Privacy policy
Pre-launch draft. This text is an initial framework based on Saudi Arabia's Personal Data Protection Law. It needs review by a qualified lawyer and the company's registration details before official publication. Items in [brackets] are to be completed. The Arabic version prevails.
This policy explains how wathila, a product by wathl, handles personal data. Last updated: [date].
Who we are
[Registered company name], commercial registration no. [number], [national address]. Privacy contact: [email].
Our role
- Website visitors and early-access sign-ups: we are the controller of this data.
- Our customers' callers (people contacting the store, café or platform): we process their data on our customer's behalf and instructions; the customer is the controller.
Data we collect
- From the early-access form: name, mobile number, business name and type, and approximate volume of orders or conversations.
- While the agent runs: the conversation audio and transcript, the order, booking or ticket details needed to complete the service, and the time and duration of the conversation.
- Limited technical data needed to run and protect the site.
The agent never asks for card details, passwords or one-time codes by voice. Payments go through a link from a licensed payment gateway.
Why we use it
- To deliver the service agreed with our customer: answering, confirming and taking orders, opening tickets and handing over to staff.
- To contact you about your early-access request, based on your consent.
- To measure and improve service quality, within what our contract with the customer allows.
Recording and disclosure
The agent introduces itself as an AI assistant at the start of every conversation and announces recording when it's on. Callers can ask to be transferred to a person.
Where data is stored and who sees it
- We're designing the service to host data inside Saudi Arabia.
- We use technical providers for speech-to-text, voice generation, language models and telephony. [The list of sub-processors and their server locations will be published here at launch.]
- Any transfer outside the Kingdom follows the Personal Data Protection Law, its regulations and approved safeguards.
- We don't sell personal data.
Retention
Recordings and transcripts are kept for the period our customer sets, up to a maximum of [period], then deleted automatically. Early-access data is deleted on request or [period] after the last contact.
Your rights
- To know how your data is processed.
- To access your data and get a copy.
- To correct your data.
- To request deletion.
- To withdraw consent at any time.
If you called one of our customers, send your request to them directly and we'll help them carry it out.
Security
We encrypt data in transit and at rest, limit access, and keep logs free of raw personal data. If a breach occurs, we notify the competent authority within the statutory period.
Changes
We may update this policy and will show the new date at the top of the page.