Privacy Policy
Last updated: 12 November 2026
In short
• We collect only what we need to run Wawika and keep it safe.
• We never sell your data and never show ads based on your behaviour.
• Your phone number is never shown. Your location is never shown — unless you choose to share a location in a chat.
• Chats are encrypted while they travel, but not end-to-end. The shop and its team can read them.
• ID documents are only for the blue badge (for a business or your own account). We ask for your clear permission first and delete them 30 days after our decision.
• You can download your data or delete your account at any time: Profile › Delete account, or wawika.com/delete-account.html.
1. Who we are
Wawika is run by Abdallah Mohamed Hassan Mohamed Hassan Kamar (trading as Kamar Soft) (“Wawika”, “we”, “us”). We run the Wawika app and the website wawika.com, a service to find local businesses and to talk, order and build communities with them.
We are the “controller” of the personal data described here under the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (the “PDPL”). Wawika is also used in other Arab countries, including Saudi Arabia, the United Arab Emirates, Kuwait, Qatar, Bahrain, Oman, Jordan, Lebanon, Iraq, Syria, Palestine, Yemen, Sudan, Libya, Tunisia, Algeria, Morocco and Mauritania. For people there, we also follow the data protection law of their country where it applies (for example Saudi Arabia’s Personal Data Protection Law, the UAE’s Federal Decree-Law No. 45 of 2021, Qatar’s Law No. 13 of 2016, Bahrain’s Law No. 30 of 2018, Oman’s Royal Decree No. 6/2022, Kuwait’s Data Privacy Protection Regulation, Jordan’s Law No. 24 of 2023 and Lebanon’s Law No. 81 of 2018). Where they apply, we also follow the EU/UK GDPR and the California CCPA/CPRA.
Data Protection Officer: [email protected] · Privacy requests: [email protected]. Our postal address and registration details are available on request at [email protected].
2. Data we collect
a) Account data: your name, @username, profile and cover photo, language, your year of birth (to confirm you are 18 or older), the version and time you accepted our Terms, a hashed recovery key, and your email address or phone number if you sign in with them. If you sign in with Apple (iPhone) or Google (Android), we receive a user ID from Apple or Google and, if shared, your email address — never your password.
b) What you create: messages, photos, videos, voice notes, files, orders, bookings, invoices, reviews, reports, cases, community posts and event replies. Also delivery addresses you save, and a location you choose to send in a chat (see “Your location”).
c) Business data, if you run a business: business name, category, address, map pin, area, hours, phone, photos, products, prices, stock, offers, delivery terms, team members and broadcast messages. Business profiles are public.
d) Verification documents, only if you ask for the blue badge: trade licence or commercial register, the owner’s national ID (front and back), the legal name and registry number, and the tax card if you choose to add it. For a personal blue badge (“Verify my account”): your national ID (front and back) and, if you choose, a selfie holding it. Staff compare the selfie with the ID by eye only — we do not use face recognition. See “ID documents and sensitive data”.
e) Location: your approximate location (rounded to about 500 metres) if you allow it.
f) Technical data: device type, operating system, app version, push-notification token, IP address, connection and security logs, and crash reports once enabled.
g) Messages to us: support requests, appeals, forms on our website, and deletion requests.
h) Signed-in devices: for each device you sign in on, we keep its name and type (for example “iPhone 16 · iOS”), the time you signed in and when it was last used, so you can see your devices and sign them out in Settings › Devices.
i) Anonymous app steps: we count a few steps in the app — for example opening the sign-up screen, finishing sign-up, opening a first shop or sending a first message — without your name or account, to find where the app is hard to use. We do not use them for advertising and never sell them.
We do not collect your contacts, call logs, SMS, browsing history, advertising identifiers or background location.
3. Where the data comes from
From you; from your device (technical data, and location only if you allow it); from other users (for example when someone messages you, adds you to a group or reports content); and from businesses (for example invoices or loyalty stamps they give you).
4. Why we use it
• To give you the service: account, finding businesses, chats, orders, bookings, invoices, notifications, groups and events (to carry out our agreement with you).
• To keep Wawika safe and lawful: stopping spam, fraud and fake accounts, checking businesses, filtering and reviewing reported content, handling cases and appeals, and enforcing our Terms (our legitimate interests and legal duties).
• To follow Egyptian law and valid requests from authorities (legal duty).
• To improve Wawika, using anonymous totals such as searches with no results (legitimate interests).
• Your approximate location, People nearby, offers from businesses you follow, ID documents, AI suggestions and push notifications are used only with your consent. You can take your consent back at any time. This does not affect what we did before.
No decision about you is made only by a computer if it has a legal or similarly big effect on you. The optional AI reply assistant only writes drafts for a business. A person always decides what is sent.
5. Your location
With your permission we use your approximate location (rounded to about 500 metres) to show businesses near you. We keep only your latest approximate location, never a history.
Your location is never shown — unless you choose to share a location in a chat. If you do, the exact spot you pick is sent in that chat, saved with the message, and seen by the people in that chat. Only share it with people you trust. You can delete it with “Delete for everyone”.
If you turn on People nearby, others nearby see only your name, never your location. We never show distances to people. You can turn location off in the app or in your phone settings, and we then delete the stored location. A business’s own address and map pin are public, because customers need directions.
6. ID documents and sensitive data
ID documents can contain sensitive personal data under the PDPL. We ask for them only when you request the blue badge, and only with your clear, separate consent in the app. You do not need to give them to use Wawika or to take orders.
We keep them in a private store that only authorised Wawika verification staff can open, never in public storage. We use them only to decide on your verification. You may cover any detail on the ID that we do not need. We delete the documents 30 days after our decision, or straight away if the request is rejected or you delete the business or your account. We keep only the decision, its date, the legal name and the registry number.
Apart from ID documents, Wawika does not ask for health, biometric, financial or criminal-record data. Please do not send such data in chats.
7. AI reply suggestions
Businesses can use an optional AI helper that writes draft replies. When a business taps “Suggest”, the recent text of that chat is sent to Anthropic (United States), which processes it for us only to write the draft. Nothing is sent unless the business taps “Suggest”. The business reads and chooses what to send.
8. Who can see your data
• Other users: your name, @username and photo. What you send in a chat is seen by the people in that chat. Group and community messages are seen by all members.
• Businesses: when you message, follow, order from, book with or review a business, that business and the team members it adds can see your name, @username, photo and what you send, including orders and stamps. Each business is an independent controller of that information and must use it only for your chat or order.
• Our service providers (processors), under written contracts that limit them to our instructions and require security: cloud hosting; Cloudflare (network security and delivery); Expo, Apple and Google (push notifications); OpenFreeMap (map tiles: it sees the map area you view, not your account); our own email server; and, when switched on, a verification-code provider (SMS or WhatsApp), a crash-report provider, and Anthropic (the AI helper, as described above).
• Authorities: only where Egyptian law (or other law that applies) requires it, for example a valid order from a competent court or the Public Prosecution. We check each request and give the minimum.
• A buyer or successor, under the same protections, if Wawika is merged or sold.
We never sell personal data.
9. How secure are chats?
All traffic between the app, the website and our servers is encrypted with TLS. Messages are stored on our servers so they sync and so businesses and their teams can reply. They are not end-to-end encrypted.
Wawika staff do not read chats, except: (a) content that was reported to us; (b) a chat you open a case about, which you allow support to read; (c) where needed to prevent serious harm or by law. Staff access to the admin console needs two-step verification and is logged.
10. Moving data between countries
Our servers and some providers are outside Egypt and outside the other countries we serve. These are the main ones:
• Cloud hosting and backups: United States.
• Cloudflare (network security and delivery): global network.
• Expo, Apple and Google (push notifications): United States.
• Anthropic (AI reply helper, only when a business taps “Suggest”): United States.
• OpenFreeMap (map tiles) and, when switched on, our code-sending and crash-report providers: United States and European Union.
When we move personal data out of Egypt we follow the PDPL, including the licences or permits and the consent it requires, and we make sure the receiver protects it at a level not lower than the PDPL. For people in the other countries we serve, we follow the cross-border transfer rules of their country’s law (for example the Saudi transfer regulation), using contracts that require the same protection and, where the law asks for it, your consent. For people in the EU/UK we also use the European Commission’s Standard Contractual Clauses or similar safeguards. You can ask [email protected] for details.
11. How long we keep data
• Account data: while your account exists.
• Messages and media: until you or the other side delete them, or the account is deleted. When a customer deletes their account, their chats with businesses are deleted for the business too. “Delete for everyone” removes the content and file from our servers.
• Closed or deleted businesses: customers keep their old chats with the business, read-only. The business’s public page, catalogue, offers and team access are deleted.
• Latest location: replaced on every update; deleted when you turn location off or delete your account. A location you sent in a chat stays in that chat until deleted.
• Verification documents: up to 30 days after the decision (see “ID documents and sensitive data”).
• Content removed by moderators: a restricted copy of reported text may be kept with the report for up to 12 months, or longer for a legal claim or if the law requires. The public copy and any file are deleted.
• Invoices and order records: as long as tax and consumer law require.
• Security and connection logs: up to 180 days, as the Anti-Cyber and IT Crimes Law No. 175 of 2018 requires, unless the law requires longer.
• Website forms and business enquiries: up to 12 months after our last contact.
• Encrypted backups: overwritten within 14 days.
• Signed-in devices: until you sign out of that device, or after 180 days without use.
• Anonymous app steps: up to 13 months.
• After you delete your account we delete or anonymise your data within 30 days, except what we must keep by law.
12. Security and data breaches
We use TLS encryption, hashed tokens and recovery keys, private storage for identity documents, removal of location data from photos and videos, encrypted backups, staff access by role with two-step verification and audit logs, rate limits and firewalls. No system is perfectly safe.
If a personal data breach happens, we will tell the Personal Data Protection Center within 72 hours, and tell the people affected within 3 working days after that, as the PDPL requires. We will say what happened, what data was involved and what you can do.
13. Your rights
Under the PDPL and other law that applies, you can: know what data we hold and see it; get a copy; correct it; delete it; take back your consent; restrict or object to some uses; be told about a breach that affects you; and complain to the authority.
How to use them: Profile › Delete account to delete your account; Settings › Account › Request account info to get a copy; or wawika.com/delete-account.html; or email [email protected]. We may need to check it is you. We reply within 30 days at the latest, or sooner if the law says so. Using your rights is free, and we will not treat you worse for it.
Egypt: you can complain to the Personal Data Protection Center. Other countries we serve: you can complain to your country’s data protection authority (for example SDAIA in Saudi Arabia, the UAE Data Office, or the authority named in your country’s law). EU/UK: you can complain to your local data protection authority. California: you can ask for access, deletion and correction, and name an agent. We do not sell or share personal data for advertising.
14. Age
Wawika is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a minor is using Wawika, write to [email protected] and we will delete the account.
15. Marketing
Businesses can send you offers only if you follow them and agreed to receive offers. Every offer can be stopped with one tap, and you can mute offers in Settings › Notifications. Wawika itself sends only service messages. We do not send third-party ads.
16. Changes
We will tell you in the app before important changes start. The date at the top shows the current version. If a change needs your consent, we will ask for it.
17. Contact
Data Protection Officer: [email protected] · Privacy: [email protected] · Security problems: [email protected] · Support: [email protected]
The Arabic version of this policy prevails for users in Egypt if the two differ.