Privacy & Data Protection Policy

Draft Date: October 2026 • Designed for mid-market finance teams in KSA & UAE

⚠️

DRAFT — REQUIRES FORMAL LEGAL COUNSEL REVIEW:

This document is a plain-language preliminary draft for early-stage evaluation and private beta onboarding. It has not yet been reviewed or finalized by certified legal counsel in the Kingdom of Saudi Arabia or the United Arab Emirates, and does not constitute a final binding contract.

1. Data Collected & Ingested

Wasal AI collects and processes only the minimum operational financial records necessary to perform bank statement matching and fee unbundling:

Bank Settlement Statement Records: Transaction timestamps, net settlement deposit figures, batch sequence numbers, and POS terminal IDs provided via uploaded files (CSV, XLSX, MT940, PDF).
General Ledger Mapping Identifiers: Account codes for Cash in Bank, Merchant Fee expense, and Input VAT recoverable used to map balanced journal vouchers into your ERP.
Corporate Account Contacts: Authorized controller name, corporate work email domain, and company business name for account configuration.

No Banking Credentials Stored: Wasal AI operates on a read-only, non-custodial architecture. We do not request, capture, or store online banking passwords, multi-factor OTP tokens, or customer payment card PANs. We have no authority or capability to initiate fund transfers.

2. How Data is Stored & Secured

All client financial data is treated with strict confidentiality and technical safeguards:

Encryption in Transit: Enforced TLS 1.3 encryption across all inbound statement uploads and API endpoints.
Encryption at Rest: Databases and uploaded statement buffers encrypted at rest [TODO: verify AES-256 configuration].
Tenant Isolation: Logical tenant isolation to ensure separation of company financial records.

3. Hosting Region & Cloud Infrastructure

To align with GCC financial data governance and privacy standards (Saudi Personal Data Protection Law - PDPL, and UAE Federal Data Protection Law):

Hosting Region: [TODO: confirm hosting region — e.g. AWS Middle East (Bahrain / UAE / KSA) or local certified GCC sovereign cloud data center]

Target SLA: Dedicated regional isolation without routing transaction data outside the GCC.

4. Data Retention Policy

Transaction statements and generated GL adjustment entries are retained during active beta tenancy to maintain an audit trail for accounting reconciliation. Upon termination or conclusion of the beta engagement, tenant data is maintained for a 30-day export grace period before permanent deletion, unless immediate erasure is requested.

5. Deletion Requests & Right to Erasure

Every enterprise client retains the unqualified right to request the permanent deletion of its financial records, raw statement files, and system mapping. To submit a deletion request:

Send an authorized email from your registered corporate domain to: [TODO: privacy@wasal.ai] or [TODO: contact@wasal.ai]

Timeline: Data deletion is executed and confirmed within 3 business days of verified controller authorization.

6. Contact Channels

For privacy reviews, security compliance inquiries, or legal documentation requests:

General Contact: [TODO: email — contact@wasal.ai]

Privacy Inquiries: [TODO: email — privacy@wasal.ai]

Entity Details: [TODO: Company Legal Entity Name, CR, KSA / UAE Registered Office]