Privacy policy

Last updated: 2026-11-08

DRAFT, not yet legally reviewed. Must be reviewed by a lawyer familiar with Saudi Arabia’s Personal Data Protection Law (PDPL) before publishing.

This policy explains what data the Waaa app and website process, why, and your rights under Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations.

1. Who we are

Data controller: [legal name of the entity or person, CR number, national address]. Privacy contact: hello@getwaaa.com.

2. Data we process

Data you enter: your baby’s name, birth date and photo (optional); feed, sleep, diaper, meal and other logs; and the parent name shown to your family.
Family sync data: your family code, a random device identifier, and your Apple push token so family alerts can be delivered.
Invites: when you invite someone by phone number, we store a keyed hash of the number (not the number itself) to match the invite [confirm when family roles launch].
Purchases: handled by Apple or Google. We never receive card details, only your subscription status.
Contact form: your name, contact details and message.

The app and this site contain no third-party analytics, advertising or tracking tools.

3. Where data is stored

On your device first. If you turn on family sync, a copy is stored with our database provider (Supabase) in [hosting region].
iCloud backup (once launched) is stored in your own iCloud private database at Apple.
Where hosting is outside the Kingdom, transfers follow the PDPL’s cross-border transfer rules [legal review: transfer basis and safeguards].

4. Why we process it (purposes and legal basis)

To provide the app and its features, including sync and reminders (performing the service you asked for).
To send family notifications (with your consent, which you can withdraw in device settings).
To answer your messages and support you.
To keep the service secure and prevent abuse.

5. Sharing

We do not sell data or share it for advertising. Logs are visible only to the family members you invite, according to their permissions. We use processors acting on our behalf: Supabase (database), Apple (notifications, purchases, iCloud), Google (once Android launches) and [hosting and contact-form provider].

6. Children’s data

Waaa is for parents and the people they authorise. Data about a baby is entered by a parent or guardian, or with their permission. Children are not meant to use the app themselves.

7. Nannies and caregivers

Nanny mode collects no location, uses no camera and produces no monitoring reports. This is shown to her, and her consent is asked in her language before she joins. She can leave the family at any time.

8. Retention

We keep data while your family uses sync. When you delete data or ask us to, we remove it from our servers within [period, e.g. 30 days]. Contact messages are deleted after [period].

9. Your rights

To be informed about how your data is processed.
To access your data and get a copy.
To correct or update it.
To ask for it to be destroyed when no longer needed.
To withdraw consent at any time.

To use any right, email hello@getwaaa.com; we reply within the statutory period. You may also complain to the Saudi Data & AI Authority (SDAIA).

10. Security

We use encrypted connections and access controls that limit each family’s data to its members [confirm after security phase 1 ships]. We will notify the competent authority and affected people of any incident as the law requires.

11. Changes

We will post changes here with the update date, and tell you in the app if a change is significant.