Privacy Policy

1. Personal data we collect

From Customers (the businesses that use the service):

• Account details: name, email, business name, role, login identifiers.
• WhatsApp connection details: WABA ID, phone number ID, display phone number, connection method (coexistence or migration), connection status.
• Billing details via our payment processor: name, billing info, and limited card data (we do not store full card numbers; Stripe handles payment data).
• Communications: messages, support requests, and anything you send us.
• Attribution: how you first reached us (the campaign, or the name of the site that referred you, such as a search engine or social network) and, if you reached us through one of our ads, that platform's ad-click identifier (Google's gclid, Meta's fbclid, TikTok's ttclid or Snapchat's ScCid), which is removed from your account after 90 days.

From website visitors:

• Cookies and similar technologies (including Google Analytics and the Meta, TikTok and Snapchat advertising pixels, loaded through Google Tag Manager on the marketing website only), usage and log data such as IP address, browser type, pages visited. See "Cookies" below.
• Information you submit in forms (for example, a contact or waitlist form: WhatsApp number, email).

Contacts/customers of the Customer ("Subscribers"): processed on the Customer's behalf, not for our own purposes:

• The Customer's contacts message the Customer's WhatsApp number; we process those conversations, contact details (for example, WhatsApp number and name), and any information the Customer chooses to collect through its own configured questions.
• The Customer decides what to collect from its contacts. Connect Wasl does not impose or default any specific questions. The Customer is the controller of this data and is responsible for having a lawful basis and any required consent to collect and process it. We process it only on the Customer's instructions (see the DPA).

We ask Customers and users not to send us sensitive personal data except where strictly necessary and lawful.

2. How we use personal data (our own purposes)

• To create and operate accounts and provide the service.
• To process payments and meet billing and accounting obligations.
• To communicate about the service (security, technical, and administrative notices) and, where permitted, service-related updates you can opt out of.
• To provide support and respond to requests.
• To maintain security, prevent fraud and abuse, and enforce our terms.
• To measure our advertising (see section 3, "How we share personal data").
• To comply with legal obligations.

3. How we share personal data

We do not sell personal data. We share it with:

• Sub-processors / service providers who help us run the service:
  • Supabase: database and media storage (hosted in Frankfurt, Germany / EU).
  • Meta (WhatsApp Business Platform): the messaging channel the service runs on.
  • Anthropic: AI replies, only when a business enables the AI assistant (United States).
  • Upstash: queue for broadcast and automation scheduling (United States).
  • Stripe: payment processing.
  • Resend: transactional email delivery (for example, account and waitlist notifications).
  • Sentry: error monitoring.
  • Cloudflare: content delivery, security, and bot protection.
  • Vercel / Render: application and website hosting.

  See our full sub-processor list for purposes and regions.

• Advertising platforms, for advertising measurement (Meta, TikTok, Snapchat). If you reached us through one of our ads, we tell that platform that a sign-up or a WhatsApp connection followed, and (Meta and TikTok only) that a meeting was booked or a payment followed, using the ad-click identifier from your visit and standard browser information (for Snapchat this includes the IP address, which it needs to recognise the click). We never send your name, email address or phone number, and nothing about your contacts or conversations. A platform whose ad did not bring you receives nothing.
• Google Analytics, to measure our website and sign-ups, including when a payment or a booked meeting follows (sent from our servers). Never your name, email address or phone number.
• Professional advisors (lawyers, accountants) where necessary.
• Authorities where required by law.
• In a business transfer (merger, acquisition), subject to this Policy.

4. Where data is stored and international transfers

Our primary data store (Supabase) is located in Frankfurt, Germany (EU). Some sub-processors are incorporated in the United States (for example, Anthropic for AI replies, Upstash for scheduling, and Meta), so some data is processed there. We rely on Saudi Standard Contractual Clauses and data minimization as safeguards. See our sub-processors page.

Because Customers and their contacts may be located in Saudi Arabia and the wider Gulf, and our infrastructure is in the EU and elsewhere, personal data may be transferred across borders. Where it is, we rely on appropriate safeguards (for example, Standard Contractual Clauses) and take steps to ensure an adequate level of protection.

5. Your data protection rights

Depending on your jurisdiction, you may have rights to access, correct, delete, object to or restrict processing, withdraw consent, port your data, and complain to a data protection authority. To exercise these, contact info@connectwasl.com.

Requests from a Customer's contacts: if you are a contact/customer of a business that uses Connect Wasl, your relationship is with that business. We process your data on their behalf and have no direct relationship with you. Please direct access, correction, and deletion requests to that business. We will assist them in responding as required.

6. Retention

We retain personal data only as long as necessary for the purposes above and as required by law. When an account is closed we soft-delete it and retain it for 30 days (in case of accidental deletion or a dispute), then securely purge it, unless a longer period is legally required.

Ad-click identifiers are cleared from your account 90 days after it was created.

7. Children's data

Connect Wasl is a business tool sold to businesses. It is not directed to children, and we do not knowingly collect personal data directly from children for our own purposes.

Customers use Connect Wasl to communicate with their own contacts. The Customer controls what information it collects through its own configured questions. Where a Customer chooses to collect information that may relate to a minor (for example, a child's age), the Customer is the controller of that data and is responsible for having the appropriate lawful basis and any required parental consent. Connect Wasl processes such data only on the Customer's instructions.

8. Security

We take reasonable technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, tenant isolation (row-level security), and two-factor authentication for owners. No system is 100% secure. In the event of a personal data breach likely to risk your rights, we will notify affected parties without undue delay, as required by applicable law.

9. Cookies

We use cookies and similar technologies on our marketing website, including Google Analytics and the Meta, TikTok and Snapchat advertising pixels, loaded through Google Tag Manager. We load no advertising pixels inside the application itself. To credit a sign-up to the right campaign, the website keeps a record of how you first reached us and of your latest ad click on each platform in your browser (local storage, until you clear site data or your browser removes it, which some browsers do on their own after a period without visits) and the application sets a first-party cookie (cw_attr, 30 days). You can control cookies and site data through your browser settings.

10. Changes to this Policy

We may update this Policy. We will post the new effective date and, where required, obtain consent for material changes.

11. Contact

Connect Wasl LTD
Email: info@connectwasl.com