Privacy Policy

1. Who is responsible for your data

Waslafg - Sadat, Chemin de Champrilly 29, 1004 Lausanne, Switzerland (UID/IDE CHE-416.282.384) is the controller responsible for the personal data described in this Privacy Policy. The owner is Ehsanullah Sadat.

For privacy questions or to exercise your rights, email info@waslafg.com or write to the registered address above.

2. Personal data we collect

Account and identity data may include your name, email address, mobile number, password credential or authentication token, phone-verification status, optional date of birth, optional profile image, language preference, account role, and account timestamps.

Order and transaction data may include the customer account, recipient mobile number, country, mobile operator, selected product, amount, currency, order and provider references, payment and fulfillment status, provider responses, and transaction timestamps.

Support and communication data includes messages, transaction references, attachments, and other information you provide when asking for help. Technical and security data may include session identifiers, cookie preferences, IP address, browser or device information, access times, request logs, and security events where generated by WaslAFG or its infrastructure providers.

3. How we collect data

We receive information directly from you when you register, verify a phone number, update a profile, place an order, choose cookie preferences, or contact support. We also receive transaction and service-status information from payment providers, mobile operators, fulfillment providers, authentication services, and hosting infrastructure.

4. Why we process personal data

We process personal data to create and secure accounts; verify contact details; provide checkout, payment, top-up and support services; confirm and troubleshoot orders; prevent fraud, abuse and unauthorized access; maintain transaction and accounting records; comply with legal obligations; establish or defend legal claims; and operate, maintain and improve the website.

Depending on the activity and applicable law, processing is necessary to perform a contract or take steps requested before a contract, comply with legal obligations, pursue legitimate interests such as platform security and fraud prevention, or act with your consent where consent is required, including for optional cookies.

5. Payments

Payments are handled through an external payment provider. WaslAFG receives payment status, transaction identifiers, amount, currency and related checkout information, but does not store your full payment-card number or card security code. Your payment provider applies its own privacy notice to information collected directly through its payment interface.

The provider used at checkout may change. This policy and the checkout information should be updated to identify any newly activated provider before it processes customer payments.

6. Recipients and service providers

We disclose only the information reasonably necessary to service providers involved in operating WaslAFG. These may include Supabase for authentication and database services, Stripe for payment processing where enabled, Twilio for SMS verification where enabled, DT One and relevant mobile network operators for product catalogues and top-up fulfillment, and providers of hosting, infrastructure, security, email, professional advice and customer support.

We may also disclose information where required by law, a competent authority or court, or where reasonably necessary to protect customers, WaslAFG, or others from fraud, security threats or unlawful activity. We do not sell personal data.

7. International data transfers

Some service providers or their support teams may process data outside Switzerland, including in the European Economic Area, the United Kingdom, the United States, or countries where a mobile operator or fulfillment partner operates. The destination depends on the selected service and provider configuration.

Where the destination is not recognized as providing adequate protection, we rely on an applicable legal safeguard, such as recognized standard contractual clauses, or another lawful exception. You may contact us for information about the safeguards relevant to your data.

8. Retention

We keep personal data only for as long as necessary for the purposes described above. Account information is generally retained while an account remains active and for a reasonable period afterward. Checkout sessions expire after a short period, although related payment, order and security records may be retained separately.

Transaction, invoice and accounting information may be retained for up to ten years where required by Swiss law. Support, security and technical records are retained according to operational need, dispute periods, fraud-prevention needs and legal obligations. Data may be deleted or anonymized when it is no longer required.

9. Cookies and similar technologies

Strictly necessary cookies and local storage may be used for sign-in, security, payment flow, language selection, session continuity and remembering privacy choices. The cookie-consent preference is currently retained for approximately six months unless you delete it earlier.

Optional analytics, functional, social-media or targeting technologies should operate only when enabled and, where required, after your consent. You can review or change available preferences using Cookie Settings in the website footer. Browser controls can also delete or block cookies, although necessary functions may then stop working.

10. Security

We use organizational and technical measures intended to protect personal data, including access controls, authenticated server requests, encrypted connections, password protection, session controls, webhook verification and restricted database permissions. No online service can guarantee absolute security, so you should protect your login details and notify us if you suspect unauthorized account use.

11. Your rights

Subject to applicable law, you may request information about whether we process your personal data and request access, correction, deletion, restriction, objection, or release or portability of relevant data. You may withdraw consent for future processing where processing is based on consent. Some data may need to be retained despite a request where required by law or necessary for legal claims, security or completed transactions.

Send requests to info@waslafg.com. We may ask for information necessary to verify your identity and protect your account. You may also contact the Swiss Federal Data Protection and Information Commissioner if you have concerns about our handling of personal data.

12. Automated decisions and children

WaslAFG does not currently make solely automated decisions that produce significant legal effects for customers. Payment and security providers may perform automated fraud checks under their own terms and privacy notices. If WaslAFG introduces applicable automated decision-making, this policy and the relevant customer notice will be updated.

The service is not intentionally directed to children who cannot legally consent or enter into a purchase. A parent or legal guardian should contact us if they believe a child has provided personal data without appropriate authorization.

13. Policy changes

We may update this Privacy Policy when services, providers or legal requirements change. The current version and update date will be published on this page. Material changes may also be communicated through the website or account contact details where appropriate.