Privacy Policy

Wasl is a customer-support automation platform for messaging channels (Messenger, Instagram, WhatsApp Business, Threads, Telegram, TikTok and a website chat widget), operated by Growth Media «to be completed with the legal entity name». Businesses (we call them “workspaces”) use it to serve their own customers. This page explains what personal data we process and why, who it reaches, how long we keep it and how it is deleted.

• For data about Wasl users themselves (workspace owners and support agents) we are the controller: account, membership, sessions, billing.
• For the conversations of a workspace’s own customers, the workspace is the controller and we are its processor. We never use that data for our own purposes.
• In Meta terms we operate as a Tech Provider: each business messages its customers through its own assets (its Page, Instagram account and WhatsApp number), and each client’s Platform Data is kept segregated from every other client’s.

About a Wasl user (agent or workspace owner):

• Name, email address and password (hashed, never in clear text) when the account is created.
• Workspace memberships and role, sign-in history, sessions and IP address for security and rate limiting.
• Channel credentials connected to the workspace — encrypted with AES-256-GCM and never displayed again after saving.

About a workspace’s customer (someone who messages it on a connected channel):

• Inbound and outbound message content (text, image, audio, video, file, location), timestamps and delivery state.
• Their identifier on that platform and the display name the platform itself provides.
• What is derived from the conversation in order to serve them: contact details they mention, an intent/segment/journey stage, and facts the AI remembers so it can continue the same conversation — never shared with another workspace.

Knowledge files a workspace uploads to train its assistant (text, FAQs, website pages, PDF and Word documents) are the business’s own knowledge, not personal data about an individual.

When a workspace connects its Facebook Page, Instagram professional account or WhatsApp Business number — always through an explicit authorization by the owner of that asset — we receive only what a support inbox needs:

• Messenger and Instagram inbound messages, the sender’s page-scoped or Instagram-scoped identifier (PSID/IGSID) and display name, and comments on the Page’s or account’s posts.
• WhatsApp messages sent to the connected number, the sender’s phone number and WhatsApp profile name, and delivery/read statuses.
• Data about the asset itself: Page/account/number name, quality rating and messaging limits, and approved message templates.
• Access tokens needed to send messages and subscribe to webhooks — encrypted at rest and dropped immediately when the channel is disconnected or the app is deauthorized.

We use it for one purpose: showing the conversation to the workspace’s agents, replying to it, and automations the workspace itself configures. We do not sell or license Platform Data, do not use it for advertising or to build profiles of people, do not use it to train general-purpose AI models, and never share one client’s data with another — as required by the Meta Platform Terms.

• Performance of our contract with you (running your account, workspace and subscription).
• The consent a customer gives the business when they start a conversation on its channel — this opt-in is also Meta’s own requirement and is the business’s responsibility to obtain and keep evidence of.
• Our legitimate interest in the security of the platform and preventing abuse.
• Legal obligations (invoicing, tax, keeping records of processing).

We use service providers that process data on our behalf under a written contract imposing equivalent obligations, each receiving only what its function requires:

• Hosting, database and object storage: Contabo servers in Germany — conversations and attachments live there.
• The messaging platforms themselves (Meta for Messenger, Instagram, WhatsApp and Threads; Telegram; TikTok), for sending and receiving, under their own privacy policies.
• TikTok data specifically: when you connect a TikTok account we store the encrypted access token, the account identifiers (open_id, union_id), display name and avatar, and the list of your public videos with their titles and counts (views, likes, comments, shares) to show them in your dashboard — no messages and no comments. They are kept until you disconnect (in Wasl, or in TikTok ⇒ Settings ⇒ Manage app permissions); on disconnection the token is deleted immediately and video data within 30 days.
• AI model providers (Anthropic, or an OpenAI-compatible provider the workspace chooses) for generating replies, and a speech-to-text provider for voice messages. Each workspace chooses its provider and key, or uses the platform default.
• Outbound email (verification, invitations, alerts): SMTP at Hostinger.
• Encrypted backups: the operator’s Google Drive storage.
• Payments (Moyasar) for subscription billing — card data is never stored on our servers.

This list changes as the operation changes; we update this page on every material change.

Our servers are in Germany, and the AI providers and messaging platforms are also outside the Kingdom of Saudi Arabia, so processing takes place abroad. Transfers are made under the Saudi Personal Data Protection Law and its Regulation on Personal Data Transfer outside the Kingdom: to perform the contract, under contractual safeguards with each provider, and with a risk assessment before any new provider is added. «to be completed with the legal entity name» — the exact safeguard instrument (standard contractual clauses or equivalent) is completed with the contracting entity’s name.

• Workspace conversations and knowledge: for as long as the workspace exists — it is its own record of customer service. Deleted when the workspace is deleted (section 9).
• Raw webhook envelopes received from the platforms: kept for processing and reconciliation, and deleted immediately for a person who requests deletion.
• Audit log: retained after an account is deleted, unlinked from any name identifying its subject, for security and accountability.
• Backups: expire with their rotation, within thirty days of deletion.
• Channel access tokens: deleted the moment a channel is disconnected or the app is deauthorized on Meta.

• To be informed about what is processed, on what basis and for what purpose — this page.
• To access your data and receive it in a clear, readable format: a workspace owner can export everything from workspace settings at any time.
• To have your data corrected or updated.
• To request destruction when the data is no longer necessary — see the data deletion page.
• To withdraw consent at any time, without affecting processing already carried out.

We respond within thirty days, extendable once with notice if the request requires it. If you messaged a business through Wasl, that conversation belongs to the business and we process it on its behalf — ask the business directly, or write to us with the Page or number you messaged and we will forward and follow up on your request. A deletion request that arrives from Meta itself (removing the app in your Meta settings) is executed automatically, and you can follow it with the confirmation code on the data deletion page. You may also complain to the Saudi Data & AI Authority (SDAIA) if our response does not satisfy you.

• Every workspace is isolated by database row-level security policies, not by application logic alone.
• Channel credentials and AI keys are encrypted with AES-256-GCM using periodically rotated keys.
• Encryption in transit (HTTPS with a valid certificate), and every Meta webhook signature is verified before the payload is accepted.
• Daily backups with weekly restore tests, and an audit log of what users do inside their workspaces.
• If an incident affects your data we notify the competent authority within seventy-two hours of becoming aware of it, and notify affected people where required.

We use strictly necessary cookies only: the sign-in session and your language and theme (light/dark) preference. No advertising trackers and no third-party analytics.

Wasl is a business tool. It is not directed at anyone under 18 and we do not knowingly create accounts for them. If data about a child who messaged a business on a connected channel reaches us, it is treated like any customer data and deleted on request from their guardian or from the business.

When what we process or who it reaches changes, we update this page and the “last updated” date above, and notify workspace owners of material changes. We do not apply a material change retroactively to data already collected without notice.

This policy is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations. «to be completed with the legal entity name» — the operator’s legal name, commercial registration, address and forum are completed here.

For any question or request about your data: support@growthmedia.online; for legal matters: support@growthmedia.online.