Effective date: 18 August 2026. This Privacy Policy explains how WISAL AL MASI ESTABLISHMENT FOR INFORMATION TECHNOLOGY ("WESSAAL", "we", "us") collects and processes personal data through the WESSAAL platform, WESSAAL Cloud, Smart Attendance, our websites, applications, support channels, and related services.
1. Who controls your data
For account administration, security, billing, direct customer support, and WESSAAL's own operational purposes, the controller is WISAL AL MASI ESTABLISHMENT FOR INFORMATION TECHNOLOGY.
For contacts, campaign data, employee attendance data, and other information uploaded or configured by a customer, that customer is generally the controller and WESSAAL acts as its processor, subject to the applicable agreement and the actual processing context.
Privacy contact: info@wessaal.com.
2. Personal data we process
Account and identity data may include name, email address, phone number, country, profile information, organization details, and account settings.
Authentication and security data may include login history, IP address, browser information, verification status, session information, security events, and related technical records needed to protect the service.
Subscription and billing data may include selected plan, entitlements, invoices, payment status, amount, currency, transaction references, refunds, and consent records. WESSAAL does not intend to store raw payment-card data.
Workspace and service data may include organizations, workspaces, members, roles, permissions, service identifiers, configuration state, and usage information.
Communication data may include contacts, recipient numbers, lists, templates, message or media content, delivery status, failure metadata, consent status, opt-out status, and campaign results when messaging features are used.
When a customer enables official WhatsApp Business Platform features, WESSAAL may process customer-authorized Meta and WhatsApp business data needed to provide the requested service. Customers connect and use their own eligible Meta and WhatsApp business assets through the applicable official onboarding flow, subject to Meta and WhatsApp terms and policies.
Smart Attendance data may include employee information, schedules, attendance records, leave or adjustment requests, and location, geofence, or Wi-Fi validation data necessary for the configured attendance process.
Support and service-reliability data may include support requests, diagnostic evidence, security logs, error information, and minimized service analytics.
3. Why we process data
We process personal data to create, verify, secure, and administer accounts; provide subscribed services and customer-requested functionality; send service, security, billing, and support communications; process payments and invoices; prevent fraud and misuse; troubleshoot and improve service reliability; comply with law; enforce agreements; and establish, exercise, or defend legal claims.
Where messaging or marketing features are used, the customer is responsible for having the lawful basis, consent, opt-in, or other authority required for recipients and content.
The applicable legal basis may include performance of a contract, compliance with legal obligations, legitimate operational or security interests, and consent where consent is required.
4. Service providers and recipients
WESSAAL uses service providers to operate its services. These may include DigitalOcean and Hostinger for hosting and infrastructure, Hostinger for transactional email, Moyasar for payment processing where enabled, Sentry for error and performance monitoring, and DeepSeek for limited AI-assisted processing where the relevant feature is enabled.
Meta and WhatsApp may receive or process data when a customer uses official WhatsApp Business Platform functionality, according to the customer's configuration and the applicable Meta and WhatsApp terms.
WESSAAL limits provider access to what is reasonably necessary for the relevant service and maintains contractual, security, and access controls appropriate to the processing.
5. International processing
Personal data may be processed or stored outside Saudi Arabia where WESSAAL or its service providers operate infrastructure or support services. Current hosting arrangements may involve locations including Germany, France, and Lithuania.
Where international transfers occur, WESSAAL applies the safeguards required by applicable law, limits transferred data, maintains appropriate provider agreements, and restricts access according to business need.
6. Retention and deletion
Account and profile data is retained while the account is active and is deleted or anonymized after a verified deletion request in accordance with the applicable retention schedule, except where information must be retained by law, for fraud prevention, security, accounting, tax, dispute resolution, or legal claims.
Invoices, tax, and accounting records are retained for the legally required period. Security and support records are retained only as long as reasonably necessary for their stated purposes and applicable legal obligations.
Customer-controlled communication, contact, attendance, and location data follows the applicable product settings, customer instructions, contractual commitments, and retention schedule.
Deleted operational data in provider backups expires through the applicable backup cycle.
7. Your rights
Subject to applicable law and WESSAAL's role in the processing, you may request information about processing, access to personal data, a readable copy, correction, deletion or destruction, withdrawal of consent where applicable, and complaint handling.
Requests may be submitted through the authenticated account where available or by contacting info@wessaal.com. WESSAAL may verify identity before acting on a request and may route requests concerning customer-controlled data to the relevant customer.
8. Account deletion
The account-deletion flow requires strong confirmation. After a verified deletion request, WESSAAL revokes account access and deletes or anonymizes operational account data according to the approved retention schedule.
Certain invoices, tax and accounting records, fraud or dispute evidence, security or incident records, and other information required by law or needed for legal claims may remain access-restricted for the required period.
9. Security
WESSAAL uses administrative and technical safeguards designed to reduce unauthorized access, loss, misuse, alteration, and disclosure. Measures may include access control, secret management, encryption in transit, logging, monitoring, backups, least-privilege controls, and incident-response procedures.
No online service can guarantee absolute security. Customers are responsible for protecting their credentials, authorized-user access, and the lawfulness of the data they provide.
10. Children
WESSAAL services are designed for business and organizational use and are not directed to children as consumer services. Customers must ensure that any employee, guardian, education, healthcare, or other regulated use involving minors has the lawful authority, notices, permissions, and safeguards required by applicable law.
11. Changes to this Policy
WESSAAL may update this Privacy Policy to reflect legal, security, provider, or service changes. Material changes will be communicated where required by law and will apply prospectively unless an earlier change is required for legal or security reasons.
12. Contact
WISAL AL MASI ESTABLISHMENT FOR INFORMATION TECHNOLOGY
Kingdom of Saudi Arabia
Email: info@wessaal.com