Privacy Policy

Last updated: May 2026

1. Who we are

Best Muscat (the "Service", "we", "us") is an online business directory for Muscat, Oman, operated at bestmuscat.com. We help visitors discover restaurants, hotels, services and other businesses, and we let owners claim and manage their listings.

2. Information we collect

Visitors (no account)

• Standard request logs from our hosting provider (IP address, user agent, page accessed, timestamp) for security and abuse prevention. We do not link these to individuals.
• Optional analytics (page views) collected via privacy-preserving aggregation.
• Cookies as described in section 5.

Account holders (free sign-up)

• Your email address (required) and an optional display name.
• A hashed password — we never store it in plain text.
• Records of business listings you have claimed.
• Booking requests you make on behalf of customers (if any).

Paying owners (active subscription)

• All of the above, plus billing-related metadata (subscription status, plan, renewal date).
• Photos you upload for your listing (stored in Cloudflare R2).
• Edits you make to your business information (audit log).
• Payment card data is handled entirely by Stripe. We never see or store your card number, expiry, or CVC.

3. How we use the information

• To operate the directory, authenticate you, and let you manage listings.
• To process subscription payments (via Stripe) and notify you of important account events.
• To send transactional emails (welcome, password reset, claim approval, edit/photo approval).
• To prevent abuse (rate-limiting, blocking malicious traffic).
• To improve search and content quality (e.g., generating editorial copy from AI partners using only the public business facts we already display).

4. Third parties we share data with

• Stripe (payments) — processes your card and stores billing data per Stripe's privacy policy.
• Resend (email delivery) — sends transactional emails on our behalf.
• Cloudflare (hosting, CDN, storage) — operates the infrastructure that serves the site and stores uploaded photos.
• Groq (AI) — receives the public name, category and existing description of a business to generate editorial copy. No personal data is sent.
• OpenStreetMap — public open data we incorporate; no personal data exchanged.

We never sell your personal information to anyone.

5. Cookies

We use a small number of cookies:

• bm_session — keeps you signed in after login (httpOnly, Secure, 30-day expiry).
• An optional consent flag stored locally in your browser to remember that you've dismissed our cookie notice.

We do not use third-party advertising or tracking cookies.

6. Data retention

• Account data: kept while your account is active, deleted on request (see section 7).
• Subscription/billing records: kept for as long as required by Stripe and applicable tax law.
• Server logs: typically retained 30 days.
• Photos: kept while approved on a listing; removed if you delete them or if an admin moderates them out.

7. Your rights

You may request:

• A copy of the personal data we hold about you.
• Correction of inaccurate information (or do it yourself in your dashboard).
• Deletion of your account and associated data. You can sign in and delete it yourself, or email us to do it for you.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect their personal data.

9. Changes to this policy

If we make a material change, we will update the "Last updated" date at the top and, where appropriate, notify account holders by email.

10. Contact

For privacy questions, write to hello@bestmuscat.com.