Privacy Policy
This policy explains how wsh collects, uses, and protects your personal data and how you can exercise your rights. It applies to the app and its supporting services. Stores and websites opened through links in the app are governed by their own privacy policies.
1. Controller
The controller of your personal data is Hisham Alashqar, the owner and operator of wsh.
2. Data We Process
We process the following data to the extent needed to provide the service:
- Account data: your phone number and name.
- Usage and content data: your wishes, images, prices, links, and notes; occasions; friend requests, invitations, and friendships; reservations, gift status, and thank you reactions; notifications; blocks; and reports you submit.
- Optional delivery data: your Short National Address or email address for receiving gifts.
- Optional contact matching: when you choose Add Your Friends, the app temporarily uses your contacts' phone numbers to find people who have an account, without sending their names or the phone numbers themselves to our server or retaining them. Being found through your phone number is on by default so friends who already hold your number can find you; you can turn it off or back on at any time from My Account → Privacy, and turning it off is honored immediately and removes your account from the discovery index.
- Technical and security data: the device push token, technical identifiers required for the service, request, error, and security data, and records of privacy requests and access to delivery data. Access records do not contain the address or email address itself.
We receive this data from you, generate it when you use the app, or receive it from service providers needed to operate the app. Your phone number and name are required to create an account. Data and features described as optional do not have to be provided or enabled.
The app does not process payment data, use advertising or advertising tracking, or request your device location. We receive only the wish images you select through the system photo picker. We do not ask for sensitive data, so please do not enter health, financial, or other sensitive information in notes or free text fields.
When you paste a product link, the link is sent to our server to retrieve public product information; when the server cannot reach the store, your device may retrieve it from the store's website directly — as if you had opened the link in your browser. Do not paste a private or signed link, or a link containing information you do not wish to send.
3. Purposes and Legal Bases
We use personal data to create and operate your account; provide wishes, occasions, friendships, reservations, and gifting; match contacts when you request it; support delivery and notifications; handle reports and blocks; protect the service, prevent abuse, and diagnose faults; and comply with binding legal requests.
Core service processing is necessary to perform our agreement with you when you use the app. Optional features rely on your request or consent. Being found through your phone number — which is enabled by default — relies on our legitimate interest in letting friends who already hold each other's numbers connect, together with your unconditional right to object: turning it off in settings takes effect immediately. We also process data where needed to meet legal obligations and rely on legitimate interests for request limits, fraud and abuse prevention, service protection, and fault diagnosis, provided that your rights are not overridden. We do not rely on legitimate interests to process sensitive data.
4. Visibility and Sharing
- Your name is visible to people handling your invitation or friend request and to accepted friends.
- Your wishes and occasions are visible in the app to you and your accepted friends. Wish images are protected by authenticated access and are not shared through permanent public download links.
- Delivery data is not displayed on your profile. It is available only to a friend with an active reservation for your gift and only to the extent needed to complete delivery.
- Contact matching results are shown only to you. We do not send your contacts' names or phone numbers and do not tell another person that you searched for them.
- Your reports and blocked list are not visible to users, and we do not disclose the reporter's identity to the reported person.
We may process data through technical service providers that operate authentication, hosting, storage, and notifications on our behalf, and we require them to protect it. We may disclose data to competent authorities where required by law. When you paste a product link, our server contacts the relevant website to retrieve public information, and that website receives the link and technical request data.
We do not sell or rent personal data or share it with others for advertising or marketing.
5. Processing Outside Saudi Arabia
Some data may be processed outside Saudi Arabia by technical service providers to the extent needed to provide, operate, and protect the service, subject to the appropriate legal safeguards and measures.
6. Retention and Deletion
We retain data only for as long as needed to operate the service or meet a legal obligation:
- Account data, content, relationships, notifications, and delivery data remain while the account exists or until you delete them. Delivery data linked to a reservation is removed when the reservation is cancelled or the gift is completed.
- Data used to make your account discoverable is deleted when you turn off the feature. Invite links, reminders, and request counters expire automatically when they are no longer needed.
- Reports remain until they are reviewed and are deleted no later than 12 months after closure. Records of privacy requests and access to delivery data are retained for no more than 12 months, and confirmation that account deletion was completed is retained for no more than 30 days.
- Operational logs are retained for 30 days. Audit records and backups follow limited deletion cycles or any period required by law.
You can delete your account through My Account → My Info → Delete Account Permanently. This starts deletion of your account data and content we control, cancels active reservations, and deletes wish images you uploaded. If part of the process fails, we retry it automatically and do not show that deletion has succeeded until the essential steps are complete.
After account deletion, limited data may remain where it is linked to another user's record, must be retained to meet a legal or security obligation, or remains temporarily in a backup. We restrict access to this data and delete it when it is no longer needed.
7. Your Rights
Under the Saudi Personal Data Protection Law, subject to lawful exceptions, you have the right to know how and why your data is processed, access it and obtain a clear copy, request correction, completion, or updating, request destruction when it is no longer needed, and withdraw consent to optional processing.
You can download a readable copy of your data through My Account → My Info → Get a copy of your data, delete your account through the path above, and update your data or privacy choices in the app. The data copy does not include other people's information, security credentials, or active reservations for gifts to you before they are revealed, and the copy explains these exclusions.
You may submit any other request through the contact method at the end of this policy. We may verify your identity before acting on a request. We respond within 30 days and may extend once for a further 30 days where necessary, after informing you of the extension and the reason.
If your complaint is not resolved, you may submit it to the competent authority at the Saudi Data and Artificial Intelligence Authority within 90 days of the incident or the date you became aware of it.
8. Security
We apply technical and organisational safeguards appropriate to the nature of the data and restrict access according to need. No method of transmission or storage can guarantee absolute security. If an incident affects your data, we will address it and notify the competent authority or affected individuals where required by law.
9. Policy Updates and Authoritative Language
We may update this policy when the service, our processing, or legal requirements change. We will update the date above and notify you in the app of material changes where appropriate.
The Arabic text is authoritative. This English translation is provided for convenience.