Privacy Notice
1. Controller and Scope
Wakti FZC LLC, a free-zone company licensed by Ajman NuVentures Centre Free Zone (ANCFZ), Office No. BC-892692, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates, is responsible for this Notice. It applies to Wakti accounts, websites, applications, support, billing, security, and integrations. Contact [email protected] for privacy matters.
2. Our Data-Protection Roles
Wakti is a controller for account identity, direct billing, security, abuse prevention, legal evidence, service administration, and Wakti communications. For personal data submitted and directed by an organizational customer in its workspace, that customer is normally the controller and Wakti its processor. Individuals may also use Wakti for personal organization, in which case Wakti determines the relevant purposes described here.
3. Information We Process
We process account and profile details; workspace, project, task, resource, time, leave, expense, approval, invoice, client, file, message, and integration content; subscription and transaction references; support communications; preferences and consent choices; legal-acceptance evidence; and security, device, IP, authentication, audit, and diagnostic records. Stripe receives payment-card details; Wakti does not store full card numbers.
4. Purposes and Legal Bases
We process data to provide and secure the Service, perform contracts, administer accounts and payments, follow customer instructions, prevent fraud, support users, maintain records, improve reliability, comply with law, and establish or defend claims. Depending on the law and context, the basis is contract, steps requested before contract, legitimate interests, legal obligation, or consent for a genuinely optional activity. Withdrawing optional consent does not affect necessary account, security, contractual, or legal processing.
5. Artificial Intelligence
Wakti uses AI, including OpenAI models, for resource ranking and other assistance. The resource-ranking flow sends limited candidate attributes such as skills, proficiency, normalized scores, availability indicators, and cost bands; it excludes names, email addresses, stable user identifiers, and raw rates from the verified ranking payload. Public skill labels may be sent for embeddings. Authorized people must review recommendations and can override them. Contact [email protected] to question, correct, or contest an AI-assisted result. Wakti does not rely on this flow for a solely automated decision producing legal or similarly significant effects.
6. Service Providers and Disclosures
Our launch providers include Amazon Web Services in the UAE for primary hosting and backups, Brevo for service email, Stripe for payment processing, OpenAI for AI features, and Google Analytics only if optional analytics is enabled after a user choice. Provider processing regions can differ: OpenAI and other global providers may process data outside the UAE. Prometheus is not a launch subprocessor unless Wakti later deploys a third-party hosted service. We also disclose data when directed through an integration, required by law, needed to protect rights and safety, or involved in a corporate transaction. We do not sell personal information.
7. International Transfers
Primary application hosting is intended to remain in the AWS UAE region, but email, payments, AI, analytics, support, and integrations may involve other countries. Where applicable law requires safeguards for a restricted international transfer, Wakti and the relevant customer or provider must use the legally required transfer mechanism and supplementary protections. Contact [email protected] for the current processing-location and transfer information relevant to your use.
8. Cookies and Optional Analytics
Wakti uses necessary cookies or local storage for authentication, security, language, theme, registration handoff, and privacy choices. These are required for requested functions. Google Analytics is enabled only after you make the optional analytics choice; before that choice, Wakti does not load Google Analytics or send Google Analytics events. You can change or withdraw the choice at any time. Advertising personalization is not part of the launch baseline.
9. Retention and Deletion
Account and workspace data is kept while needed to provide the Service and then deleted or returned subject to customer instructions, disputes, legal holds, and mandatory records. AWS-UAE backups follow a 30-day expiry and deletion cycle. Operational audit evidence retention depends on the subscription plan, configured retention, record category, and mandatory legal periods; UAE financial and related audit records are retained for at least five years where required. Privacy-export download files expire after seven days and related request artifacts follow the implemented request schedule. Legal-acceptance evidence is kept while needed to prove the agreement and comply with law. Data can remain longer where a legal hold or mandatory rule applies. Help & feedback messages, attachments, contact snapshots, and internal support notes are normally retained for 12 calendar months after closure. Reopening for genuine follow-up and later closing the report starts a new closure period; routine edits or internal notes do not. Open reports are reviewed at least every 90 days for continued necessity. Unsubmitted temporary files expire after 24 hours and are scheduled for deletion within the following 24 hours. Rejected files are immediately inaccessible and scheduled for deletion. At retention expiry or an approved earlier deletion request, ordinary access closes and cleanup is scheduled within 24 hours. Documented legal holds or mandatory obligations may require restricted retention, with an owner and review date. Minimal private audit and privacy-case evidence follows the applicable audit schedule, without retaining the report body or files. Restored backups must have applicable deletion decisions reapplied before normal service resumes. Unmatched support emails are retained for up to 12 calendar months from receipt, with a necessity review at least every 90 days. Review or other routine administrative activity does not extend that period; earlier dismissal or approved erasure triggers the deletion process described above, subject to documented holds.
10. Security and Incidents
Wakti uses access controls, tenant isolation, encryption in transit, credential and session protections, audit evidence, and other measures appropriate to the risk. No system is completely secure. Wakti investigates suspected incidents and gives notifications required by applicable law. Report a suspected privacy or security incident to [email protected].
11. Your Rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of optional consent, and information about processing. Send requests to [email protected]. Wakti will verify identity proportionately, respond within the applicable period, explain any lawful refusal or retention, and not discriminate for exercising a right. For workspace data controlled by an organization, Wakti may direct the request to that organization and assist it.
12. Adults Only
Wakti is available only to people who are at least 18 and have reached legal majority where they live. The acceptance flow requires an express majority declaration but does not collect or retain a birth year or date of birth. Contact [email protected] if you believe an ineligible person provided personal information.
13. Complaints and Changes
You may complain to the privacy or consumer authority that has jurisdiction over your location or processing. You may also contact [email protected] first so Wakti can investigate. Wakti may update this Notice; a material change requiring acknowledgement will re-open the legal gate, while other changes may be notified in the Service or by email.
14. Contact
Privacy, rights, security, and legal notices: [email protected]. Postal address: Wakti FZC LLC, Office No. BC-892692, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates.
15. Help & feedback submissions
When you send Help & feedback, Wakti acts as controller for handling the request, following up, maintaining support continuity, and improving the product. We process your message and optional files, your account name and email, the selected workspace name and participant type, and limited technical context: product area, language, browser family, and viewport category. We do not automatically collect the page query string, page contents, or session logs through this form. Contract necessity applies where processing is needed to provide requested support; our legitimate interests in responding to suggestions and improving reliability apply where appropriate, subject to your rights. Authorized Wakti staff review submissions in a private inbox. Restricted internal service providers may process minimal operational notifications under appropriate safeguards. Workspace administrators do not receive other participants’ submissions through workspace audit or export tools. Avoid including unnecessary information about other people. Contact [email protected] for access, correction, objection, or deletion requests, including after leaving a workspace. Support correspondence also includes Wakti's replies, your email responses and their attachments, routing identifiers and delivery status. Brevo processes service email and incoming replies on our behalf. Email conversations follow the same report retention schedule; deleting Wakti's copy cannot remove messages already delivered to your mailbox. Emails awaiting association are reviewed in a restricted inbox using their claimed sender details, message and permitted attachments. A claimed email address is not proof of identity. Once a message is associated with a support request, it follows that request’s retention schedule.
16. Google and Microsoft Data
With your permission, Wakti accesses your basic profile (name, email address and profile picture) for sign-in, reads your calendar events to show them in Wakti and turn meetings into time entries, and, only when you create a Google Meet or Microsoft Teams link for a task, creates that one meeting. This data is used only for these features, stored encrypted, never sold or used for advertising, and never used to train AI or machine-learning models. Wakti's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect a calendar in Wakti or remove Wakti's access in your Google or Microsoft account settings at any time.
Questions? Contact us at [email protected].