Privacy Policy

Effective and last updated: 9 October 2026

1Who we are

WATSLI is a shared WhatsApp workspace for company teams. It is operated by The A Media Studio LLC, a company in the State of Qatar ("WATSLI", "we", "us"). This Privacy Policy explains what personal data we handle when you use:

• the website at watsli.com,
• the company app at app.watsli.com, and
• the platform admin used by our own staff at admin.watsli.com.

It follows Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016 (the "PDPPL"), and should be read with our Terms of Service.

Contact: hello@watsli.com

2Two roles: controller and processor

Our data protection roles. WATSLI generally acts as the data controller for its own website, company registration, subscription, account administration, billing and security records.

For personal data contained in the WhatsApp conversations, contacts and related records managed by a Tenant, the Tenant generally acts as the data controller and WATSLI acts as its data processor.

We process such End-Customer data to deliver and maintain the Services, in accordance with the Tenant's documented instructions, our applicable contractual obligations and the law.

Where WATSLI independently determines the purposes and means of a specific processing activity, it will act as a controller for that activity and explain the applicable purpose in this Policy.

In this Policy, "Tenant" means a company with a WATSLI account, "Team Members" are the people who sign in for it, and "End-Customers" are the Tenant's own customers.

3What we collect

3.1 Company account data

• Team Member name, work email address and role (company admin, supervisor or agent).
• Password, stored only as a salted bcrypt hash. We cannot read it.
• Sign-in session records: the time of sign-in and last activity, and a label for the browser or device. Our servers and hosting providers may also keep technical request logs, which can include IP addresses, for security and troubleshooting.
• The Tenant's company name, plan, country and time zone.
• The Tenant's WhatsApp connection details: phone number ID, WhatsApp Business Account ID, display name, phone number, and an access token that is stored encrypted.
• Message templates the Tenant creates: template name, category, language, the header, body, footer and button text, the example values entered for each variable, any sample image, video or document used for a media header, and the approval status and rejection reason Meta returns. Templates are stored per Tenant and sent to Meta for approval.
• Messaging activity records, including message identifiers, categories, timestamps and delivery statuses, where available from Meta, for technical operation, reporting, troubleshooting and compliance.
• WATSLI subscription and service billing records, including invoices, payments and account status. Meta's messaging charges are billed separately to the Tenant by Meta. WATSLI does not collect or store the Tenant's payment card details for Meta messaging charges.
• Emails you send us, and messages we send you such as password-reset emails.

3.2 Customer conversation data

• The customer's WhatsApp phone number and the profile name WhatsApp provides. WhatsApp does not send profile photos, so we do not hold them.
• Message text, photos, video, voice notes and documents, with timestamps and delivery status.
• Contact details a Team Member enters or imports from CSV or Excel: name, phone, type, tags, source, sales stage, deal name and value, and private notes.
• Which tracked ad link, if any, a customer came from, and how many times each link was clicked.

3.3 Website

If you email us we keep the message and your address. The marketing site does not use advertising or cross-site tracking.

4Why we use it

Service improvement and analytics. We may analyze aggregated or appropriately de-identified operational data to monitor reliability, prevent abuse and improve the Services. We do not use identifiable End-Customer conversation content for unrelated marketing, cross-Tenant profiling or AI model training.

We use personal data only for the disclosed purposes and on the lawful basis applicable to the relevant processing activity under Qatar's Personal Data Privacy Protection Law and other applicable laws.

We do not make automated decisions about End-Customers that have legal or similarly significant effects. Automatic replies only follow keyword rules the Tenant created.

5Who we share it with

We do not sell personal data. We use these providers to run WATSLI.

WATSLI can also connect a Tenant's number through Twilio instead of Meta. No Tenant uses Twilio today. If one does, Twilio will process that Tenant's message data on our behalf as a data processor, under its own terms, and we will list it in this table first.

We may also disclose data when the law or a valid order requires it, to protect people or the service from abuse, or as part of a sale or merger of our business under confidentiality. Tenants who need a separate data processing agreement can ask at hello@watsli.com.

6Where data is stored

Data storage and international processing. WATSLI's primary database and application files are hosted on a Hostinger VPS in Frankfurt, Germany. Our web applications may be delivered through Vercel's infrastructure, and WhatsApp message data is also processed by Meta and any other messaging provider actually used by the relevant Tenant.

As a result, personal data may be processed outside Qatar. We take reasonable contractual, organizational and technical measures appropriate to the nature of the data and applicable legal requirements. We do not guarantee that all data remains in Qatar.

Where a Tenant has specific data residency or international transfer requirements, the Tenant should contact us before connecting its account.

7How long we keep it

Retention during an active subscription. We retain account information, contacts, conversations, media and related records for the purposes and periods disclosed in the Services. Where supported, Tenants can select a retention period between 7 and 365 days, with a default setting of 90 days. The relevant retention start date and the data categories covered by the setting are displayed in the Tenant's account settings.

After termination. After the end of a subscription, WATSLI provides the applicable export and deletion process described in its Terms of Service. Information that is no longer needed will be deleted or anonymized according to the applicable schedule, except where continued retention is necessary for a legal obligation, a security investigation, the establishment or defense of legal claims, or another lawful purpose.

Deletion requests. Tenant administrators can submit deletion requests from inside the app (Settings, Data deletion), after signing in. End-Customers should contact the business they messaged, and may write to us at hello@watsli.com. We verify the requester's identity and authority, identify the relevant Tenant and data, and follow the procedures described in Section 10. A verified request may result in deletion from active systems before the normal retention period expires, subject to legal exceptions.

Backups. Encrypted backup copies are retained according to the backup rotation schedule disclosed by WATSLI, currently up to 90 days if that schedule is in operation. Information removed from active systems may remain in protected backup copies until those copies expire. If a backup containing previously deleted information is restored, WATSLI will take reasonable measures to reapply the relevant deletion instructions before the restored information is returned to normal use.

Financial and security records. Certain billing, transaction, access and security records may be retained for longer periods where necessary to comply with legal requirements, prevent fraud, investigate incidents or resolve disputes. Such data will be limited to the necessary purpose and retained only for an appropriate period.

• WATSLI subscription invoices, payment records and related financial documents are retained for the periods required by applicable law. WhatsApp messaging charges are billed directly by Meta and are not included in WATSLI's invoices. Technical messaging activity records are retained according to the applicable service retention policy, subject to legitimate operational, security and legal requirements.
• Message templates are deleted with the rest of the Tenant's data when retention ends, or when the Tenant deletes them.
• Sign-in sessions are kept while the person's account exists. Server and hosting request logs are kept for a limited time needed to investigate abuse and faults.
• Disconnecting a WhatsApp number from WATSLI does not by itself delete the data stored in WATSLI. That data follows the retention period above. Before disconnecting, a Tenant can export its messages as CSV (text only, without media files) and its contacts as CSV.

8Security

• Traffic is encrypted with TLS.
• Passwords are hashed with bcrypt. Messaging provider credentials (the Meta access token, and a Twilio auth token if Twilio is used) are encrypted before they are saved (AES-256-GCM).
• Sign-in sessions use short-lived access tokens, and each person has one active sign-in at a time. Changing a password signs out other sessions.
• Every request is tied to the signed-in person's company, and roles (admin, supervisor, agent) limit what each person can see and do.
• The database is not exposed to the internet. Public requests are rate limited.
• The API connects to the database with a restricted account that cannot change the database structure, and row-level security in the database limits each company's requests to that company's own rows.

No system is perfectly secure. If a breach affects personal data we control or process, we will tell the affected Tenants and any competent authority without undue delay, as the law requires.

9Who at WATSLI can see data

A small number of WATSLI staff hold the platform admin role. They can create and manage companies, and can reach the underlying systems for support, operations, security and billing. Platform admins sign in only at admin.watsli.com and cannot open the company app. We do not read Tenant conversations to sell to, market to or profile End-Customers.

10If you are a Tenant's customer

If you communicate with a business that uses WATSLI, that business generally determines why and how your conversation data is processed. The business is normally the data controller, and WATSLI processes the information on its behalf.

You may contact the business directly to exercise your privacy rights. You may also write to WATSLI at hello@watsli.com with the subject "Privacy request". WATSLI's data deletion requests are filed by company administrators from inside the app; details are at https://watsli.com/en/data-deletion.

When we receive a request, we take reasonable steps to verify the requester's identity, determine the relevant business and data, and coordinate with the business where required. Verification of an email address alone may not be sufficient to establish control of a WhatsApp phone number.

WATSLI will not delete or disclose information belonging to another individual or an unrelated Tenant without appropriate authorization or a valid legal basis.

We aim to acknowledge verified requests promptly and ordinarily within 72 hours, and to complete eligible deletion requests within 30 days, subject to the business's lawful instructions, the complexity of the request and applicable legal requirements.

When a request is completed, we provide written confirmation identifying its scope and any applicable legal or backup-retention exceptions.

11Your rights

Under the PDPPL, people whose personal data we control (mainly Team Members) may ask us to:

• confirm whether we process their data and give them a copy,
• correct data that is wrong or incomplete,
• delete data that is no longer needed or was processed unlawfully,
• stop or limit certain processing, object to it, and withdraw consent where we rely on it,
• receive their data in a commonly used format where we can provide it (today, the contact list can be exported as CSV from the app),
• and complain to the competent data protection authority in Qatar.

To exercise your privacy rights, contact hello@watsli.com with the subject "Privacy request". Company administrators can also use the data deletion request in the app where applicable. We may request additional information reasonably necessary to verify your identity and authority, while avoiding unnecessary collection of sensitive identification documents.

Where WATSLI acts as a processor, we will coordinate with the relevant Tenant as appropriate. Where WATSLI acts as a controller, we will assess and respond to requests in accordance with applicable law.

12Cookies

We use only the cookies the app needs to work: sign-in cookies (watsli_access and watsli_refresh), the selected company, and your language and display choices. We do not use advertising cookies, analytics or cross-site tracking tools. Blocking cookies in your browser will stop you from signing in.

13Children

WATSLI is a business platform. It is directed at businesses and their staff, not at children, and we do not knowingly create accounts for or collect account data from children. However, a business that uses WATSLI may receive messages from people of any age, including minors, in its WhatsApp conversations. That conversation data is controlled by the business (see section 2), and the business is responsible for handling it lawfully. If you believe a child has given us personal data, or you are a parent or guardian with a concern, write to us at hello@watsli.com and we will help, including by passing your request to the relevant business.

14Changes

When we change this policy we update the date above. For material changes we will tell Tenant account contacts, for example by email or a notice in the app. Continuing to use WATSLI after a change takes effect means you accept it.

15Contact

The A Media Studio LLC (WATSLI) Registered address: Tornado Tower, Floor 16, West Bay, Doha, State of Qatar Email: hello@watsli.com

Privacy Policy: https://watsli.com/en/privacy Terms of Service: https://watsli.com/en/terms Data Deletion: https://watsli.com/en/data-deletion