Privacy Policy

This Privacy Policy explains how Suhoolah, operated by NOAH INTERNATIONAL SPC under the A11y Oman brand in the Sultanate of Oman, processes personal data in connection with a11y.om, Suhoolah accounts, accessibility scanning, reports, scheduled monitoring, developer APIs, integrations, browser extensions, support and related services.

This Policy should be read together with any product-specific privacy notice, Data Processing Agreement, order form or other privacy terms that apply to a particular service. The Suhoolah Accessibility Scanner browser extension may have an additional extension-specific privacy notice.

1. Our role

For account administration, billing, support, security, service operations and our own business communications, Suhoolah generally determines why and how personal data is processed and acts as a controller where applicable.

When an organizational Customer submits websites, application content, files or other Customer Data for testing and that material contains personal data, Suhoolah may process that personal data on the Customer's instructions in order to provide the contracted service. In that context, the Customer generally determines the purpose of the processing and Suhoolah may act as a processor, subject to applicable law and any Data Processing Agreement.

2. Personal data and information we process

The information processed depends on how you use Suhoolah. It may include:

• Account and identity information: name, email address, organization, role, account identifiers and account settings.
• Authentication and security information: password-related security records, login events, session information, failed-login records, IP address, device or browser information and security events.
• Subscription and transaction information: selected plan or service, transaction status, invoice or order information, payment references and limited billing information received from a payment provider. Payment card information entered directly into a third-party checkout is subject to that provider's handling practices.
• Scan and audit information: submitted URLs, scan scope and settings, pages tested, accessibility findings, technical evidence, issue history, scores, manual-review indicators and generated reports.
• Website or application content processed for testing: page structure, markup, accessibility-related attributes and other content made available to the scanner as needed to perform the requested assessment. Depending on the target page, this content could contain personal data chosen or exposed by the Customer.
• Scheduled monitoring information: scan targets, schedules, notification settings, history and associated results.
• Developer API and integration information: API account identifiers, credential identifiers, request metadata, job IDs, integration configuration, webhook destinations where supported, timestamps, response and error information, and other technical records needed to provide and secure the integration.
• Browser-extension information: the current page URL, page or navigation content required for a user-requested scan, scan results, authentication state and technical information necessary to operate and secure the extension. The separate extension privacy notice provides additional detail.
• Support and communications: messages, support tickets, attachments, feedback and records of communications with us.
• Service and diagnostic information: system logs, request records, performance information, error data and audit trails used for reliability, troubleshooting, security and abuse prevention.

3. How we obtain information

We obtain information directly from users and Customers, automatically from use of the Services, from systems connected by an authorized Customer, from scan targets submitted by a Customer, and from service providers that support functions such as payment processing or communications.

Suhoolah does not require a Customer to intentionally provide personal data about visitors to a scanned website merely to run an accessibility test. Customers should avoid submitting unnecessary personal or confidential information and should use appropriate non-production or test environments where that is more suitable.

4. Why we process information

We process information to:

• create and administer accounts and authenticate users
• perform accessibility scans and requested testing
• generate, store, display, export and share reports as directed by the Customer
• operate scheduled scans, dashboards, issue history and notifications
• provide APIs, integrations and browser-extension functionality
• process purchases, subscriptions and service orders
• respond to support requests and provide service communications
• protect accounts, detect abuse, investigate security events and maintain system integrity
• diagnose failures, maintain and improve service reliability, accessibility and usability
• comply with legal, regulatory, accounting and dispute-resolution obligations
• send commercial marketing only where the required consent or other lawful permission has been obtained

5. Legal grounds and consent

Where the Omani Personal Data Protection Law applies, Suhoolah processes personal data in accordance with the Personal Data Protection Law promulgated by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and the Executive Regulation issued under Ministerial Decision 34/2024.

Depending on the processing activity, processing may be based on explicit consent, performance of a contract, compliance with a legal obligation, processing of lawfully public data or another basis permitted by applicable law. Where consent is required, we will seek it in a clear manner and maintain appropriate evidence of the consent.

6. Customer-controlled scan content

Customers decide which authorized digital properties are submitted to Suhoolah. If a scan target contains personal data, confidential information or information belonging to another party, the Customer is responsible for having the legal authority to make that information available for the requested processing.

Suhoolah processes scan content to provide the requested accessibility service, to secure and troubleshoot that service, and for other purposes agreed with the Customer or required by law. We do not sell Customer Data.

7. Automated processing

Suhoolah uses automated processing to identify accessibility-related issues, organize findings, calculate scores and generate technical outputs. These outputs concern the accessibility characteristics of digital content and are intended to support remediation and human review.

Suhoolah does not intend its accessibility-scanning automation to make legal or similarly significant decisions about an identifiable natural person. Where applicable law gives a person the right to object to an automated decision concerning that person, requests may be submitted through the contact process below and will be reviewed with human involvement as required.

8. Reports and sharing

Reports and scan results are normally associated with the relevant account and made available to authorized users. A Customer may choose to export a report, provide it to another person, or enable a supported public or shareable report link. Once a Customer independently shares an exported report, the recipient's handling of that copy is outside Suhoolah's control.

9. Payments

Where online payment is available, a third-party payment provider such as Thawani may process payment information. Suhoolah may receive information necessary to confirm and administer a transaction, such as a transaction reference, status, amount and associated order information. The payment provider processes information under its own privacy and security terms.

10. Service providers and subprocessors

We may use service providers to support hosting or infrastructure, payment processing, email delivery, security, monitoring, support, document generation or other operational functions. They may process information only to the extent necessary for their assigned function and subject to applicable contractual and legal requirements.

Where Suhoolah acts as a processor for an enterprise Customer, material subprocessors and any Customer-specific requirements may be addressed in a Data Processing Agreement or subprocessor notice.

11. International transfers

Some providers or integrations may process or store information outside the Sultanate of Oman. Where personal data is transferred outside Oman, Suhoolah will apply the requirements and safeguards required by the Omani Personal Data Protection Law and its Executive Regulation where those rules apply.

Enterprise Customers may request available information about material processing locations and applicable transfer arrangements.

12. Cookies, sessions and similar technologies

Suhoolah may use cookies, session identifiers or similar technologies that are necessary for authentication, account security, language or interface preferences and operation of the Services. If optional analytics, marketing or other non-essential technologies are introduced, they will be addressed through appropriate notice and consent controls where required.

13. Data retention and deletion

We retain personal data only for as long as needed for the purpose for which it is processed, subject to legal obligations, disputes, security needs and documented Customer requirements. Under applicable Omani law, personal data must be erased when the purpose of processing ends, subject to permitted exceptions such as an existing dispute or a legal retention obligation.

Operational retention may differ by data category. Account information is retained while needed to administer the account. Scan history and reports are retained according to the service configuration, Customer instructions, applicable plan and legitimate operational requirements. Security and diagnostic records are retained for periods appropriate to investigation, abuse prevention and system integrity. Transaction and accounting records may be retained for legally required periods.

Where Suhoolah processes Customer Data as a processor, deletion and return arrangements may be governed by the applicable Customer agreement or Data Processing Agreement.

14. Security

We use technical and organizational measures designed to protect personal data and Customer Data against unauthorized access, disclosure, alteration, loss and misuse. Measures may include authentication and authorization controls, access restrictions, security logging, network and application protections, credential controls, backups and operational monitoring as appropriate to the service.

No online system can be guaranteed completely secure. Customers are responsible for protecting their own devices, user accounts, passwords, API credentials, integrations and any exported copies of Suhoolah reports.

15. Personal data breaches

We maintain procedures for assessing and responding to suspected personal-data incidents. Where an incident triggers notification duties, Suhoolah will notify the competent authority and affected data subjects in accordance with the applicable legal requirements and prescribed procedures.

Where Suhoolah acts as a processor, we will also follow applicable contractual notification duties to the relevant Customer.

16. Your privacy rights

Subject to applicable law and any permitted limitations, a data subject may have rights to:

• withdraw consent without affecting processing that lawfully occurred before withdrawal
• request amendment, updating or blocking of personal data
• obtain a copy of processed personal data
• request transfer of personal data to another controller
• request erasure of personal data where applicable
• receive required notice of a personal-data breach and the actions taken
• object to qualifying decisions resulting from automated processing and request human review where the law provides that right
• submit a complaint to the competent authority where the person believes processing does not comply with applicable data-protection law

To exercise a right relating to data controlled directly by Suhoolah, contact us using the method below. If the request concerns personal data processed by Suhoolah solely on behalf of an organizational Customer, we may refer the request to that Customer or assist the Customer as required.

17. Children

Suhoolah is primarily intended for professional, organizational and developer use. We do not knowingly invite children to create paid or developer accounts without appropriate authorization. Where the processing of a child's personal data is subject to Omani law, the required guardian approval or other legally permitted condition must be satisfied.

18. Marketing communications

Transactional messages concerning accounts, scans, security, service changes, purchases and support are service communications. Commercial advertising or marketing communications will be sent only with the explicit consent required by applicable law. A person may withdraw marketing consent through the method provided in the communication or by contacting us.

19. Product-specific notices

Some products or integrations may require additional privacy information because they process different data or operate within another platform. Product-specific notices, including the Suhoolah Accessibility Scanner Privacy Policy, should be read together with this Policy.

20. Changes to this Privacy Policy

We may update this Policy when our Services, processing activities, service providers or legal obligations change. The effective date will be updated on this page. Where required by law or appropriate because a change materially affects individuals, we will provide additional notice.

21. Contact and privacy requests

Privacy questions, rights requests and complaints may be submitted through the Suhoolah contact page. Requests should provide enough information for us to identify the relevant account or processing activity without unnecessarily sending sensitive information.

If you are not satisfied with our handling of a matter, you may also have the right to submit a complaint to the Ministry of Transport, Communications and Information Technology in accordance with applicable Omani law.