Privacy Policy
This policy explains how Twasel collects, uses, and protects personal data, whether you are a subscriber to the platform or an end customer communicating with a subscribed business via WhatsApp
1. Who We Are
Twasel is a Saudi SaaS platform specializing in WhatsApp business conversation management. We provide businesses with tools to manage conversations, send campaigns and organize teams, through the official connection to Meta's WhatsApp Business API or Direct Linking with the business's existing number.
2. Data We Collect
We collect two categories of data:
Subscriber Data (platform users)
- Email address, full name, business name, and phone number at registration
- Login credentials and activity logs within the platform
- Subscription and billing information
- Technical data about the device, browser, and connection address, used for security, fraud prevention, and service improvement.
End Customer Data
- WhatsApp numbers and display names of individuals who communicate with subscribed businesses
- Message content (text, images, files) that passes through the platform
- Conversation metadata (timestamps, delivery status)
3. Purposes of Data Collection
- Operating the platform and delivering the service to subscribed businesses
- Facilitating message delivery between businesses and their customers via WhatsApp
- Generating reports and analytics for subscribers on team performance
- Protecting the platform from unauthorized or unlawful use
- Complying with applicable regulations in the Kingdom of Saudi Arabia
- Improving the platform and measuring usage, and sending service updates and offers with the ability to opt out at any time
4. Data Sharing
We do not sell personal data. Data may be shared with a limited set of parties to operate and improve the service:
- Meta Platforms, Inc: As the operator of WhatsApp Business API, in accordance with WhatsApp Business Policies.
- Hosting Provider: For storing data on secured servers
- Payment gateway provider: To securely process subscription payments (we do not store your card data, it is processed directly by the gateway)
- Competent Authorities: Only upon official request pursuant to the laws of the Kingdom
- Analytics and measurement providers: Such as Google Analytics, to understand site usage, improve the experience, and measure campaigns. They run only according to your choice in cookie settings
- AI processing provider: To generate smart assistant replies when the feature is enabled; your messages are not used to train its models
- Published pages hosting provider: To serve the landing pages and websites you order through the platform
5. Data Protection
We implement security measures including: advanced encryption for credentials, session protection against exploitation, two factor authentication for identity verification at login, and complete data isolation between projects. All connections are made over encrypted channels (HTTPS), and data is stored with a trusted hosting provider on secured servers with safeguards consistent with the Personal Data Protection Law (PDPL).
6. Data Retention
We retain account data for the duration of the subscription. Conversation data is retained according to the subscriber's settings. You may request deletion of your data at any time via our Data Deletion page.
7. Your Rights
In accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, you have the right to:
- Access your data stored with us
- Request correction or deletion of your data
- Object to or restrict the processing of your data
8. Cookies
We use two types of cookies: essential cookies required to run the platform and keep your session (cannot be disabled), and optional analytics and marketing cookies that are activated only after your consent from the cookie banner, with the ability to change your choice at any time. The full list:
- Session Cookie: Maintains your login state while browsing. Expires when the browser is closed or after the configured session duration.
- CSRF Protection: Verifies that requests originate from the same browser to prevent exploitation. Regenerated with each session.
- Language Preference: Saves the selected language (Arabic or English). Valid for one year.
- Security cookie: Identifies trusted devices to secure the account.
- Remember Token: Used when device remembering is enabled to maintain login for up to 30 days. Tied to the trusted device and fully encrypted.
- Analytics and marketing cookies (third party): Measurement and analytics tools such as Google Analytics and marketing tools for campaign measurement. Activated only after your consent from the cookie banner and can be disabled at any time.
Analytics and marketing tools (such as Google Analytics) run only after your consent from the cookie banner. You can keep essential cookies only or change your choice at any time from cookie settings.
9. Our Role as Data Processor (DPA)
Regarding end customer data, Twasel acts as a Data Processor on behalf of the subscribed business, which is the Data Controller. This relationship is governed by the following obligations:
- The subscribed business is responsible for obtaining the necessary consents from its customers before processing their data through the platform
- Twasel processes end customer data solely according to the subscriber's instructions and for the purpose of delivering the service
- Twasel may not use end customer data for its own purposes or share it with parties not listed in this policy
- Subscribers may request a detailed Data Processing Agreement (DPA) by contacting our team
10. Legal Basis for Processing
We process personal data based on the following grounds under the Personal Data Protection Law (PDPL):
- Contract performance: processing subscriber data necessary for service delivery
- Legitimate interest: protecting the platform from unauthorized use and improving the service
- Legal obligation: compliance with tax and regulatory requirements in the Kingdom
- Consent: when collecting optional data or sending marketing communications
Marketing Communications
We may send you marketing communications via email or WhatsApp about our services and products. You can unsubscribe at any time via the "Unsubscribe" link at the bottom of each message, through your account settings, or by contacting us directly.
11. Data Transfers
Data is stored on secured servers. Some data may be transferred to Meta servers to operate the WhatsApp service, in accordance with Meta's approved policies. We do not perform any additional data transfers beyond service delivery except with adequate safeguards under PDPL.
12. Security Incident Notification
In the event of a security incident affecting personal data, we are committed to notifying the competent authorities within 72 hours of discovering the incident as required by PDPL. We also notify affected subscribers of the incident and the measures taken without undue delay.
13. Changes
We may update this policy as needed. Subscribers will be notified of material changes via email or a notification inside the platform. Updates will be published on this page.
14. Contact
For any inquiries regarding your data or this policy: legal@twasel.io