Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how Wasel CRM ("Wasel", "we", "us" or "our"), available at https://wasel-crm.com, collects, uses, shares, retains and protects personal data. Wasel is owned and operated by Astrecode for Technology (One Person Company LLC), a company registered in Cairo, Egypt. You can reach us using the details below.

• Legal entity: Astrecode for Technology (One Person Company LLC)
• Commercial Register No.: 280865, Cairo
• Address: Office No. 2, Apartment 1202, 2 Mohamed Mostafa Hammam St., Nasr City, Cairo, Egypt
• Email: support@astrecode.com
• Phone: +20 115 527 6633
• Website: https://wasel-crm.com

2. Our Role: Controller and Processor

Wasel is a business software platform (software as a service) that businesses ("tenants") use to manage customer conversations, leads, sales and advertising. Our role depends on whose data is involved:

• Data of a business's customers: each business that uses Wasel is the data controller of the personal data of its own customers and contacts, for example people who message the business on Facebook Messenger, Instagram or WhatsApp, or who submit its lead forms. Astrecode acts as a data processor for that data and processes it only on the business's instructions and to provide the Wasel service to that business.
• Account data: Astrecode is the data controller of the personal data of the people who register for and use Wasel accounts (business owners, administrators and agents) and of visitors to our website.
• If you are a customer of a business that uses Wasel, please also read that business's privacy policy and contact the business about your data. We will help the business respond to your request, and you can also contact us directly.

3. Information We Collect

A. Account and business information

When a business registers for or uses Wasel, we collect:

• Identity and contact details of account users: name, email address, phone number and job role.
• Login credentials: passwords are stored only in hashed form.
• Business details: company name, workspace subdomain, subscription plan, billing and invoice information.
• Settings and content you create in Wasel, such as message templates, products, knowledge base entries and AI reply settings.
• Technical and usage data: IP address, browser and device type, log data and sign-in times, used for security and troubleshooting.

B. Data received from Meta platforms (Facebook, Instagram, WhatsApp)

When a business connects its Facebook Pages, Instagram professional accounts, WhatsApp Business accounts and Lead Ads to Wasel using Facebook Login for Business, and only within the permissions that business grants, we receive and store:

• Asset identifiers and names: Facebook Page IDs and names, Instagram professional account IDs and usernames, WhatsApp Business Account (WABA) IDs, phone number IDs and display phone numbers, and ad account IDs and names.
• Access tokens issued by Meta for those assets. We store them in access-restricted systems and use them only to operate the integration the business enabled.
• Messages and attachments exchanged between the business and its customers on Messenger, Instagram Direct and WhatsApp: message content, images, audio, video, documents and other attachments, timestamps and delivery status, and the sender's identifier (Page-scoped ID (PSID), Instagram-scoped ID (IGSID) or WhatsApp phone number), together with the sender's name and profile picture where Meta makes them available.
• Lead Ads data: the answers people submit in the business's instant lead forms (for example name, phone number, email address and answers to custom questions), the form and its submission time, and the related ad and campaign.
• Advertising data for the business's own ad accounts: campaigns, ad sets, ads and creatives, budgets, targeting settings and performance results, Meta pixels and the ad account currency.

C. Data received from TikTok

When a business connects its TikTok Business Account to Wasel using TikTok's authorization (OAuth), and only within the permissions that business grants, we receive and store:

• Account details: the TikTok Business Account ID, display name, username and profile picture.
• Access and refresh tokens issued by TikTok. We store them encrypted (AES-256-GCM), use them only to operate the integration the business enabled, and never show them in the app or write them to logs.
• Direct messages: the messages and images that customers send to the business and the replies sent back, with timestamps and delivery status, and the sender's TikTok identifier, display name and profile picture where TikTok provides them.
• Lead forms: where the business has connected TikTok Lead Generation, the answers submitted in its forms, the form and ad identifiers and the submission time.
• Phone numbers that a customer types in a TikTok chat. We save the number on that customer's record in the business's workspace and may match it to an existing customer of the same business who has the same number, so that the conversation history is kept in one record.

D. Customer and CRM data added by businesses

Businesses may add or import information about their customers into Wasel, such as contact details, notes, deals, tickets, orders and activities. We process this data on the business's behalf.

E. Cookies and local storage

We use browser local storage and strictly necessary cookies to keep you signed in, remember your language and theme preferences and protect the service. We do not use advertising or cross-site tracking cookies.

4. How We Use Information

We use personal data only to provide the inbox, CRM, lead and advertising features that the business has requested, and to operate our service:

• Unified inbox: receive, display, assign and send Messenger, Instagram, WhatsApp and TikTok messages and attachments between the business and its customers.
• CRM: create and update contacts, conversations, leads, deals, tickets and activities in the business's own workspace.
• Leads: bring Lead Ads submissions into the business's CRM and notify its team.
• Ads: sync and show campaigns, ad sets, ads, pixels and results for the business's ad accounts, and create or publish ads only when the business instructs us to.
• AI features: only when the business enables AI replies or AI assistance, generate suggested or automatic replies and summaries for that business's conversations.
• Running the service: authentication, billing, customer support, service notices, security, fraud prevention, troubleshooting and meeting our legal obligations.

5. Meta Platform Data

We comply with the Meta Platform Terms and Developer Policies when we process data received from Facebook, Instagram and WhatsApp. In particular:

• We never sell, rent or license Platform Data or any other personal data.
• We do not use Platform Data for advertising profiling, building user profiles, targeting or retargeting, or data brokering.
• We use Platform Data only to provide the features requested by the business that connected its accounts, and each business can access only the data of its own connected assets.
• We delete Platform Data when it is no longer needed for those features, when the business disconnects the integration, or when we receive a valid deletion request, as described in the Data Retention section below.

6. TikTok Platform Data

We comply with TikTok's developer terms and policies when we process data received from TikTok. In particular:

• We never sell, rent or license TikTok data or any other personal data.
• We do not use TikTok data for advertising profiling, building user profiles, targeting or retargeting, or data brokering.
• We use TikTok data only to provide the features requested by the business that connected its account, and each business can access only the data of its own connected TikTok account.
• We reply only to conversations that the customer started, within the 48-hour window and the limit of 10 messages that TikTok allows, and we do not send broadcasts, bulk or unsolicited messages.
• When a business disconnects TikTok, we revoke and delete its tokens straight away, stop processing data from that account, and delete or anonymize its TikTok message data within 30 days, as described in the Data Retention section below.

7. Sharing and Sub-processors

We do not sell, rent or trade personal data, and we do not share it with third parties for their own purposes. We share data only with the following sub-processors, and only as needed to operate Wasel:

• Google Cloud (Google LLC): hosting of the Wasel web application and API.
• Hostinger (Hostinger International Ltd.): virtual servers that run our database, cache and message queue.
• Microsoft Azure (Microsoft Corporation): file storage, including message attachments.
• Alibaba Cloud: a virtual server that stores our application logs, which may contain identifiers and technical details of requests.
• Meta Platforms (Facebook, Instagram and WhatsApp): to send and receive messages and to sync leads and ads on behalf of the business that connected its accounts.
• Telegram and TikTok: only when a business connects its Telegram bot or TikTok business account, to exchange messages and data with that account on the business's behalf.
• Email and calendar providers connected by a business (Google, Microsoft, Zoho, or the business's own IMAP/SMTP server): to sync and send that business's emails and calendar events.
• AI processing providers (currently Google Gemini, through our own automation server): only when a business enables AI replies or AI features, the conversation content needed to produce a reply is sent to the provider for that purpose only.
• Google Maps and Google Fonts: loaded in your browser to display maps and fonts; Google receives your IP address and browser details.
• Authorities: we may disclose data where required by law, a court order or a competent authority, or where necessary to protect the rights, safety and security of our users and our service.

8. Data Retention

• Data received from Meta platforms (messages, attachments, sender identifiers, names and profile pictures, lead and ads data) is kept only while the business keeps the integration connected and its Wasel account active.
• It is deleted or anonymized within 30 days after the business disconnects the integration or requests deletion of its account, or after we receive a valid deletion request from a user or from Meta, except where the law requires us to keep it longer.
• Access tokens stop working as soon as access is removed in Meta (Business Settings, or Facebook Settings > Apps and Websites), and we delete them from our systems within 30 days of a disconnection or deletion request.
• Account data is kept while the account is active and is deleted or anonymized within 30 days after an account deletion request, except records we must keep by law, such as invoices and tax records.
• TikTok data (direct messages, attachments, TikTok profile data and contacts that exist only because of TikTok messages) is kept while the business keeps TikTok connected. When the business disconnects TikTok, its tokens are revoked and deleted at once and the TikTok message data is deleted or anonymized within 30 days. A customer record that is linked to the business's orders, appointments, tickets or leads is kept, with the TikTok identifier and profile picture removed; the name the person used on TikTok stays on that record until the business changes or deletes it.

9. Security

We use technical and organizational measures to protect personal data, including:

• HTTPS (TLS) encryption for all data in transit.
• Access tokens and secrets are stored encrypted, and access to databases and file storage is restricted to the Wasel service.
• Strict tenant isolation, so each business can access only its own workspace data.
• Role-based access control, least-privilege access for our staff, hashed passwords and activity logging.

No system is completely secure. If a security incident affects personal data, we will notify the affected businesses and, where required, the competent authorities.

10. Your Rights and How to Request Deletion

Subject to applicable law, including Egypt's Personal Data Protection Law No. 151 of 2020 and, where it applies, the EU General Data Protection Regulation, you may have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Lodge a complaint with a data protection authority.

To exercise these rights, email support@astrecode.com. To request deletion of your data, including data received from Facebook, Instagram, WhatsApp or TikTok, follow the instructions on our Data Deletion page at https://wasel-crm.com/delete-data. We respond within 30 days.

11. Children

Wasel is a service for businesses and is not directed to anyone under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. International Data Transfers

We are based in Egypt. Wasel is hosted on Google Cloud, with file storage on Microsoft Azure and servers operated by Hostinger and Alibaba Cloud, and these and our other sub-processors, including Meta, TikTok and AI processing providers, may process data in other countries, such as the United States and countries of the European Union. When personal data is transferred across borders, we rely on appropriate safeguards required by applicable law, such as contractual commitments from our sub-processors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page with a new "Last updated" date and, for material changes, notify account owners in the app before the changes take effect.

14. Contact Us

For questions about this Privacy Policy or our privacy practices, contact Astrecode for Technology (One Person Company LLC):

• Legal entity: Astrecode for Technology (One Person Company LLC)
• Commercial Register No.: 280865, Cairo
• Address: Office No. 2, Apartment 1202, 2 Mohamed Mostafa Hammam St., Nasr City, Cairo, Egypt
• Email: support@astrecode.com
• Phone: +20 115 527 6633
• Website: https://wasel-crm.com