Privacy Policy

• Your account — your email address, your password stored in a form that cannot be reversed, and the name you choose to show.
• Your orders — order number, amount, payment method and status, and what you became entitled to. If you pay by transfer, the receipt you upload.
• Your delivery — when you buy a physical product: recipient name, phone number, governorate, wilayat and address. Used to get the order to you, and for nothing else.
• Your learning — your progress, challenge attempts, points and reward stamps.
• Your messages — reviews you publish and support messages you send.

We never see or store your card details at any point. They are entered directly with the payment provider, and all that reaches us is the status of the transaction and its reference.

• To do what we agreed: create the account, complete the order, and get you what you bought.
• To protect your account and the platform from misuse.
• To answer your messages.
• To meet our legal obligation to keep financial records.

We do not sell your data, rent it, or use it for advertising. It reaches only the service providers the platform runs on, and only as far as their job requires:

• Our hosting and database provider, where account, order and file data is kept.
• Our payment provider (OMPAY), to carry out card payments.
• Our email provider, to deliver account and order messages.
• The delivery company, which receives only the shipping details, and only when you buy something physical.
• The authorities, where the law requires it.

We are happy to tell you exactly which providers we use if you ask.

Your data is stored and processed outside the Sultanate of Oman, in data centres in the United States. That means it is transferred internationally, and we are telling you here before you create an account rather than afterwards.

The transfer is necessary to provide the service you are asking for: the platform runs on that infrastructure. Your rights below apply wherever your data is processed.

We use one necessary cookie to keep you signed in. There are no advertising or tracking cookies, which is why you are not shown a consent banner.

• Passwords are stored in a form that cannot be reversed.
• All traffic to the site is encrypted.
• Your paid files and receipts sit in private storage only your account can reach.
• No account can reach another account's data.

• Account and learning data: for as long as your account exists. If you ask us to delete it, we do so within thirty days.
• Order and payment records: kept for the period financial record-keeping requires, even after the account is deleted. This is an exception we cannot waive.
• Delivery details: kept with the order record, for the same reason.
• Support messages: deleted with the account.
• Published reviews: you can ask us to remove them at any time.

Under Oman's Personal Data Protection Law (Royal Decree 6/2022), you may ask to:

• See the personal data we hold about you.
• Correct anything inaccurate.
• Delete your account and data, so far as that does not conflict with keeping financial records.
• Withdraw your consent to marketing messages at any time.

The messages we send today are operational only: email confirmation, password recovery, and messages about your order. We do not send marketing messages, and will not without your prior consent.

Send a privacy request to notesharbor20@gmail.com from the address registered on your account, and we reply within thirty days at the latest. The controller of your data is Notes Harbor, a business registered in the Sultanate of Oman.

If a breach affects your personal data, we notify the competent authority and tell you at your registered email address.

This version is dated 2026-10-31. We update the date on any material change, and email account holders when a change affects how their data is processed.