Introduction and Scope of This Policy

This Privacy Policy ("Policy") describes how the Wa7sh platform ("Wa7sh", "we", "us", "our") collects, processes, stores, shares, and protects your personal data when you use our website, applications, dashboards, application programming interfaces (APIs), and any other services we provide (collectively, the "Service").

This Policy applies to all users of the Service, including store owners, advertising agencies, invited members within workspaces, and visitors to our website. By using the Service or creating an account with us, you acknowledge that you have read this Policy and understand the practices described in it.

We may provide additional or supplemental privacy notices for specific products or features. Where such a notice conflicts with this Policy, the more specific notice governs with respect to that particular feature.

Who We Are and Who Controls Your Data

Wa7sh is an AI-powered marketing platform that helps store owners and agencies design, launch, and optimize advertising campaigns across various ad platforms.

For the purposes of applicable data protection laws, Wa7sh acts as the "data controller" with respect to account data and usage data that we collect directly from you. With respect to store data and customer data that you process through our platform, we may act as a "data processor" on your behalf, where you remain the controller responsible for the lawful basis of that data.

If you have any questions about our role in processing specific data, you may contact us using the contact details provided at the end of this Policy.

1. Data We Collect

We collect different types of data depending on how you interact with the Service. This data falls into the following categories:

a) Account data: full name, email address, phone number (optional), company or store name, job role, hashed password, and profile picture if provided.

b) Store and e-commerce data: product details, descriptions, prices, images, product categories, order and sales data, and inventory data that we import when you connect your store.

c) Advertising and campaign data: the ad content you create, budgets, target audiences, and performance metrics such as impressions, clicks, conversions, spend, and return on ad spend.

d) Third-party connection data: encrypted access tokens and identifiers for the ad accounts and stores you connect through official authentication protocols.

e) Usage and technical data: internet protocol (IP) address, browser and operating system type, device identifiers, pages you visit, time spent, and error and performance logs.

f) Communication and support data: the content of your messages and conversations with our support team, and any attachments or screenshots you send us.

g) Payment data: when you subscribe to a paid plan, your card details are processed by a certified third-party payment provider, and we do not store full card numbers on our servers.

2. How We Collect Your Data

We collect your data through three main methods:

First, data you provide to us directly: when you create an account, complete forms, upload content, or contact support.

Second, data we collect automatically: through cookies and similar technologies when you use the Service, such as session and interaction data.

Third, data we receive from third parties: such as the ad platforms and e-commerce platforms you connect to your account, which provide us with performance and store data based on the permissions you grant.

3. Legal Basis for Processing

We process your personal data on the basis of one or more of the following legal grounds:

a) Performance of a contract: processing data necessary to provide the Service you requested and manage your account.

b) Legitimate interests: improving, securing, and preventing fraud on the Service, in a manner that does not override your fundamental rights and freedoms.

c) Consent: where we request your explicit consent for specific purposes such as marketing or certain cookies, and you have the right to withdraw this consent at any time.

d) Legal obligation: where processing is necessary to comply with a legal or regulatory obligation.

4. How We Use Your Data

We use your data only for the following legitimate purposes:

a) Operating and providing the Service and managing your account and workspace.

b) Designing ads and generating creative content using AI systems based on your store data and preferences.

c) Launching, monitoring, and automatically optimizing advertising campaigns across connected platforms.

d) Performing analytics, measuring performance, and developing new features and services.

e) Providing technical support and responding to your inquiries.

f) Sending necessary operational notifications about your account, invoices, and Service changes.

g) Sending marketing and promotional messages where you have consented, with the ability to unsubscribe at any time.

h) Maintaining the security of the Service and detecting and preventing fraudulent or unlawful activity.

i) Complying with legal and regulatory obligations.

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing without human involvement, except within the scope of the campaign optimization that you yourself authorize.

5. Connecting Third-Party Accounts

The Service allows you to connect your accounts on e-commerce and advertising platforms. When you connect, we follow these practices:

a) We use official, secure authentication protocols (such as OAuth), and we do not request or view your passwords for those platforms.

b) We store access tokens in encrypted form and use them only within the scope of the permissions you have granted.

c) We request the minimum permissions necessary to operate the features you choose.

d) You may disconnect any account at any time from your workspace settings, at which point we stop accessing that account and delete the associated access tokens in line with the retention periods described below.

6. Data Sharing and Disclosure

We do not sell your personal data to any third party. Data sharing is limited to the following cases:

a) Operational service providers: we share limited data with trusted providers who help us operate the Service, such as cloud hosting providers, payment processors, AI model providers, and analytics and support tools. These providers are contractually bound to protect your data and use it only for the purposes we specify.

b) Advertising and commerce platforms: we share campaign data and content with the platforms you connect, in order to perform the actions you request such as publishing ads or pulling performance metrics.

c) Legal requirements: we may disclose data where required by law, court order, or to protect our rights or the safety of our users.

d) Business transfers: in the event of a merger, acquisition, or asset sale, your data may be transferred to the new entity, with the obligations of this Policy remaining in effect, and we will notify you before your data becomes subject to a different privacy policy.

7. International Data Transfers

Your data may be processed or stored on servers located in countries outside your country of residence. When we transfer data internationally, we take appropriate measures to ensure it is protected to a comparable standard, including relying on appropriate contractual safeguards with service providers who process data outside your jurisdiction.

8. Data Storage and Protection

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, alteration, or disclosure. These measures include:

a) Encrypting data in transit using the TLS protocol, and encrypting sensitive data such as access tokens at rest.

b) Logical isolation between workspaces, so that users of one workspace cannot access the data of another.

c) Role-based and permission-based access controls, so that access is limited to authorized personnel and on a need-to-know basis.

d) Continuous security monitoring and event logging to detect any abnormal activity.

Nevertheless, no electronic system can be guaranteed to be absolutely secure. In the event of a data breach that may materially affect your rights, we will notify the competent authorities and affected users as required by applicable laws.

9. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service to you.

When you close your account, we delete or anonymize your data within a reasonable period, unless we are required to retain some of it for legal, accounting, dispute resolution, or agreement enforcement purposes.

We may retain backups and system logs for an additional limited period for disaster recovery and security purposes, subject to the same protection controls.

10. Your Rights to Control Your Data

Subject to applicable laws, you have the following rights regarding your personal data:

a) Right of access: to request a copy of the data we hold about you.

b) Right to rectification: to request correction of inaccurate or incomplete data.

c) Right to erasure: to request deletion of your data in cases permitted by law.

d) Right to restrict processing: to request restriction of the processing of your data in certain circumstances.

e) Right to data portability: to request to receive your data in a structured, machine-readable format and transfer it to another provider.

f) Right to object: to object to the processing of your data for marketing purposes or based on legitimate interests.

g) Right to withdraw consent: to withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us using the contact details below. We will respond to your request within the period specified by applicable law. You also have the right to lodge a complaint with the competent data protection authority in your country.

11. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, improve your experience, and analyze usage. These include the following types:

a) Essential cookies: necessary for the core operation of the Service, such as logging in and maintaining your session, and cannot be disabled.

b) Performance and analytics cookies: help us understand how the Service is used in order to improve it.

c) Functional cookies: to remember your preferences such as language.

d) Marketing cookies: used to measure the effectiveness of our campaigns, subject to your consent.

You can control your cookie preferences through your browser settings or through the preference management tool we provide. Disabling certain cookies may affect certain functionality of the Service.

12. Artificial Intelligence and Content Processing

The Service uses AI models to generate creative content and optimize campaigns. When you use these features, your store data and inputs are processed to generate the requested outputs.

We ensure that this processing stays within the scope of the permissions you grant, and we do not use your confidential data to train publicly available models in a way that reveals your data to others. Any output the Service generates remains associated with your workspace and subject to our terms of use.

13. Children’s Privacy

The Service is intended for commercial use by adults and is not designed for or directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a minor below the legal age without valid consent, we will take steps to delete that data as soon as possible.

14. External Links and Services

The Service may contain links to third-party websites or services that we do not control. This Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party you interact with.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or through a prominent notice within the Service before the changes take effect.

The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of the Service after the changes take effect means you accept the updated Policy.

16. How to Contact Us

If you have any questions, concerns, or requests relating to this Policy or your personal data, you can contact us at:

Data Protection Officer: [name / title] Privacy email: [email protected] Mailing address: [official company address]

We will make every effort to respond to and address your inquiries within a reasonable time and as required by applicable laws.