Privacy
Policy

Mawidi ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp appointment management platform and related services.

This policy applies to: Business owners and administrators using Mawidi, end-users booking appointments through Mawidi, and visitors to our website.

Jurisdictions & Compliance: We operate globally with a focus on the GCC region (Saudi Arabia, UAE, Qatar, Kuwait, Bahrain, Oman), United Kingdom, and serve customers worldwide.

We comply with GDPR (General Data Protection Regulation) for EU users, CCPA (California Consumer Privacy Act) for California residents, GCC Data Protection Laws for users in Gulf Cooperation Council countries, and UK Data Protection Act for UK users. See "Data Controller" below for our full legal identity.

Who We Are: Mawidi (trade name) operates this platform.

Registered Address: Doha, Qatar. This is the same address listed in our Terms of Service.

Contact: For general privacy questions, email privacy@mawidi.com. For urgent security matters, email security@mawidi.com.

Data Protection Officer (DPO): We have appointed a Data Protection Officer for GDPR-related matters. Contact the DPO directly at dpo@mawidi.com.

Controller vs. Processor Role: For data you provide to us directly (your account, billing, and platform usage), Mawidi acts as the data controller. For data your customers share with your business through Mawidi (bookings, conversations), your business is the data controller and Mawidi acts as a data processor on your instructions.

Account Information: Full name and email address, password (encrypted and hashed), business name and industry type, contact information (phone number, business address), operating hours and service offerings.

Business Data: Service descriptions and pricing, staff member information, WhatsApp Business account details, appointment schedules and availability.

Payment Information: Payment method details (processed securely by Stripe), billing address and VAT/Tax registration, transaction history. Note: We do not store full credit card numbers.

Usage Data: Device information (type, operating system, browser), IP address and location data, pages visited and features used, time spent on platform, referral sources.

Communication Data: Conversation transcripts between businesses and customers, message metadata (timestamps, read receipts), and media files shared through conversations.

AI Voice Receptionist: When a business activates our AI voice receptionist, calls are processed in real time by our voice AI sub-processor, ElevenLabs, including the call audio itself. Recordings and transcripts are retained per the schedule described in "Data Security" below. Transcripts may be automatically quality-analyzed, with identifying details redacted before that analysis runs. Callers hear a recording disclosure at the start of the call.

Service Delivery & Your Account (Art. 6(1)(b), contract): We process your account details, business data, and booking information because it is necessary to perform our contract with you: providing and maintaining our appointment management platform, processing bookings and managing schedules, handling payments and invoicing, enabling WhatsApp Business integration, and providing AI-powered features you have activated.

Communication (Art. 6(1)(b), contract): We use your contact details to send appointment confirmations and reminders, provide customer support, respond to inquiries, send transactional emails, and deliver service updates and important notices, all necessary to deliver the service you signed up for.

Security, Fraud Prevention & Audit Logging (Art. 6(1)(f), legitimate interest; Art. 6(1)(c), legal obligation where applicable): We authenticate users, detect and prevent fraud and abuse, conduct security audits, and keep audit logs because we have a legitimate interest in keeping the platform and your account secure, and in some cases because logging or reporting is required by law.

Error Monitoring (Art. 6(1)(f), legitimate interest): We use Sentry to detect and diagnose technical errors in our application. Only technical error data is processed (stack traces, error messages, request metadata), and we strip identifying details before sending events, so we can keep the service reliable without relying on your consent for this narrow, technical purpose.

Analytics Cookies (Art. 6(1)(a), consent): With your consent, we analyze platform and website usage to understand behavior, improve features, develop new functionality, and run A/B tests and performance optimization. See "Cookies & Tracking" below for how to grant or withdraw this consent.

Marketing Communications & Marketing Cookies (Art. 6(1)(a), consent): With your consent, we send promotional offers and feature announcements, personalize marketing communications, run marketing cookies (including the Meta Pixel and Google Ads), and conduct market research and surveys. You can withdraw this consent at any time; see "Your Rights & Choices" below.

Service Providers & Sub-processors: We work with the following third-party processors, each acting only on our instructions and only for the stated purpose: Clerk (authentication and user identity, hosted in the US), Convex (our primary application database, hosted in the US), Stripe (payment processing), Twilio (telephony and WhatsApp messaging infrastructure), and ElevenLabs (voice AI processing, including call audio, for the AI voice receptionist).

Analytics, Advertising & AI Processors: Meta (the WhatsApp Business Platform for messaging with your customers, and the Meta Pixel plus Conversions API for advertising, both only with your marketing consent and with your email and phone hashed before sending), Google (Google Analytics and Google Ads, only with your consent, and Google Gemini AI for knowledge-base features), PostHog (product analytics including session recording, only with your consent, hosted in the United States), Sentry (error monitoring), Anthropic, OpenAI, and OpenRouter (AI language processing that powers our reception and quality-assurance features), Pinecone (knowledge-base search index, hosted in the US), Resend (email delivery), and Upstash (infrastructure, including rate-limiting and caching).

Full Subprocessor Register: For the complete list of every processor with its purpose, the categories of data it processes, its region, and the safeguard we rely on, see our Subprocessor Register at /en/legal/subprocessors (Arabic: /ar/legal/subprocessors).

Facebook & Instagram Data: If you connect a Facebook Page or Instagram professional account, we access, via Meta's Graph API and with your explicit authorization, the messages sent to your Page/account (message content and the sender's Meta-assigned ID), your Page IDs, and connection metadata, solely to help you read, reply to, and manage customer conversations from your Mawidi dashboard. We never post as you without your action and never sell this data. You can disconnect at any time, and either you or a customer can request deletion of this data; see “Your Rights & Choices” and our data deletion endpoint at /api/webhooks/social/meta/data-deletion.

Business Transfers: In the event of merger, acquisition, or sale of assets, your information may be transferred. You will be notified via email and prominent website notice.

Legal Requirements: We may disclose information to comply with court orders or legal processes, enforce our Terms of Service, protect rights and safety of Mawidi and users.

B2B Context: Mawidi is a B2B platform. Your business customers' data is processed on your behalf. You remain the data controller for your customer data.

We Never Sell Your Data: We do not and will never sell your personal information to third parties or share data for third-party marketing without your consent.

How Our AI Receptionist Makes Decisions: Our AI-powered WhatsApp and voice receptionist can automatically process booking requests and replies based on the messages your customers send, for example confirming or declining an appointment slot, or requesting a deposit before confirming a booking.

No Legal or Similarly Significant Effects Intended (GDPR Art. 22): These automated outcomes are designed to be low-stakes scheduling decisions. We do not intend for them to produce legal effects or similarly significantly affect you.

Human Review Path: A human, the business owner or their staff using Mawidi, can review, override, or reverse any automated booking decision through their dashboard.

Contest an Automated Outcome: If you disagree with an automated decision, contact the business directly or email privacy@mawidi.com and we will help facilitate a human review.

Right to Access (GDPR Art. 15, CCPA): Request a copy of all personal data we hold about you. Email privacy@mawidi.com with subject "Data Access Request". We respond within 30 days.

Right to Rectification (GDPR Art. 16): Correct inaccurate or incomplete personal information. Update directly in your account settings or contact support.

Right to Erasure (GDPR Art. 17, CCPA): Request deletion of your personal data. Account deletion removes all associated data permanently within 30 days.

Right to Data Portability (GDPR Art. 20): Receive your data in a structured, machine-readable format. Download your data anytime from Account Settings, or email privacy@mawidi.com for a manual export.

Right to Restriction of Processing (GDPR Art. 18): Ask us to limit how we use your data, for example while we verify its accuracy or investigate an objection, instead of deleting it outright. Email privacy@mawidi.com to request restriction.

Right to Object (GDPR Art. 21): Object to processing for direct marketing purposes. Unsubscribe from marketing emails or contact privacy@mawidi.com.

Right to Withdraw Consent (GDPR Art. 7(3)): Wherever we rely on your consent, you can withdraw it at any time, with effect for the future. Withdraw cookie consent anytime via the "Cookie Settings" control in the site footer. Withdraw marketing consent via the unsubscribe link included in every marketing email. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

How to Exercise Your Rights: Handle many of these rights directly in Account Settings (delete your account, download your data). For anything else, use the "Privacy" topic on our contact form or email privacy@mawidi.com. We acknowledge every request and aim to respond in full within 30 days.

Encryption: All data transmitted using TLS 1.3 encryption. Database encryption using AES-256. Password hashing with bcrypt (industry standard).

Access Controls: Multi-factor authentication (MFA) available, strong password requirements enforced, role-based access control (RBAC), regular access reviews and audits.

Infrastructure Security: Regular security updates and patches, vulnerability scanning and penetration testing, DDoS protection and rate limiting, hosted on cloud infrastructure that maintains SOC 2 Type II certification (AWS).

Data Retention: Active accounts retain data as long as the account is active. Conversation transcripts and WhatsApp message history are automatically deleted after the business's configured retention window (default 365 days, tenant-adjustable). Deleted accounts are permanently removed within 30 days. Backup copies are kept for a limited backup retention period after deletion, not indefinitely.

Your Responsibility: Keep your password confidential, enable two-factor authentication, use secure networks for sensitive operations, report security concerns to security@mawidi.com.

Essential Cookies (Always Active): Required for platform functionality, authentication and session management, security features. Cannot be disabled.

Analytics Cookies (With Consent): Google Analytics tracks website usage and performance with anonymized IP addresses. You can opt-out via cookie consent banner or browser settings.

Preference Cookies (With Consent): Language selection (Arabic/English), theme preferences (dark/light mode), dashboard customizations.

Third-Party Cookies: Google Analytics (website analytics), Stripe (payment processing session management), and, only if you consent via the marketing cookie category, the Meta Pixel (to measure our own Facebook/Instagram ad campaigns). No advertising or tracking cookies load without your consent.

Managing Cookies: A cookie consent banner appears on your first visit. You can accept all, reject non-essential, or customize your preferences at any time using the "Cookie Settings" control in the site footer. We honor Do Not Track for analytics and advertising tags.

Data Storage Locations: Our cloud infrastructure is hosted primarily in the EU (Ireland) for our core application, with several sub-processors named above operating from the United States. All providers meet GDPR and international compliance standards.

Cross-Border Transfers & Safeguards: When we transfer personal data to the United States or another country outside the EU/EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and on data processing agreements (DPAs) that we put in place with each vendor named in "Information Sharing & Disclosure" above.

Full Processor List: See "Information Sharing & Disclosure" above and our Subprocessor Register at /en/legal/subprocessors (Arabic: /ar/legal/subprocessors) for the complete list of sub-processors, their purposes, and their regions.

Your Rights: You have the right to be informed about where your data is transferred, to object to transfers to specific countries, and to request that data remain in your jurisdiction where technically feasible.

Data Localization: We are working on data localization options for customers who require data storage exclusively in the GCC region or EU-only data processing.

Minimum Age: 13 years old in most jurisdictions, 16 years old in EU/EEA countries (GDPR requirement), 18 years old for business account creation.

Business Use Context: Mawidi is a B2B platform designed for business owners, professional service providers, and business administrators. We do not target children with our marketing.

Parental Consent: If your business serves minors (under 18), you are responsible for obtaining parental consent and complying with COPPA and local laws.

If We Discover Child Information: We will delete the information immediately, close any accounts created, and take steps to prevent future collection.

How to Report: If you believe a child has provided information to us, email privacy@mawidi.com with subject "Child Privacy Concern".

How We Update: We may update this Privacy Policy to reflect changes in our business practices, new features, legal requirements, or user feedback.

Material Changes: For significant changes affecting your rights, we will send email notification at least 30 days before changes take effect, display a prominent website banner, and show in-app notifications.

Minor Changes: For non-material changes (typos, clarifications), we will update the "Last Modified" date. Changes take effect immediately.

Your Options: If you disagree with changes, you can email us with concerns, request data deletion before changes take effect, or close your account within the 30-day notice period.

Version History: Current version: July 16, 2026. We maintain archives of previous privacy policy versions available upon request.

Privacy Team: Email privacy@mawidi.com. Response time: Within 3 business days for acknowledgment, 30 days for full response.

Security Issues: Email security@mawidi.com for urgent security matters only. Response time: Within 24 hours.

Data Protection Officer (DPO): Email dpo@mawidi.com for GDPR-related inquiries.

Regulatory Authorities: If not satisfied with our response, you can lodge a complaint with your local data protection authority. UK: ICO (ico.org.uk), EU: Find your authority at edpb.europa.eu.

Response Timeline: Acknowledgment within 3 business days, simple requests within 14 days, complex requests within 30 days (45 days if exceptionally complex).