Privacy Policy

1. Introduction

Welcome to WASLA ("the Platform"), operated by WASLA Egypt LLC. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use our services.

By using WASLA, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the Platform.

2. Data We Collect

We collect the following categories of information:

• Account Information: Full name, business name, email address, phone number, username, account type, and profile photo. Your password is managed by our authentication provider (Google Firebase Authentication) and is never stored by WASLA — see Security Measures below.
• Business Information: Business registration details, trade licenses, portfolio images, product listings, MOQ, production capacity, and specializations.
• Device Information: Device type and model, operating system version, unique device identifiers, app version, and crash reports.
• Usage Analytics: Pages visited, features used, time spent on the Platform, search queries (anonymized), and interaction patterns used to improve recommendations.
• Location (City-Level Only): Your city and country of operation as declared during registration. We do not collect GPS or precise real-time location data.
• Business Verification Documents: Commercial registration certificates, trade licenses, or portfolio materials submitted during the verification process. These are used solely for account verification and are handled under strict confidentiality.

3. How We Use Your Data

Your data is used for the following purposes:

• Matching & Discovery: We use the information in your profile together with your activity on the Platform to recommend relevant brands, factories, suppliers, and professionals and to rank search and "For You" results. Because WASLA is a professional network, the profile information you choose to provide is discoverable by other signed-in users so they can evaluate a potential business connection.
• Notifications: To send you relevant updates about connections, messages, marketplace activity, and platform news. You can customize notification preferences in Settings.
• Fraud Prevention: To detect and prevent fake accounts, spam, marketplace fraud, and unauthorized access attempts.
• Service Improvement: Aggregated, anonymized usage data is analyzed to improve Platform features, fix bugs, and optimize performance.
• Legal Compliance: To comply with Egyptian law and applicable international regulations, including responding to lawful data requests from authorities.

4. Your Rights (GDPR-Inspired)

We respect internationally recognized data protection principles. As a WASLA user, you have the following rights:

• Right to Access: You can request a complete copy of all personal data we hold about you at any time.
• Right to Correct: You can update or correct inaccurate personal information directly in your profile settings or by contacting us.
• Right to Delete: You can request deletion of your account and all associated personal data. Deletion is subject to our data retention obligations.
• Right to Data Portability: You can request your data in a structured, machine-readable format (JSON/CSV) via Settings → Download My Data.
• Right to Restrict Processing: You can request that we limit how we process your data while a complaint or dispute is being resolved.
• Right to Object: You can object to certain processing activities, including processing based on our legitimate interests.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond to all requests within 30 days.

5. Data Sharing

We do NOT sell your personal data to any third party under any circumstances.

We may share your data only in the following limited circumstances:

• With Your Explicit Consent: When you choose to connect with another user, your profile information is shared with that user as you have approved.
• Legal Requirement: When required to comply with a court order, subpoena, or other lawful legal process issued by Egyptian or applicable international authorities.
• Platform Infrastructure Providers: We use a small number of carefully vetted third-party service providers (cloud hosting, analytics, security monitoring) who process data on our behalf under strict Non-Disclosure Agreements (NDAs) and Data Processing Agreements (DPAs). These providers are prohibited from using your data for any purpose other than providing services to WASLA.
• Payments: Marketplace orders are paid cash on delivery, directly between the buyer and the seller or their courier. WASLA does not collect, hold, or transmit payment for orders, and no card or financial details are entered into or passed through the Platform. Should card payment be introduced in future, it would be handled by a licensed third-party gateway on its own hosted page, and this policy would be updated before that option became available to you.

6. Data Retention

We retain your personal data for as long as necessary to provide the Platform and comply with our legal obligations:

• Active Accounts: Your data is retained for the lifetime of your active account.
• Deleted Accounts: When you delete your account from the app, deletion is immediate and irreversible — there is no recovery period. Your account and associated personal data — your profile, posts, stories, reels, marketplace listings, tenders, job postings, verification documents, and the uploaded files behind all of them — are permanently removed from our active systems and cannot be restored. Two things survive by necessity: messages you already sent remain in the other participant's copy of the conversation (we cannot reach into another person's chat history, and its contents are end-to-end encrypted and unreadable to us), and order records remain available to the other party to that transaction. Ratings you wrote about sellers are anonymised rather than deleted, so that another business's published score does not change because an unrelated account closed. Beyond these, only limited records we are legally required to keep are retained, as described under "Legal Hold" below. Step-by-step instructions are at wasla.network/delete-account.
• Verification Documents: Business verification documents (commercial registrations, trade licenses, etc.) are retained for up to 90 days after submission and are then automatically and permanently deleted. We do not keep them longer than necessary for the verification decision, except where a longer period is required by law.
• Legal Hold: In cases where we are required by law to retain data for a longer period, we will retain only the minimum necessary data for the legally mandated duration.

7. Security Measures

We take the security of your data extremely seriously and implement industry-leading protections:

• Encryption at Rest: All personal data stored in our databases is encrypted using AES-256 encryption.
• Encryption in Transit: All data transmitted between your device and our servers uses TLS 1.3 — the most current and secure transport layer protocol.
• Layered Security Architecture: WASLA is built on a defense-in-depth model — server-side access-control rules, app attestation, encrypted transport and storage, and end-to-end encryption for private messages. We review our security practices internally and address identified issues before release.
• End-to-End Encrypted Messages: The text and shared media (photos, voice notes and videos) of private conversations — both one-to-one and group — are end-to-end encrypted on your device using X25519 key agreement and AES-256-GCM. Encryption keys are generated and held only on participants' own devices, so WASLA's servers store only ciphertext and cannot read the content of these conversations. For one-to-one chats you can additionally verify a safety number with the other person to confirm there is no interception, and the app warns you if their security key changes.
• Password Security: Authentication is handled by Google Firebase Authentication. Your password is never stored by WASLA in any form; Firebase keeps only a salted, cryptographically hashed (scrypt) representation, and neither WASLA nor anyone with access to our databases can recover your original password.
• Two-Step Verification: You can optionally enable two-step verification, which requires a one-time code sent to your email — in addition to your password — when signing in.
• New-Device Login Alerts & App Lock: You can opt in to an email alert whenever your account is accessed from a new device, and you can protect the app itself with a PIN and biometric (Face ID / Touch ID / fingerprint) lock.
• Access Controls: Internal access to production data is restricted to authorized personnel only, on a need-to-know basis, with full audit logging.

8. Children's Privacy

WASLA is strictly a professional platform intended for users aged 18 and above.

• We do not knowingly collect personal information from anyone under the age of 18.
• If we discover or are notified that an account belongs to a person under 18, the account will be immediately terminated and all associated data will be deleted.
• If you believe a minor has created an account on WASLA, please notify us immediately at [email protected].

9. International Data Transfers

WASLA runs on Google Firebase / Google Cloud infrastructure. Your data is stored and processed in Google's data centers, which, depending on service configuration, may be located outside your country of residence.

• Where personal data is transferred across borders, the transfer relies on the safeguards in Google Cloud's Data Processing Addendum, including Standard Contractual Clauses (SCCs) where applicable.
• Our infrastructure provider maintains internationally recognized security and compliance standards for its data centers.
• We take reasonable steps to ensure your data receives an adequate level of protection wherever it is processed.

10. Cookie Policy

WASLA uses a minimal cookie approach, prioritizing your privacy:

• Essential Cookies Only: We use only technically necessary cookies required for the Platform to function (e.g., session authentication, security tokens). These cannot be disabled.
• No Advertising Cookies: We do not use cookies for advertising, retargeting, or cross-site tracking. We do not participate in any advertising cookie networks.
• Analytics: We use Google Firebase Analytics to understand how the app is used and to improve features and recommendations. Analytics events are associated with your account identifier and account type so we can measure and personalize the experience. This data is used only to operate and improve WASLA and is never sold or used for third-party advertising, retargeting, or cross-app tracking. You can turn off usage-analytics collection at any time from Settings (Usage analytics).

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

• Significant changes will be communicated via in-app notification and email at least 14 days before the updated policy takes effect.
• The notification will clearly summarize what has changed.
• Continued use of WASLA after the notice period constitutes acceptance of the updated policy.
• The "Last updated" date at the top of this policy will always reflect the most recent revision.

12. Contact & Data Protection Officer

For any privacy-related inquiries, data requests, or concerns, please contact:

• Data Protection Officer (DPO): [email protected]
• General Support: [email protected]
• Phone: 01024657204 / 01055007833
• Organization: WASLA Egypt LLC
• Address: Cairo, Egypt

We aim to respond to all privacy inquiries within 72 hours. For formal data subject requests (access, deletion, portability), we will respond within 30 days as required by law.