This policy explains what personal data Uppercut Apps collects through this website and through Uppercut One, why, where it is kept, who else handles it, and what you can ask us to do with it. It is written to meet the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022) and, where a venue's customers are elsewhere, the data protection laws that apply there. If anything here is unclear, ask: [email protected].
Uppercut Apps is a software business established in Muscat, Oman. Depending on who you are, we hold your data in one of three capacities:
| What | Why | How long |
|---|---|---|
| The sign-up form: business name, your name, email, phone, city, message | To contact you about setting up the service. Lawful basis: taking steps at your request before entering a contract. | Until the request is closed, then 12 months. |
| Questions you ask the site's sales assistant | To answer them. Questions are sent to the AI model provider named in section 6 for that purpose only. | Not stored by us beyond the session; a count per visitor per day is kept for 24 hours to limit use. |
| The interactive demo | A random token in your browser identifies your private copy of the demo so nobody else sees what you typed into it. It is not linked to you. | Deleted 24 hours after you last use it. |
| Standard server logs: IP address, browser, pages requested | Security, and keeping the site running. | Held by our hosting provider for a short period. |
This site sets no advertising or analytics cookies. It stores the demo token and your preferences in your browser only.
Each venue has its own separate database. The data below is held for the venue, on its instructions, and is not shared between venues or used for anything else.
Name, email, a hashed password, login sessions, and which venues you may manage. Used to give you access and to contact you about the service. Kept while your account exists and for 12 months after.
No card numbers, no government ID numbers, no location tracking, no advertising profiles. The Assist feature answers from the venue's own data and is not used to build profiles of anyone.
Under Omani law you may ask to see the personal data held about you, to have it corrected, to have it deleted, to withdraw a consent you gave, and to object to or restrict how it is used. You may also complain to the Ministry of Transport, Communications and Information Technology, which supervises data protection in Oman.
We use a small number of providers, each for one job. Each is bound by its own terms to process data only to provide its service to us.
| Provider | What for | What they see |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting, databases, file storage, the network the service runs on | Everything the service stores, encrypted in transit and at rest |
| Resend, Inc. (USA) | Sending email: booking confirmations, receipts, staff notices, password resets | The recipient's address and the message |
| AmwalPay (Oman) | Online card payments, where a venue enables them | The payer's card details, on its own pages; the amount and a reference |
| Anthropic, PBC (USA) | The AI model behind the sales assistant, Uppercut Assist and the onboarding document reader | The question asked and the data needed to answer it, or the documents a venue uploads for setup. Not used to train the provider's models. |
| Google LLC (USA) | Web fonts on the pages | The IP address of the browser requesting the font file |
We do not sell personal data and we do not share it with advertisers. We disclose it to authorities only where the law requires us to, and we will tell the venue when we are allowed to.
Data travels encrypted (TLS) and is stored encrypted. Passwords and till PINs are stored as salted hashes, never as typed. Each venue's database is separate, and a venue's staff can reach only their own venue. Access to the platform itself is limited to the people who run it, with two-factor authentication. Repeated wrong logins and PINs are locked out. If a breach affects personal data we will tell the affected venue without undue delay and help it meet its own obligations to notify.
The service is for businesses and their adult customers. A venue that takes bookings for children records the parent or guardian as the customer. We do not knowingly collect personal data from a child.
When this policy changes we update the version and date at the top, and we tell venues by email if the change affects the data we hold for them. The current version is always at this address.