Privacy Policy

Waaqi ("Waaqi", "we", "our", or "us") provides an AI-powered Governance, Risk, and Compliance (GRC) platform that helps organizations manage policies, risks, controls, audits, security awareness, and regulatory compliance.

This Privacy Policy explains what information we collect when you use the Waaqi platform, our website (waaqi.ai), and related services (collectively, the "Services"), how we use it, who we share it with, and the choices you have. By using the Services you agree to the practices described here.

Account & identity data: name, work email, job title, organization, role, and authentication credentials.

Customer content: policies, controls, risks, evidence, audit artifacts, tasks, training records, and other information you or your users upload to the platform.

Usage data: log-in events, feature usage, page views, IP address, browser type, device identifiers, and timestamps.

Communications: messages you send to support, demo requests, and feedback.

Cookies & similar technologies: used for session management, security, preferences, and analytics.

Provide, operate, and secure the Waaqi platform and its GRC modules (policy, risk, compliance, tasks, awareness, audit, and reporting).

Run AI-assisted features such as control mapping, gap analysis, evidence suggestions, and reporting. AI processing is performed on your tenant data only to deliver the requested feature.

Authenticate users, manage access, and enforce role-based permissions.

Monitor performance, detect abuse, and improve reliability and security.

Communicate service updates, security notices, onboarding guidance, and (where permitted) product information.

Meet legal, regulatory, audit, and contractual obligations.

Where applicable law requires a legal basis (e.g., GDPR, UAE PDPL, KSA PDPL), we rely on: performance of a contract with your organization, our legitimate interests in operating and securing the Services, your consent (where required), and compliance with legal obligations.

Waaqi uses AI models to assist with compliance workflows. Customer content is not used to train foundation models. AI outputs are suggestions intended to support, not replace, human review by qualified personnel within your organization.

We do not sell personal data. We share information only with: (a) authorized users within your organization, (b) vetted sub-processors that provide cloud hosting, AI inference, monitoring, email, and support tooling under contractual confidentiality and security obligations, and (c) authorities when legally required.

A current list of sub-processors is available on request at compliance@waaqi.ai.

Waaqi hosts customer data in regional cloud infrastructure (e.g., UAE and KSA regions) to support data residency and sovereignty requirements. Where data must be transferred across borders, we apply appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

We implement administrative, technical, and physical safeguards aligned with ISO 27001, SOC 2, and applicable regional standards. These include encryption in transit and at rest, role-based access controls, multi-factor authentication, network segmentation, logging and monitoring, vulnerability management, and regular security testing.

No system is perfectly secure; you remain responsible for protecting your account credentials and configuring access within your tenant.

We retain customer content for the duration of your subscription and for a limited period afterward to allow recovery, dispute resolution, and compliance with legal obligations. You may request export or deletion of your tenant data in accordance with your contract.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. For customer content stored in your tenant, please contact your organization's Waaqi administrator. For requests directly to Waaqi, contact compliance@waaqi.ai.

We use strictly necessary cookies for authentication and security, and optional cookies for analytics and preferences. You can control non-essential cookies through your browser settings.

Waaqi is an enterprise platform and is not directed to individuals under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or via email to account administrators. The "Last updated" date below indicates when this policy was last revised.

For any questions, requests, or concerns about this Privacy Policy or our data practices, contact: compliance@waaqi.ai.