Wasl Privacy Policy

Last updated: 3 November 2026

1. 1.Information we process about account owners

   • Instagram account details returned by Instagram when you connect: account ID, username and account type.
   • An Instagram access token that lets Wasl act on your account within the permissions you approve. We store it encrypted and never show it in the dashboard.
   • A list of your recent posts and reels (post IDs and links), read when you choose the reel for a campaign.
   • Campaign settings you create: the reel, keywords, message text, the link you share, the campaign duration and the recipient limit.
   • Sign-in and security data: a session cookie, a hashed session identifier and counters that limit repeated sign-in attempts.
   • If you subscribe to a paid plan: your billing email, plan and payment status. Card details are handled by our payment provider and never reach Wasl.

2. 2.Information we process about people who comment or message

   Wasl only processes comments on the reel an account owner selected, and only while that owner’s campaign is active.

   • When a comment contains the campaign keyword, Wasl receives the comment ID, the commenter’s Instagram user ID and username, and the comment text. The text is used once to check for the keyword and is not stored.
   • To deliver the reply, Wasl keeps an encrypted reference to the comment and the recipient. This reference is deleted within 24 hours, or as soon as the campaign is paused or ends.
   • To make sure nobody receives the same message twice, Wasl keeps a one-way fingerprint of the person’s Instagram ID together with the outcome of the delivery attempt. The fingerprint cannot be turned back into the Instagram ID.
   • If the person replies with the requested word, Wasl reads that reply and asks Instagram whether the person follows the account, so it can decide whether to send the link. Other messages in the conversation are ignored.

   Wasl does not read message history, does not post public replies, and does not message anyone who did not comment the keyword.

3. 3.How we use information

   • To run the campaigns account owners set up: matching keywords, sending the private reply, checking the follow condition and sending the link.
   • To prevent duplicate, excessive or unwanted messages, including per-campaign limits.
   • To keep the service secure, detect abuse and fix errors.
   • To provide support and to contact account owners about their account or billing.

   We do not sell personal information, we do not use it for advertising, and we do not use Instagram data to train artificial intelligence models.

4. 4.Legal basis

   Where data protection law requires a legal basis, we rely on the performance of our contract with account owners, our legitimate interest in operating a safe and reliable service, and the consent account owners give when they connect Instagram. Account owners can withdraw that consent at any time by disconnecting.

5. 5.Service providers and sharing

   • Meta Platforms, which provides the Instagram APIs Wasl uses to receive comments and send messages.
   • Cloudflare, which hosts Wasl and its database.
   • Our payment provider, for paid plans only.
   • Public authorities, where the law requires us to disclose information.

   These providers process information only to provide their services to us.

6. 6.International transfers

   Cloudflare and Meta operate data centres in many countries, so information may be processed outside the United Arab Emirates. When this happens we rely on these providers’ contractual and security commitments.

7. 7.How long we keep information

   • Encrypted delivery references: up to 24 hours, or until the campaign is paused or ends.
   • Campaign records, delivery outcomes and duplicate-prevention fingerprints: while the account is connected, and deleted within 30 days after the owner disconnects or asks us to delete them.
   • Access tokens: deleted when the owner disconnects Instagram or deletes their Wasl account.
   • Operational logs: kept for a short period for security and troubleshooting, normally no longer than 30 days.

8. 8.Security

   Wasl uses HTTPS for all traffic, encrypts access tokens and delivery references at rest, checks that incoming events are signed by Meta, and limits access to the service to its operator. No system is completely secure. If a breach affects your information, we will tell affected account owners without undue delay.

9. 9.Your choices and rights

   • Account owners can pause a campaign or disconnect Instagram from the Wasl dashboard at any time.
   • Anyone can remove Wasl’s access in the Instagram app under Settings and activity, then Website permissions, then Apps and websites.
   • You can ask us to access, correct or delete information about you by emailing collab@moathalherani.com. We reply within 30 days.
   • Residents of the United Arab Emirates have rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. If you live in the European Union or the United Kingdom, you may also object to processing and complain to your local data protection authority.

   Step-by-step instructions are on the Wasl data deletion page.

10. 10.Children

    Wasl is built for creators and businesses and is not directed at children. Account owners must be at least 18 years old.

11. 11.Changes to this policy

    If we change this policy, we will update the date at the top of this page. If a change is significant, we will tell account owners by email or in the dashboard before it takes effect.