Privacy policy
Last updated: 29 October 2026
Who we are
WASLA is provided in Saudi Arabia by Al Tawasul International (شركة التواصل العالمي), CR no. [to be added], VAT no. [to be added], which is responsible for your data. RECA TECH develops and technically operates the platform on its behalf, under a confidentiality obligation.
This policy explains what data we collect and why, who we share it with, how we protect it, and your rights under the Saudi Personal Data Protection Law (PDPL).
Data we collect
- Demo requests from the website: name, company, job title, email, mobile number, city, number of facilities and your message.
- User accounts: name, email, username, role and permissions, preferred language and sign-in history.
- Company and facility data: commercial registration and VAT details, hotel facility details, your chart of accounts and its mapping to the Ministry chart.
- Financial documents: invoices, reports and statements you upload, and the entries extracted from them. They may include other people's data, such as guest or supplier names; you are responsible for having a lawful basis to share it with us.
- National Tourism Monitoring Platform connection: each facility's credentials, stored encrypted.
- Payment data: we never receive or store your card details. Online payments are processed by the Moyasar payment gateway; we keep only the payment reference, amount and status. For bank transfers we keep the transfer reference.
- Technical data: IP address and request times for security and abuse prevention, and an audit log of administrative and financial operations.
How we use data
- To provide the service: analyzing documents, preparing journal entries and letting you review them before approval.
- To submit financial data to the National Tourism Monitoring Platform, only when you request and approve it.
- For billing, subscriptions and AI credit.
- For support and to contact you about your account or request.
- To protect the platform, detect misuse and meet legal obligations.
We do not sell your data, use it for advertising, or use your documents to train AI models.
AI processing and transfers outside Saudi Arabia
When you request automatic analysis, the document to analyze and the relevant part of your chart of accounts are sent to the WASLA engine and from there to one or more AI model providers (such as Google, Groq, Cerebras, NVIDIA and OpenRouter), whose servers may be outside Saudi Arabia.
We only use providers and plans that do not use inputs to train their models under their published terms, and we send the minimum data needed. Results are suggestions reviewed by your accountant; no entry is sent to the Ministry without human approval.
By using automatic analysis you agree to this transfer. You can avoid it entirely by importing your general ledger from Excel, which sends nothing to any AI provider.
Who we share data with
- Service providers: hosting, AI providers (as above) and the Moyasar payment gateway, only as needed to provide the service.
- Ministry of Tourism: through the National Tourism Monitoring Platform, at your request.
- RECA TECH: as the development and technical operations partner, under confidentiality.
- Authorities: when required by law or court order.
How we protect data
- Encrypted connections (HTTPS) on every page.
- Passwords are stored as one-way hashes; sessions are validated on the server for every request.
- Each company sees only its own data; the company is identified by the server, never by the browser.
- An encrypted vault for each company's documents, and encrypted Ministry connection credentials.
- Sign-in rate limiting and an audit log of administrative and financial operations.
Retention
- Account, company and accounting data: for the subscription, then as long as Saudi accounting and tax rules require.
- Temporary results in the AI engine: encrypted, deleted automatically within 30 days at most.
- Website demo requests: up to 12 months unless you become a customer.
- Payment records: as long as the VAT regulations require.
Your rights
Under the PDPL you may access your data and get a copy, ask us to correct or complete it, ask us to destroy it when there is no longer a legal need to keep it, and withdraw consent for processing based on consent.
Send your request through the contact details below; we reply within 30 days. You may also complain to the Saudi Data & AI Authority (SDAIA).
Cookies and browser storage
We only use what the platform needs to work: a secure session cookie after sign-in, an anti-forgery token, and your language preference. We use no advertising cookies or tracking tools.
Changes to this policy
We may update this policy and will show the date of the last update at the top. For material changes we will notify company administrators inside the platform.
Contact us
Email: hello@example.com · Phone: +966 5X XXX XXXX