Privacy Policy
This policy explains what personal data Waafer collects, why, who we share it with, and the choices you have. We wrote it in plain English. It is designed with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") in mind.
1. Who we are
Waafer is operated by Array Labs DWC LLC ("Waafer", "we", "us"), Dubai, UAE. We decide how your data is used (we are the "controller"). Contact: support@arrayae.com.
2. What we collect
- Account details you give us: your name, business name, email, phone (optional), emirate and sector, and your language choice.
- Your activity in the app: which providers you view, the deals you request, messages you add to a request, and support messages.
- Sign-in data: one-time codes (stored only as a scrambled hash and deleted after use or after 10 minutes) and sign-in sessions with basic device information (browser or app type).
- Technical data: IP address, used briefly to prevent abuse (rate limiting), and anonymous usage counts (for example, how many people opened a provider page).
- Early-access sign-ups: if you joined our early-access list, we use those details to set up your account when you first log in.
We do not collect payment card details, and we do not use advertising trackers in the app.
3. Why we use it (and our legal basis)
- To create and run your account and log you in (performing our agreement with you).
- To send your request to a provider when you tap Get this deal (your request and consent).
- To send service emails: sign-in codes, welcome, request confirmations and support replies (performing our agreement).
- To keep Waafer secure and prevent misuse (our legitimate interest and legal obligations).
- To understand which categories and providers are useful, using counts that do not identify you (legitimate interest).
4. When we share your data
- Providers, only when you ask. When you request a deal, we send that provider your name, business name, email, phone, emirate, sector and any message you write. When you use a sign-up link, we only tell the provider that you came from Waafer through the link itself. After that, the provider handles your data under its own privacy policy.
- Service providers who help us run Waafer: cloud hosting (Cloudflare) and email delivery. They process data only on our instructions.
- Authorities, if the law requires it.
We never sell your personal data. Providers pay Waafer a fee when you sign up or close a deal with them; this does not change what we share.
5. Where your data is stored
Our hosting provider stores data on servers that may be outside the UAE. When data leaves the UAE, we rely on the safeguards allowed under the PDPL, such as contractual protections with our service providers.
6. How long we keep it
- Account data: while your account is open. Delete your account and it is removed straight away.
- Sign-in codes: up to 10 minutes. Sign-in sessions: up to 180 days or until you log out.
- Email delivery logs: 30 days. Anonymous usage counts: up to 400 days.
- Records we must keep by law are kept only as long as required.
7. Your rights
Under the PDPL you can ask to access, correct, or delete your data, restrict or object to some processing, and receive a copy of your data. You can correct your profile and delete your account yourself in Account. For anything else, email support@arrayae.com. You can also complain to the UAE Data Office.
8. Deleting your account
In the app, go to Account → Delete my account. This permanently deletes your profile, requests, support messages and sign-in sessions. Details already sent to a provider at your request stay with that provider; contact them directly to delete them.
9. Security
We use encrypted connections, store sign-in codes and session tokens only as hashes, limit who can access data, and rate-limit sign-in attempts. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
10. Children
Waafer is for businesses and is not meant for anyone under 18.
11. Changes
If we change this policy in a meaningful way, we will tell you in the app or by email before it takes effect.