Privacy Policy

1. Introduction

This policy explains how RASSEL (راسل) — a product of the SOWLF (سولف) brand — collects, uses, shares and protects personal data. It is issued by Gita Online Agency For Travel and Tourism (وكالة جيتا أونلاين للسفر والسياحة), CR / National no. 7054277814, 6075 Taj Alasfahani St., Al Iskan District, Madinah 42317, Saudi Arabia. We operate within the framework of the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, the E-Commerce Law and other applicable laws. We do not claim any compliance certification or approval unless we publicly state one.

2. Our roles: controller and processor

• Account, billing and platform technical-usage data: we are the controller and decide the purposes and means of processing.
• Our customers' customer data (contacts, conversations and similar): our customer (the workspace owner) uses RASSEL to communicate with other people. In most cases the customer is the controller and we are the processor handling that data on its instructions under the Terms of Service. Roles may be characterised differently case by case, and a data processing agreement (DPA) can be concluded on request.
• If you are an individual who communicated with one of our customers over WhatsApp or another channel, that customer is primarily responsible for your data; you can contact it, or contact us and we will help route your request.

3. Data we process

• Account data: name, email, role and permissions, password (stored using secure hashing), language preferences.
• Workspace data: organisation name, settings, teams, invited users, tags, custom fields and templates.
• Contacts and customers: names, phone numbers, emails, company, country, tags, interaction history and source.
• Conversations and messages: content of inbound and outbound messages over connected channels, delivery and read status, and internal notes.
• Attachments and media: images, files and audio sent by customers or agents.
• Campaign data: recipient lists, segments, campaign content and results.
• Usage and technical data: logs, operational events, audit trail, browser and device type.
• IP address and sessions: network addresses, session identifiers and sign-in times for security.
• Billing records: plan, cycle, amounts, tax, payment status and transaction reference, billing details and VAT number. We do not store card data; it is entered with the payment gateway directly.
• Connected integrations: channel keys and credentials (WhatsApp, email, others) are stored encrypted and are not displayed after saving.
• AI and knowledge content: knowledge sources uploaded by the customer and the text sent to the model provider when the feature is enabled.

4. Where data comes from

From you directly, from your workspace users, from connected communication channels (such as WhatsApp), from your customers who message you, and from your technical use of the platform.

5. Purposes of processing

• Operating and providing the Service: showing, routing and assigning conversations, automation and reports.
• Delivering communications: sending and receiving messages through channel providers.
• Authentication, account and permission management.
• Security: detecting suspicious sign-ins, preventing abuse, protecting the platform and the audit trail.
• Support and responding to your requests.
• Billing, invoicing, payment processing and tax collection.
• Operational analytics and service improvement (using aggregated indicators, never using the content of your conversations for marketing tracking).
• Fraud and abuse prevention.
• Legal compliance and responding to competent authorities.

6. Legal basis

We process data on the basis of performing our contract with you, your consent where required, our legitimate interest in operating and protecting the Service without prejudice to your rights, and legal obligations. Our customer is responsible for securing the lawful basis (including recipient consent) for messaging its own contacts.

7. Sharing data

We do not sell your data. We share it only as needed with:

• Communication channel providers: messages necessarily pass through Meta / WhatsApp when WhatsApp is connected, under their privacy policies.
• Payment provider: the Moyasar gateway processes payments and receives payment details directly from you.
• Hosting and cloud infrastructure: to store data and run the Service.
• Email provider: to send account and billing emails.
• AI provider: when a customer enables AI features, the necessary text is sent to the provider the customer chose with its own key.
• Public authorities where there is a legal obligation or a competent order.
• Our professional advisers as necessary and in confidence.

Each processor we use is bound to appropriate safeguards.

8. Transfers and processing outside the Kingdom

Some data may be processed or stored by providers outside the Kingdom, such as channel providers, AI providers, email and cloud infrastructure providers. We do not claim that all data is physically hosted in Saudi Arabia. Where personal data is transferred or disclosed outside the Kingdom we do so under the controls required by the PDPL and its Implementing Regulations (including appropriate safeguards and an adequate level of protection), a point we keep under continuous review.

9. Retention

• Active accounts: we keep data for the duration of the subscription to provide the Service.
• Expired trials: we keep data for at least 30 days after expiry and do not delete automatically; we notify the owner before any scheduled deletion.
• Cancelled or suspended accounts: the same period from cancellation/suspension, so the customer can export or reactivate.
• Technical logs and audit trail: kept as long as needed for security and incident investigation.
• Billing records and invoices: kept for the period required by tax and commercial law.
• Deleted accounts: we delete or anonymise data after the periods above and once the purpose and legal obligation have lapsed; backups may persist for a limited time until periodically replaced. We do not promise immediate deletion where a legal or technical retention duty exists.

10. Your rights

Under the law you may — depending on the case — be informed about how your data is processed, access your data and obtain a copy, request its correction or destruction, withdraw consent where consent is the basis, and object to certain processing. To exercise your rights or ask a question: [email protected]. We respond within the legal periods after verifying your identity, and may refer you to the customer if it is the controller of your data. Customers have export and deletion tools inside the platform to respond to their own customers.

11. Security

We apply reasonable technical and organisational measures including workspace data isolation, role-based permissions, encryption of keys and credentials at rest, secure password hashing, an audit trail, webhook signature verification, HTTPS connections and backups. Details are on the Security page. No system is completely secure, and we notify the relevant authorities and individuals where an incident requires it by law.

12. Cookies

We use cookies that are necessary for sign-in, session continuity and request protection. We do not use third-party advertising cookies in the platform.

13. Children's data

The Service is for businesses and is not directed at those below the legal age. If we learn that a minor's data is processed without a lawful basis we will take appropriate action.

14. Third-party links and platforms

The Service may link to external sites or services (such as Meta). They have their own policies and we do not control them.

15. Data we receive from Meta (WhatsApp Business Platform)

RASSEL is a software platform that integrates with the Meta WhatsApp Business Platform (Cloud API) on behalf of the businesses that use it. When a business connects its own WhatsApp Business Account to RASSEL (through Meta's onboarding flow or by providing its Cloud API credentials), we receive and process, only on that business's instructions:

• Business account identifiers: Meta Business ID, WhatsApp Business Account (WABA) ID, phone number ID, display phone number, verified business name, and quality rating and messaging-limit status.
• Access credentials and permissions granted by the business (such as whatsapp_business_messaging and whatsapp_business_management). They are stored encrypted and used only to operate that business's connected account.
• Messages: the content of messages and media exchanged between the business and its customers, the customer's WhatsApp ID (phone number) and profile name, and sent / delivered / read status notifications.
• Message templates created by the business and their approval status.

How we use Meta Platform Data: only to provide the features the business asked for (sending and receiving messages, showing conversations in the inbox, templates, campaigns the business itself starts, and reports). We do not sell Meta Platform Data, do not use it for advertising or profiling, do not transfer it to data brokers, and do not use it to train AI models. We process it in line with the Meta Platform Terms, the Meta Developer Policies and the WhatsApp Business terms, and we share it only with the service providers in section 7 acting on our behalf, or where the law requires.

Revoking access: a business can disconnect its WhatsApp number from RASSEL settings at any time, or remove RASSEL's access from Meta Business Settings. When the channel is removed we stop receiving data for it and its stored access credentials are deleted.

16. How to request deletion of your data

• Workspace owners: you can delete contacts and conversations from inside the platform at any time. To delete your whole workspace and all of its data (including data received from Meta), email [email protected] from the account owner's email with the subject "Data deletion request".
• People who messaged a business that uses RASSEL: contact that business first, as it controls your data; or email [email protected] with your WhatsApp number and the business name and we will route or carry out the request.
• We confirm receipt within 3 business days and complete deletion within 30 days, except records we must keep by law (such as tax invoices), which are kept only for the legal period.
• Full step-by-step instructions: Data deletion instructions.

17. Updates to this policy

We may update this policy and will notify you of material changes with reasonable notice; the last-updated date and version number appear under the title.

18. Contact and complaints

The data controller for account data is Gita Online Agency For Travel and Tourism, CR 7054277814, 6075 Taj Alasfahani St., Al Iskan District, Madinah 42317, Saudi Arabia. For questions and privacy requests: [email protected] or +966549582272. For legal matters: [email protected]. You also have the right to complain to the competent personal-data protection authority in the Kingdom.