Privacy Policy

Last updated: 30 September 2026

Draft: 9 company details (legal name, address, contact, retention…) still to be filled in, and this text still needs review by a lawyer before launch.

This is a draft template describing what Wasaf actually collects and how it's actually handled today. It has not been reviewed by a lawyer against Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) — have it reviewed before relying on it for real, paid transactions.

1. What we collect

• Business registration: CR number, business name, phone, address, and the number of user seats requested.
• Account details: name, email address, and a securely hashed password for each user and sub-account (we never store your password itself).
• Marketplace activity: listings you create, orders you place or receive, RFQs, vendor ratings and reviews you leave or receive, and messages sent through an order's chat.
• Photos and documents: listing photos and, if you submit one, a payment receipt image.
• Technical data: sign-in timestamps, IP address, and a record of actions taken on your account (our internal activity log), kept for security and dispute-resolution purposes.

2. How we use it

We use this information to operate the marketplace: showing your listings to buyers, connecting orders between businesses, verifying in-person pickups, calculating and tracking commission, reviewing new business registrations, responding to support requests, and sending you notifications about your own orders, payments, and account (by email, where you've been notified and where email delivery is configured).

3. Who we share it with

We don't sell your data. A few service providers process it on our behalf so the platform can run:

• Supabase hosts our database and stores uploaded photos/receipts.
• Resend (once configured) delivers transactional emails such as password resets and order updates.
• Vercel hosts the website and API, keeps short-lived server logs for troubleshooting, and provides privacy-friendly page analytics (no advertising cookies, no cross-site tracking).
• Google Analytics measures page visits and traffic sources in aggregate. It runs without cookies (consent mode with storage denied) and with IP anonymisation; we don't send it names, emails, CR numbers or search terms.
• Apple, Google and Expo deliver push notifications to the Wasaf app when you turn them on; they receive a device token and the notification text.

Other businesses on Wasaf only see what's necessary to transact with you: your business name and rating on listings, and order/chat details for orders you're actually a party to. Your account password and, for pickup orders, your one-time pickup code are never shown to the other party.

4. Cookies

Wasaf uses a single essential cookie to keep you signed in (an httpOnly session token). We don't use advertising or third-party tracking cookies.

5. Data retention

We keep account and transaction records for as long as your account is active and as needed for dispute resolution, accounting, and legal obligations. When you delete your account, your name, email, password and devices are removed straight away. Order and invoice records are kept for the other party to the order and for accounting — without your name or email — for: TODO: how long order and invoice records are kept after an account is deleted (confirm with your accountant/lawyer).

6. Your choices

You can update your business and contact details from Settings at any time, and change your password there or via the "Forgot password" link on the sign-in form. You can delete your account yourself from Settings → Delete account (website and app). To request a copy of your data, contact us through Support.

7. Security

Passwords are hashed, not stored in plain text; sessions use httpOnly cookies; and access to buyer/seller-specific data (like pickup codes and order chats) is restricted to the parties on that order and Wasaf admins.

8. Changes

We may update this policy as the platform evolves. Material changes will be reflected here with an updated date.

9. Contact

TODO: registered company name, TODO: registered address in Qatar. Privacy questions: TODO: privacy contact email. You can also reach us through Support.