Data processing agreement

For Waazn Business customers · Last updated 13 October 2026 · العربية

This agreement forms part of the terms of service between Waazn and each company that uses Waazn Business (the "Customer"). It applies automatically when the Customer creates a Waazn Business account. It follows the Kingdom of Bahrain's Personal Data Protection Law (Law No. 30 of 2018) and its implementing resolutions.

1. Roles

For company-card data, the Customer is the data controller and Waazn is the data processor acting on the Customer's behalf. For the Customer's own account details (owner and admin names, emails, billing), Waazn is a controller under its privacy policy.

2. What we process

• People: the Customer's owners, admins and viewers, and the employees ("card holders") who link a company card.
• Data: names and work emails of portal users; for each card holder, their name, the cards registered to them, and for payments made with those cards only: amount, currency, merchant, time, bank, the card's last 4 digits, category, balance when the bank includes it, any explanation the card holder sends, and any receipt photo they attach.
• Not processed: card holders' personal cards, other SMS, SMS text, contacts and photos other than receipts they choose to attach.
• Purpose: to show the Customer live company spending, limits and alerts, explanations and receipts, reports and exports, and to provide the API the Customer turns on.
• Duration: for as long as the Customer's account is open, plus the deletion period in section 9.

3. The Customer's responsibilities

• Register company cards only to employees who agree, and tell them how Waazn is used (the in-app consent screen helps with this).
• Have a lawful basis for monitoring company-card spending, and use the data only for managing company spending.
• Give instructions that comply with the law.

4. Our commitments

• We process the data only on the Customer's documented instructions, which are these terms, the settings the Customer chooses in Waazn Business, and its written requests, unless the law requires otherwise.
• We never sell the data, never use it for advertising or marketing, and never use it to train AI models.
• Everyone at Waazn with access is bound by confidentiality, and access is limited to what they need.

5. Security

• SMS are parsed on the card holder's phone; the SMS text never reaches our servers.
• All data travels over HTTPS (TLS).
• Portal sign-in uses Google or a one-time email code; sessions expire; roles (owner, admin, viewer) limit what each person sees; every access change is logged.
• Server access is limited to the Waazn team using SSH keys. Databases are backed up regularly, and backups are kept for 14 days.

6. Sub-processors

We use these service providers. Each is bound by data protection terms, and each is in a country on the Bahrain Personal Data Protection Authority's list of countries with adequate protection.

• Hostinger – server hosting (United Kingdom)
• OpenRouter and the AI provider it routes to – AI answers and receipt reading (merchant, total, VAT, seller's VAT number), with no storage or training (United States)
• Brevo and Hostinger Mail – email delivery (European Union)
• Google – sign-in (United States)
• Telegram – alerts the Customer chooses to receive there
• Polar – subscription billing (United States); handles only billing details, not card data from SMS

We will give at least 30 days' notice on this page or by email before adding or replacing a sub-processor, and the Customer may object and cancel if it disagrees.

7. Helping the Customer

We help the Customer answer requests from card holders and portal users to access, correct or delete their data, and we provide the information the Customer reasonably needs to show its own compliance. Card holders can also leave a company at any time in the app, which stops sharing at once.

8. Data breaches

If we become aware of a breach affecting the Customer's data, we will tell the Customer without undue delay and within 48 hours, with what we know: what happened, the data and people affected, and what we are doing. This lets the Customer meet the 72-hour notification duty to the Personal Data Protection Authority. We will notify the Authority and affected people directly where we are the controller.

9. When the account ends

The Customer can export its data at any time. Within 30 days after the account closes, we delete the Customer's data from our live systems; it leaves our backups within a further 14 days. We keep invoices and payment records only as long as tax and accounting law requires.

10. Liability and law

The limits of liability in the terms of service apply. This agreement is governed by the laws of the Kingdom of Bahrain. If this agreement and the terms conflict on data protection, this agreement wins.

Need a signed copy for your records? Email hello@waazn.com.