Privacy Policy — Ommal

Last updated: 2026-09-02 · Requires professional legal review before final publication

1. Who we are

Ommal is independent, not operated by the Government of Jordan. Provides general information and self-help tools, not legal advice.

2. Data we collect

• Account: email, optional name, bcrypt-hashed password
• Employment: issue category, employer name (optional), job title, salary, dates — only if you provide
• Uploaded documents: contracts, slips, images, messages — stored as metadata + private storage key with short-expiry signed URL
• Evidence, timeline, plans, generated docs
• Assistant conversations: questions/answers — not retained permanently unless you save a case

3. AI processing

When you use the assistant, your description (without private docs unless you attach) is sent to OpenAI gpt-4o-mini for retrieval from public legal sources only. Private docs are never mixed into public index. Models are not trained on your data.

4. Purpose

Help you understand rights, identify evidence, organize info, and understand official procedures. Not for marketing.

5. Storage & hosting

Database: Neon Postgres (TLS in transit). Hosting: Vercel. Files: stored outside public root, short-expiry signed URL (10m) with ownership check on every download. Not security by obscurity.

6. Third-party processors

• Neon (database), Vercel (hosting), OpenAI (AI, only when you use assistant), privacy-preserving analytics (anonymous events only)

7. Retention & deletion

Private files retained until you request deletion via settings or contact. You can export/delete your case/account. Audit logs may be retained longer for legal reasons. Backups encrypted.

8. Cookies & analytics

Only necessary cookies (login). Analytics is anonymous: events like problem_started, case_created without names, salary or sensitive content.

9. Security

We apply: encrypted transport (HTTPS), hashed passwords, ownership check on every request, short signed URLs, MIME/size/magic-byte checks, filename sanitization, executable block, rate limiting, access logging. Not UI hiding only.

10. Your rights

You can access, export, correct, and request deletion. Legal requests undergo review. In case of breach, we notify affected and log incident.

11. International transfers

Data may be processed in Neon/Vercel/OpenAI data centers outside Jordan with contractual/technical safeguards.

12. Contact

For privacy/deletion: contact@ommal.wakeelypro.com — we reply within reasonable time. This policy is general information, not legal advice.

We do not claim encryption/security not actually implemented — above reflects current infrastructure.