Privacy

Last updated: 13 October 2026.

This policy explains what personal data Decree collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to decree.om and arabic.decree.om, the Decree apps for iPhone, iPad and Android, Lex AI, the Decree connector for AI assistants at mcp.decree.om, and our newsletter.

Who we are

Decree is operated by Decree Tech LLC, a company registered in the Sultanate of Oman. We are the controller of the personal data described in this policy.

If you have any question about your personal data or your rights, you can contact our data protection officer at the addresses at the end of this policy.

Data we collect

Your account

When you register, or when your organisation registers you, we collect your name, job title, organisation, and email address. You sign in with a one-time code or link that we send to your email address, and we record when you sign in.

Newsletter

When you subscribe to our newsletter, we collect your name, job title, organisation, and email address.

Lex AI

Lex AI is our legal research assistant, available on our websites and in our apps. When you ask Lex AI a question, we store the conversation: your questions, the answers given, the sources cited, and the time of each message, linked to your email address. With each question we also store the type and version of the browser or app you used, your device language, the page you asked from, and your IP address. If you rate an answer with a thumbs up or down, we store that rating.

Decree connector for AI assistants

The Decree connector lets AI assistants such as Claude and Cursor search Omani legislation on your behalf. When you connect it, we record your email address, your organisation, and the name and version of the assistant you connected. For each search the assistant makes through the connector we keep a log entry containing the search terms, the documents returned, the outcome, the response time, and the assistant’s identifier. Organisations with a licence can ask us to log their members’ searches as a fingerprint only, or not at all. We also keep a record of failed sign-in attempts, including the IP address and client used, to protect the service from abuse.

Decree apps

The Decree apps for iPhone, iPad and Android collect the same data as Lex AI on the website, together with your device platform and operating system version. If you enable notifications, we store a notification token for your device. The apps do not contain advertising, analytics, or crash-reporting software.

If you dictate a question, the speech recognition is performed by the speech service of your device (Apple on iOS and macOS, usually Google on Android), which may process the audio on your device or on that provider’s servers under that provider’s privacy policy. We receive only the resulting text, never the audio.

Website analytics

Our websites use Google Analytics, which collects a limited amount of information that does not identify you, such as your approximate location, device, and browser type. Our websites are delivered through Cloudflare’s global network, which processes your IP address to serve and protect the site.

How we collect your data

We collect data directly from you when you register, subscribe, sign in, use Lex AI, or connect an AI assistant, and from your organisation when it registers you or subscribes to our service on your behalf.

How we use your data

We use your data to:

  • Provide the service, including answering your questions in Lex AI and returning search results to your AI assistant.
  • Let you return to your earlier conversations.
  • Improve Lex AI. Our team reviews questions and answers to check the accuracy of the answers, find questions the service could not answer well, and improve the legal content and the way it is retrieved.
  • Keep the service secure, apply usage limits, and detect abuse.
  • Send you the newsletter if you have subscribed, and communicate with you about your account and the service.
  • Produce aggregate statistics about how the service is used.

We do not sell your data, and we do not use it for advertising.

AI processing and the providers we use

Lex AI and the Decree connector are built on large language models and search services operated by other companies. To answer a question or run a search, we send the relevant content to the following providers, each of which processes it only to return a result to us, under business terms that exclude the use of that content to train their models:

  • Google (Gemini API) receives your question, the conversation so far, and the legal text we retrieve, and generates the answer.
  • OpenAI receives the search text derived from your question in order to convert it into a search vector, and the opening words of your first question in order to generate a conversation title. In the apps, if our main answering pipeline fails, the conversation is sent to OpenAI to generate the answer instead.
  • Cohere receives the search text and the candidate passages of legislation in order to rank them by relevance.
  • Pinecone stores our search index and receives only numeric search vectors, never the text of your question.

We also rely on the following service providers to run the service:

  • Google Cloud and Firebase host Lex AI, the Decree connector, the apps’ backend, and the data described above, in the United States.
  • Google Workspace sends our sign-in codes and account emails.
  • Apple and Google deliver push notifications to the apps and provide on-device dictation.
  • Vultr hosts our websites, currently on servers in the European Union, and Cloudflare delivers and protects them through its global network.

Apart from these providers, we do not share your data with third parties, unless we are required to by law.

Organisation licences

If you access Decree through a licence held by your organisation, we may provide your organisation with reports on its members’ usage of the service, and your organisation may choose how much of its members’ connector activity we log.

How long we keep your data

  • Account data is kept for as long as your account exists, and as required by law after that.
  • Lex AI conversations are kept until you delete them. When you delete a conversation in Lex AI, its messages are removed and we keep only a record that the conversation existed and when it was deleted. You can ask us to delete all of your conversations together with your account.
  • Connector search logs are deleted after 90 days. Failed sign-in records are deleted after 30 days. Sign-in codes expire within minutes, and sign-in tokens expire within 30 days. We keep daily aggregate statistics, which may include a small sample of searches that returned no results, to improve the service.
  • Notification tokens are kept until you sign out or disable notifications.
  • Newsletter data is kept until you unsubscribe.

Your rights

You have the right to:

  • Request that your personal data be corrected or updated.
  • Request a copy of your personal data.
  • Delete your Lex AI conversations yourself at any time.
  • Request the deletion of your account and the data linked to it.
  • Unsubscribe from the newsletter at any time using the link in each email.

To exercise any of these rights, contact our data protection officer.

Security

All data is encrypted in transit. Sign-in tokens are stored in hashed form. Access to stored conversations and logs is limited to members of our team who need it to operate and improve the service.

Breach

We will notify you of any data breach that affects your personal data.

Location of processing

Your data is processed outside Oman. Lex AI, the Decree connector, and the apps’ backend run on Google Cloud in the United States, and the AI providers listed above process content in the United States. Our websites are hosted by Vultr, currently on servers in the European Union; we may move them to another Vultr region when needed to keep the service reliable, and will update this page when we do. Cloudflare serves cached copies of our public pages from its data centres around the world, including in Oman.

Changes to this policy

We will update this page when our practices change and show the date of the latest revision at the top. Material changes will be announced to registered users by email.

Data protection officer

You can contact our data protection officer at the following addresses:

Email: [email protected]
Telephone: +968 9111 5320