Privacy policy – Wasel Mail

This policy explains how Wasel (“Wasel”, “we”) handles data in Wasel Mail. It covers the mail service at mail.wasel.sa, the Wasel Mail apps for Windows, Android and iOS, and the Wasel Cloud integration. It supplements Wasel's general privacy policy.

When your company uses our services, your company is responsible for its employees' and customers' data, and Wasel processes that data on its behalf and under its instructions.

• Account data: your email address and password.
  • The password is stored in the device's secure keystore: Android Keystore, Windows DPAPI or the iOS Keychain.
  • The notification service does not keep your password; it only verifies it when notifications are turned on.
• Mail content: messages, attachments, drafts and folders stored on the mail servers, plus a temporary copy on the device for offline reading.
• Company contacts directory: synced from Wasel Cloud and stored on the device, for address autocomplete.
• Notification data: your device's push token, linked to your email address and device type. It is deleted automatically when it stops being used.
• App settings: language, theme, signatures, trusted senders and the Gatekeeper. Blocking rules and auto-replies are stored on the mail server so they work on all your devices.
• Technical logs: server logs (such as IP address, connection time and notification delivery status) for security and troubleshooting.
• Fingerprint or face: never reaches us; only your device's operating system checks it.

You can add accounts from other email providers (IMAP/SMTP). In that case:

• The app connects directly to that provider's servers.
• Wasel never receives that account's password or mail.
• Its notifications are not sent through Wasel's notification service.

Those accounts are governed by their provider's privacy policy.

We only ask for these permissions when needed, and you can turn them off in your device settings:

• Notifications: to alert you as soon as new mail arrives.
• Camera: only to scan the QR code when signing in on mobile. No images are saved or sent.
• Photos and files: to attach files and save the attachments you choose.
• Fingerprint or face: for app lock if you enable it; verification happens on the device.

• To provide, operate and support the service.
• To send the notifications you choose.
• For security, abuse prevention and troubleshooting.
• For billing and legal obligations.

We don't read or analyse your mail for any other purpose. Sorting in the app (such as “Focused”, “Newsletters” and the Gatekeeper) happens on your device.

• We don't sell data or use it for advertising.
• We don't track you across other companies' apps or websites, and our apps contain no analytics or advertising trackers.
• By default the app blocks remote images in messages, because they can tell the sender that you opened the message and reveal your IP address. It shows them automatically only from your organisation, your contacts and senders you choose to trust.

We share data only as needed to provide the service or where the law requires:

• Push services from Google (Firebase Cloud Messaging) and Apple (APNs): to tell your device new mail has arrived. The notification includes the sender's name, the subject and roughly the first two lines of the message so it can appear on your screen. Your company's service admin can turn on “notifications without details” so only “New message” is shown.
• Other mail servers you correspond with: as needed to deliver your messages.
• Hosting providers acting on our behalf.
• Competent authorities when legally required.

• Mailboxes are stored on servers operated by Wasel.
• The notification contents described in section 7 pass through Google and Apple servers, which may be outside the Kingdom. This is done in line with the Personal Data Protection Law and the regulation on transferring personal data outside the Kingdom.

When you use “Sign in on mobile”:

• The desktop app encrypts the account details end to end (AES-256).
• The encrypted copy is held on Wasel's server for at most 3 minutes and delivered only once.
• The decryption key exists only in the QR code, so Wasel cannot read this data.

• Data is stored on servers operated by Wasel, or by hosting providers we contract with under appropriate protection obligations.
• We use encrypted connections (TLS), access controls and backups.
• Mail is kept while the mailbox exists; when an account is closed we delete its content within 30 days.
• The on-device copy is deleted when you remove the account from the app or uninstall it. Removing the account also stops its notifications and deletes the linked device token.
• We keep server logs for 90 days, then delete them.
• If an incident affects your data, we notify your company and the competent authorities within the statutory deadlines.

• In the app: “Settings → Accounts → Sign out” removes the account and its data from the device.
• From our servers: to request deletion of the mailbox and its data, email us at support@wasel.sa from the address on the account, or ask your company's account admin. We confirm the request and delete the data within 30 days, unless the law requires us to keep some of it (such as billing records).

Under Saudi Arabia's Personal Data Protection Law and applicable regulations, you have the right to:

• Know how your data is processed.
• Access it and obtain a copy.
• Have it corrected.
• Request its deletion.
• Withdraw your consent.

If your account belongs to a company, we may refer your request to it as the party responsible for the data. You may also file a complaint with the Saudi Data & AI Authority (SDAIA).

The service is for businesses and their staff and is not directed at anyone under 18.

We may update this policy; we will show the date above and notify you in the app or by email of material changes.

Contact: support@wasel.sa — 920029957