Privacy Policy

WGTK is an appointment booking platform serving service businesses (subscribers) and their customers. Our role depends on your relationship with us:

• If you registered your business on the platform, we are the controller of the account holder and subscription data.
• If you booked an appointment with a business through its page, that business is the controller of your data and we process it on its behalf and under its instructions. The business remains responsible to you for the service itself and for its own cancellation policy.

We collect the minimum the service needs to work:

• From subscribed businesses: business name and type, account holder name, email, mobile number, address, logo, and subscription and invoicing details. When a business turns on card payments: its legal name, commercial registration or freelance document number, and IBAN, which we share with the payment gateway Moyasar to verify the business and settle booking payments to it. Registration documents a business uploads for Moyasar before its live account is running are kept as an encrypted copy so its registration can be completed without uploading them again, and deleted as soon as the account is active. We never store card numbers; the licensed payment gateway handles them directly.
• From customers who book: name, mobile number, the chosen service and time, any note the customer writes, and the verification code when phone verification is enabled. When a customer asks the business to come to them: the district and address, and their location on the map if they choose to share it, which only the business and the staff member making the visit can see.
• From customers who add their email after a booking, which is optional: the email address. We keep it with the phone number to send the details of your bookings at any business on the platform without asking again. We do not give it to businesses, and you can ask us to delete it at any time.
• From customers who message a business on WhatsApp: mobile number, the name shown on WhatsApp, and the text of the messages exchanged with the business, whether the automated agent or a member of staff answered. The business sees them in its panel to follow what its customers were told and to reply.
• Automatically when you use the platform: IP address, device and browser type, pages visited and error logs, for operation and security.

We do not ask for sensitive data such as health or religious information. If you type it yourself into the notes field it reaches the business as written, so we recommend leaving it out.

• To carry out the booking and inform you and the business of it, as the agreement you requested requires.
• To send appointment confirmations and reminders by SMS, WhatsApp or email. These are service messages needed to complete the booking, not marketing.
• To answer your message to a business on WhatsApp and complete a booking in the conversation, at your request. The reply may be written by an automated agent that uses artificial intelligence and the business's own information, and you can ask to speak to a person at the business at any time.
• To have our support team review a WhatsApp conversation only when needed: when the business reports a conversation to us, or to fix a problem in the service or in the assistant's replies. This access is limited and logged, and conversations are not used for any other purpose.
• To verify the mobile number and prevent fake bookings and abuse, a legitimate interest of ours and of the businesses.
• To work out an overall rating of how you keep your appointments from your bookings on WGTK, with overall numbers about them (how many, how often you attend or cancel, in how many places you booked, how far ahead you book and your usual time), and show them to the business you book with so it can plan its day and reduce no-shows, a legitimate interest of ours and of the businesses. They are numbers only, never the names of other businesses, their services or what you paid there. You may object to them from the link at the end of any message a business sends you through WGTK, after which no business sees your numbers, or by contacting us to object or ask for a correction.
• To issue invoices, collect subscriptions and meet our legal and accounting obligations.
• To measure, fix and improve the platform, using aggregated statistics that do not identify individuals.

We send marketing messages only with your explicit consent, which you can withdraw at any time from the message itself or by contacting us.

A business you deal with may write to you from its own WhatsApp: a birthday greeting, a thank-you after a visit, or an invitation to come back. Every such message ends with a link that stops that business's messages at once. Stopping them does not affect your appointment reminders and confirmations, which are service messages.

• The business you booked with: it sees your name, number, appointment and note in order to serve you, and your appointment rating and the overall numbers about your bookings on WGTK described above.
• Service providers working for us under contracts that bind them to protect the data and use it only for our purposes: server and database hosting, SMS, WhatsApp and email delivery, the provider of the artificial intelligence model that writes the automated agent's replies, and the payment gateway chosen by the business.
• Government and judicial authorities when there is a binding legal request.

We do not sell, rent or share your personal data with anyone for their own purposes.

Our databases are hosted with a global cloud provider whose servers may be located outside the Kingdom of Saudi Arabia. We transfer the minimum needed to run the service, encrypted in transit and at rest, under contractual safeguards that hold the provider to a level of protection no lower than the PDPL and the data transfer regulations require.

If you object to this transfer you can contact us and we will explain the available alternatives.

• Booking and customer data: kept while the business account is active, since the customer record is part of the business. When the account is closed or the business asks us to, we delete or anonymise it within 90 days.
• WhatsApp conversations with a business: kept while the business account is active so the business can review them, and deleted with the customer data when the account is closed or the business asks.
• Verification codes: deleted as soon as they expire.
• Technical and security logs: kept briefly for operations and incident investigation, then deleted.
• Invoice and subscription records: kept for the periods the Kingdom's tax and accounting rules require.

The PDPL gives you the following rights, and we answer every request within 30 days of receiving it:

• To be informed: to know why we collect your data and how we process it, which this policy explains.
• Access and a copy: to see the data we hold about you and receive a copy in a clear format.
• Correction: to have your data corrected, completed or updated.
• Destruction: to have your data deleted once it is no longer needed for the purpose it was collected for, subject to what the law requires us to keep.
• Withdrawal of consent: for any processing based on your consent, without affecting processing already done.

To exercise any of these rights, email us at the address at the end of this page from the email or number we have on file so we can verify your identity. If your request concerns a booking with a business, we will handle it together with that business as the controller, and you can also contact the business directly.

When a business erases your data at your request, your record, its notes about you and your conversations with it are deleted, and your name, number and address are removed from your bookings and reviews there. The amounts of your visits stay in its reports without anything that identifies you, and issued e-invoices stay because the law requires them to be kept.

You also have the right to lodge a complaint with the competent authority for personal data protection in the Kingdom, the Saudi Data and Artificial Intelligence Authority (SDAIA).

• All traffic to the platform is encrypted (HTTPS), and stored data is encrypted by our hosting provider.
• Each business's data is isolated, so no business sees anyone but its own customers.
• Passwords are stored hashed and cannot be recovered, and internal access to data is limited to those who need it for their work.
• Card details never pass through our servers; they are handled by payment gateways licensed by the Saudi Central Bank.

If a security incident affects your personal data, we will notify the competent authority and the affected individuals as the law requires and within its deadlines.

We use the cookies the service needs to run: the sign-in session for businesses and staff, your language preference, and temporary state for phone verification.

On the public pages of the site only (not inside the dashboard, the staff portal or booking pages) we use the Google Ads tag to learn which sign-ups came from our ads. The tag is not used inside the service after sign-in, and we never sell your data.

You can disable cookies in your browser settings, but signing in to the dashboard will not work without them.

Subscribing and creating a business account is open to those aged 18 or over. If an appointment is for a minor, the guardian books it with their own details.

When a business turns e-invoicing on, we issue its tax invoices on its behalf and report them to the Zakat, Tax and Customs Authority as the e-invoicing regulation requires. An invoice carries the business's details (legal name, VAT number, registration and address), the sale's lines and amounts, and the customer's name if it was given at booking; it does not carry the customer's phone number.

Issued invoices and notes are kept in their signed form for as long as the VAT regulation requires (at least six years) and are never edited or deleted, even after the account closes, because they are the business's legal record. A business can export its whole archive from its panel at any time.

We record what happens inside each business account: who created, edited, deleted, marked paid or refunded a booking, who changed services, settings and the team, when, and what changed. The purpose is to let the owner review what their team does, to protect both sides in a dispute, and to let our team support the business when it asks.

The log shows the user's name or sign-in email as registered, and deleted bookings stay in it in their last shape. The log is kept with the account's data and for the same periods.

When a business links Google Calendar from its settings, we ask Google for permission to manage calendar events (calendar.events) and use it for one thing: creating an event for each of the business's bookings, updating it when the appointment changes and deleting it when the booking is cancelled. We do not read, display or store any other events in the calendar.

The access token Google grants is kept encrypted on our servers, together with the id of each event we created; neither is shared with any third party, and Google data is never used for advertising or analytics. The calendar can be disconnected at any time from the settings or from the Google account permissions page; we then delete the token immediately, and the events already in your calendar stay as they are.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may update this policy as our services or the law change. The updated version is published here with its date, and if the change is material we notify subscribed businesses by email before it takes effect.

For any question about this policy or to exercise your rights, use the contact details in the card below.