Wasl Privacy Policy

Depending on the circumstances, Wasl may act either as a controller or as a processor of personal data.

When Wasl acts on behalf of a Business Customer

When an End Customer communicates with a Business Customer that uses Wasl, the Business Customer generally determines why and how the End Customer’s personal data is processed.

In these circumstances, the Business Customer generally acts as the controller of the personal data, and Wasl processes that information on the Business Customer’s behalf in order to provide the Services.

For example, if an individual sends a WhatsApp message to a restaurant using Wasl to make a reservation, Wasl may process the message, phone number, reservation information, and other information necessary to respond to the customer and complete the requested reservation on behalf of that restaurant.

Business Customers are responsible for ensuring that they have an appropriate legal basis for processing their customers’ personal data and for providing any privacy notices or obtaining any permissions required by applicable law.

When Wasl acts for its own purposes

Wasl may act as a controller when we determine the purposes and means of processing, including when processing information relating to:

• Business Customer accounts;
• account administrators and authorized users;
• billing and subscriptions;
• security and authentication;
• fraud and abuse prevention;
• support communications;
• Service administration;
• system logs;
• legal and regulatory compliance; and
• operation and improvement of the Services.

The personal data we process depends on how a person interacts with Wasl and how a Business Customer configures the Services.

A. End Customer information

When an End Customer communicates with a Business Customer using Wasl, we may process:

• name;
• telephone number;
• WhatsApp identifier;
• social media or messaging-platform identifiers;
• account or profile information made available through the relevant platform;
• messages sent to and received from the Business Customer;
• the contents of conversations;
• images, documents, audio, or other information provided within a conversation where supported;
• reservation information;
• appointment information;
• order information;
• delivery information;
• requests, preferences, questions, or instructions;
• customer-service information;
• transaction-related information;
• conversation status and history;
• timestamps and messaging metadata; and
• other information that an End Customer chooses to provide through a conversation.

Because End Customers may freely communicate with businesses, messages may occasionally contain additional categories of personal data that Wasl did not specifically request.

We ask Business Customers to configure and use Wasl in a manner that minimizes unnecessary collection of personal data.

B. Information obtained through Business Customer integrations

Where a Business Customer connects Wasl to its systems, Wasl may receive or process information from systems such as:

• reservation and scheduling platforms;
• customer relationship management systems;
• point-of-sale systems;
• order-management systems;
• e-commerce systems;
• inventory systems;
• delivery or logistics systems;
• customer databases; and
• other systems authorized by the Business Customer.

The specific information processed will depend on the integration and the actions requested by the Business Customer or End Customer.

C. Business Customer and account information

When a business or its representatives use Wasl, we may process:

• names;
• business email addresses;
• telephone numbers;
• business names;
• account identifiers;
• account roles and permissions;
• authentication information;
• configuration information;
• support communications;
• subscription or plan information;
• integration settings;
• usage information; and
• other information required to operate the Business Customer’s Wasl account.

D. Technical and security information

When individuals interact with the Wasl Services, we may automatically generate or collect information necessary to operate, secure, and troubleshoot the Services, including:

• IP addresses;
• device or browser information;
• login activity;
• authentication events;
• system events;
• request and response information;
• error information;
• security logs;
• timestamps;
• webhook and messaging events; and
• Service usage information.

The public Wasl website does not currently use advertising or behavioral tracking technologies.

We may receive personal data:

• directly from Business Customers;
• directly from individuals who contact Wasl;
• when End Customers communicate with Business Customers through WhatsApp or another connected communication service;
• from Meta and other messaging-platform providers;
• from systems connected by a Business Customer;
• automatically through the operation of our Services;
• from authentication, infrastructure, email, hosting, and technology providers; and
• from other sources where authorized by the relevant Business Customer or permitted by law.

We process personal data only for specified purposes connected with operating the Services or fulfilling the instructions of our Business Customers.

These purposes may include:

Providing AI-powered customer communication

We process messages and related information so that Wasl can understand a customer request, generate an appropriate response, and assist the Business Customer in communicating with the customer.

Completing customer requests and transactions

Depending on the Business Customer’s configuration, Wasl may use personal data to:

• answer questions;
• make, modify, or cancel reservations;
• schedule or modify appointments;
• create or update orders;
• retrieve order information;
• provide delivery information;
• check availability;
• retrieve information from connected systems;
• update connected business systems;
• escalate conversations to human employees; or
• perform other actions requested through the Services.

Operating Business Customer accounts

We process information to create and administer accounts, configure Wasl, provide support, manage permissions, connect integrations, administer subscriptions, and provide the Services.

Security and fraud prevention

We may process information to:

• authenticate users;
• prevent unauthorized access;
• detect abuse;
• investigate suspicious activity;
• protect accounts and systems;
• maintain logs;
• troubleshoot incidents; and
• preserve the security and integrity of Wasl.

Maintaining and improving the Services

We may use operational information to diagnose errors, monitor system reliability, understand Service performance, and improve Wasl.

Where appropriate, we seek to use aggregated, anonymized, or otherwise non-identifying information for analytics and improvement purposes.

Legal and regulatory obligations

We may process or preserve information where required to comply with applicable laws, lawful governmental requests, legal proceedings, regulatory obligations, or to establish, exercise, or defend legal claims.

Artificial intelligence is a central component of Wasl.

When an End Customer communicates with a Business Customer using Wasl, relevant portions of the conversation and related information may be transmitted to OpenAI through its API so that an AI model can understand the request and generate or assist in generating a response.

The information transmitted may include:

• customer messages;
• conversation context;
• relevant customer information;
• relevant information supplied by the Business Customer; and
• information retrieved from connected business systems where necessary to complete the requested task.

We seek to limit information provided to AI systems to information reasonably necessary to provide the requested functionality.

Wasl does not use Business Customer or End Customer conversations to train Wasl’s own general-purpose AI models.

Wasl may use AI-generated outputs to communicate with End Customers or assist Business Customers. Business Customers may also configure human takeover or escalation mechanisms allowing authorized employees to assume control of a conversation.

AI systems can occasionally produce incomplete or inaccurate outputs. Business Customers remain responsible for determining how Wasl is configured and used within their businesses and for supervising uses of the Services appropriate to their activities.

The legal basis applicable to particular processing depends on the nature of the information, the purpose of processing, and whether Wasl is acting as a controller or on behalf of a Business Customer.

Where applicable, processing may be based on:

• performance of an agreement or provision of requested services;
• consent;
• compliance with applicable legal obligations;
• the actual interests of the data subject where permitted by law; or
• legitimate interests permitted under applicable law, such as maintaining network and information security, preventing abuse, protecting the Services, and operating Wasl, where those interests do not improperly prejudice the rights and interests of individuals.

Where Wasl processes personal data solely on behalf of a Business Customer, the Business Customer is generally responsible for establishing the applicable legal basis for that processing.

Where sensitive personal data is processed, Wasl and its Business Customers must apply any additional requirements imposed by applicable law.

Certain information is necessary for Wasl to provide particular Services.

For example, a telephone or messaging identifier may be necessary to maintain a conversation, while reservation information may be necessary to create a reservation.

Individuals are not generally required to provide information unrelated to the service or request they are making.

If information necessary to complete a requested service is not provided, Wasl or the relevant Business Customer may be unable to respond to or complete the request.

Wasl relies on third-party technology providers to operate the Services. Personal data may be disclosed to or processed by these providers where necessary to provide their services to Wasl.

Current providers include:

• OpenAI — artificial intelligence processing and generation.
• Meta / WhatsApp — transmission and processing of WhatsApp communications and related messaging information.
• Supabase — database, authentication, and related infrastructure services. Wasl currently uses Supabase database infrastructure located in Mumbai, India.
• Railway — server and application infrastructure. Wasl currently uses Railway infrastructure located in the United States.
• Vercel — hosting and delivery of Wasl web properties and related application infrastructure.
• Resend — delivery of account-related, authentication, support, and other service emails.

These providers may process information according to their respective agreements with Wasl and, where applicable, their own privacy and security obligations.

We may add, replace, or remove service providers as Wasl develops. Where required, we will update this Privacy Policy or other applicable disclosures.

We may also disclose personal data:

• to a Business Customer on whose behalf the information is processed;
• to authorized employees or representatives of that Business Customer;
• when a Business Customer directs us to interact with a connected system;
• where required by applicable law or a lawful governmental request;
• to protect the security or legal rights of Wasl, its users, or others; or
• in connection with a business restructuring, financing, merger, acquisition, or transfer, subject to applicable legal requirements.

Wasl does not sell personal data.

Wasl currently uses technology infrastructure located both inside and outside the region in which an individual may be located.

Personal data processed through Wasl may therefore be transferred to, stored in, or otherwise processed outside the Kingdom of Saudi Arabia.

Our current infrastructure includes processing in locations such as:

• India, including Wasl’s current Supabase database infrastructure in Mumbai; and
• the United States, including infrastructure and services used to operate Wasl and provide AI and messaging functionality.

Other service providers may process data in additional locations in accordance with their infrastructure and contractual arrangements.

Where Saudi personal data is transferred or disclosed outside the Kingdom, Wasl intends to implement the requirements and safeguards applicable under the Saudi PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.

Wasl may modify the geographical location of its infrastructure and service providers over time.

Wasl retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, including:

• providing the Services;
• maintaining Business Customer accounts;
• maintaining conversation and transaction history requested by Business Customers;
• providing customer support;
• maintaining system security and reliability;
• resolving disputes;
• enforcing agreements; and
• complying with applicable legal obligations.

The appropriate retention period may vary depending on the type of information and the instructions of the relevant Business Customer.

For information processed on behalf of Business Customers, retention may also be determined by the Business Customer’s configuration, instructions, or legal obligations.

Wasl is developing more detailed retention and deletion controls as the Services evolve.

When personal data is no longer required, Wasl will seek to securely delete, destroy, anonymize, or otherwise render the information non-identifiable in accordance with applicable law and our technical capabilities.

Information may remain temporarily within backups or disaster-recovery systems until those copies are overwritten or deleted through normal backup lifecycle processes.

Wasl uses technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, destruction, loss, or misuse.

These measures may include, as appropriate:

• authentication controls;
• account permissions and role-based access;
• separation of Business Customer data;
• access controls;
• secure management of credentials and secrets;
• encrypted network communications;
• database security controls;
• logging and monitoring;
• webhook and API security controls;
• incident detection;
• backup and recovery procedures; and
• other security practices appropriate to the nature of the Services.

No information system can be guaranteed to be completely secure. We continuously seek to improve Wasl’s security as the platform develops.

Business Customers are also responsible for protecting their accounts, credentials, connected systems, employee access, and devices.

If Wasl becomes aware of a personal data breach, we will investigate the incident and take appropriate measures to contain and remediate it.

Where required by applicable law, Wasl will cooperate with affected Business Customers and applicable authorities regarding required notifications or other response measures.

Where Wasl processes affected information on behalf of a Business Customer, Wasl will provide relevant information to the Business Customer as appropriate to allow it to fulfill its obligations as controller.

Subject to the Saudi PDPL and other applicable law, individuals may have rights concerning their personal data, including the right to:

• be informed about the legal basis and purposes for processing personal data;
• access personal data held about them;
• request a copy of their personal data in a readable and clear format;
• request correction, completion, or updating of inaccurate or incomplete personal data;
• request destruction of personal data where applicable; and
• withdraw consent where processing is based on consent, subject to applicable legal limitations.

Certain rights may be restricted where permitted or required by law.

Information processed for a Business Customer

If your information was collected because you communicated with a business using Wasl, the relevant Business Customer is generally the controller of that information.

You may therefore wish to contact that business directly regarding your privacy request.

Wasl will reasonably assist Business Customers in responding to valid data-protection requests as required by applicable law and our agreements with those businesses.

Information controlled by Wasl

For information for which Wasl acts as controller, privacy requests may be submitted to rayan@withwasl.com.

We may need to verify your identity before fulfilling a request in order to protect personal data from unauthorized disclosure or deletion.

Wasl is not designed to require End Customers to provide sensitive personal data unless such information is necessary for a lawful service provided by the relevant Business Customer.

However, because individuals may communicate freely through messaging platforms, they may voluntarily include sensitive information within conversations.

Business Customers are responsible for configuring their use of Wasl appropriately for the information they expect to process.

Where sensitive personal data is processed through Wasl, it must be processed only where permitted under applicable law and subject to any additional safeguards, permissions, or legal bases required for that category of information.

Wasl is currently designed primarily for customer-service and transactional communications, including responding to customer inquiries, managing reservations or appointments, processing orders, providing updates, and completing related business requests.

Wasl does not currently provide its Services for unsolicited direct marketing communications.

A conversation may nevertheless contain information about products, services, availability, pricing, recommendations, or potential purchases where that information is relevant to a customer’s inquiry or transaction.

If Wasl introduces dedicated direct-marketing functionality in the future, additional consent, opt-out, and other controls may apply.

Wasl is a business communication platform and is not specifically directed toward children.

Business Customers that provide services to children or individuals who lack full legal capacity are responsible for ensuring that their use of Wasl complies with applicable requirements, including any requirements relating to consent from a parent or legal guardian.

If we become aware that personal data has been processed in circumstances that violate applicable law, we may take appropriate steps to delete or otherwise address that information.

Business Customers using Wasl are responsible for using the Services in accordance with applicable laws and their own obligations as controllers of personal data.

This may include responsibility for:

• providing appropriate privacy notices to their customers;
• determining appropriate legal bases for processing;
• obtaining consent where required;
• limiting collection to information reasonably necessary;
• responding to data-subject requests;
• configuring integrations appropriately;
• ensuring employees access personal data only where authorized; and
• ensuring that their use of AI and automated functionality is appropriate for their business.

Wasl is an evolving service. We may update this Privacy Policy as our Services, infrastructure, integrations, business practices, or legal obligations change.

When we make changes, we will update the “Last Updated” date at the top of this Privacy Policy.

Where required by law or where changes materially affect how personal data is processed, we may provide additional notice.

Questions, concerns, or requests regarding this Privacy Policy or Wasl’s processing of personal data may be submitted to:

For information processed by Wasl on behalf of a Business Customer, individuals may also contact the relevant Business Customer directly.