Privacy Policy — Waaraq
Last updated: November 2026
Waaraq is a service provided by DOTIMPACT TECHNOLOGIES, the entity responsible for operating the service and processing your data (the data controller), headquartered in the Kingdom of Saudi Arabia — Riyadh — Commercial Registration No. 7054059535. We treat your invoices and financial documents as sensitive data. Waaraq is designed to collect the minimum data necessary, with full transparency about what is stored and why. This policy applies to our users in all supported countries, including the Kingdom of Saudi Arabia and the United States.
1) Data we collect
Account data: mobile number, email address where provided, name, and a device identifier or basic device data where needed.
Extracted document data: vendor or customer name, invoice number and date, amounts, tax, currency, line items and suggested category, review status, and accounting notes.
Operational data: subscription plan, document counts, and last sign-in.
Limited technical data: IP address and basic device information, for security and abuse-prevention purposes.
Sales invoicing data: company, seller and customer information, business or tax identification needed for the transaction, addresses, items, amounts, discounts, taxes, supply and receipt dates, advance and settlement references, and logos and attachments you select. Records include drafts and their revisions, issued invoice artifacts, processing states and authority responses where the relevant integration is enabled.
Connection and approval data: connected assistant application name, authorized company and permissions, connection state and usage, and operation, review and approval records needed for security, traceability and prevention of duplicate issuance. Assistant tools do not require verification codes, passwords or service keys in the conversation.
2) How we use your data
We store the extracted data on Waaraq servers so that we can: sync your data between mobile and web, generate financial and tax reports, enable an authorized accountant to review, prevent duplicate invoices, calculate plan limits, and keep the history of your invoices and reports inside your account. We use your mobile number / email for verification and sign-in.
We also use invoicing data to prepare and validate drafts, display previews, retain exact-revision approval, issue and retain eligible invoices, and operate enabled, authorized integrations. Operation records support duplicate-request prevention, troubleshooting and permission checks. Having a Waaraq account alone does not cause data to be sent to an external assistant.
3) The original document image
By default, the original invoice image is used for processing only and is not kept as a permanent cloud copy after extraction — unless you enable the “Cloud backup of original documents” option in Settings. When enabled, a copy of the document is stored in your account so you can access it from any device.
This setting concerns incoming document images used for extraction. It does not delete issued invoice artifacts or records, or attachments and logos retained for other features. The relevant feature explains which files it requests.
4) Third-party processing and transfers outside your country
Document images or their data may be processed through trusted technology and AI services that read documents and extract their data. Some data may be processed or stored with providers outside your country of residence where needed to operate the service. Processing and storage locations vary by provider and service. We share only the data necessary to complete the processing, and we never sell your invoices or your data to anyone.
5) Sharing with your accountant and members
No accountant or accounting firm can access your data unless you authorize them or add them to your account. You can manage members and permissions, and revoke authorization, from inside the app at any time.
6) Connections to external systems
Waaraq does not connect to external accounting software. The only way to connect your account to another system is to connect an assistant such as ChatGPT or Claude through the Model Context Protocol (MCP) with your authorization, as described below, in addition to the tax-authority connection when it is enabled.
Connections to external assistants
When you connect an assistant such as ChatGPT or Claude and authorize its permissions, we may return the information you request within the authorized company and scopes, such as company, customer, item and invoice data, summaries, subscription status and preview or invoice files. Draft preparation, issuance and branding changes require their respective permissions. The assistant may send us the line items and references you specify to carry out a request. Retrieved data or files may appear in your conversation with the assistant provider.
A draft-and-issuance connection is bound to one selected company. A read-only connection may cover several companies you own if you authorize it. Permissions do not allow access to unauthorized companies or data. A statement of approval in the conversation is not enough to issue an invoice: the exact revision must be reviewed and approved inside Waaraq. File links and approvals expire at the displayed time, and the connection's authorization continues to be checked when they are used.
You can disconnect inside Waaraq to stop subsequent requests. Disconnecting does not recall information or files already delivered to the assistant or erase conversations held by that provider. Its processing, retention and use of data are governed by its policies and your account settings with it. Review those policies before connecting, and avoid sending data that the task does not need. We do not guarantee how the assistant provider uses data outside your agreement with it.
Connections to tax authorities
Where an eligible production connection to a tax authority is enabled, the invoice data and files required for the relevant processing are transmitted, and transmission and response states are retained. Creating a draft or running a test does not by itself mean an invoice was sent to the authority. Processing depends on the phase, invoice type and company eligibility.
7) Data protection
We protect your data through encrypted connections between your app and our servers via TLS, internal access and permission controls, isolation of each account’s data from other accounts, protection of credentials and security tokens using appropriate technical controls, and need-based access restrictions. When cloud backup of documents is enabled, they are stored with a trusted storage provider that applies appropriate protection controls. That said, no method of electronic transmission or storage is 100% secure.
Preview files retrieved through an assistant are checked against the user, company, connection and expiry. Possessing a file URL alone does not authorize access. Issue approval is bound to the draft content and becomes invalid when approval-bound information changes.
8) Data retention and deletion
We retain extracted data for as long as your account is active so you can access your history and reports. You can delete certain data from inside the app, and you can delete your account and its associated data from inside the app, or by requesting it via support@dotinvo.com. Upon deletion, we delete or disable access to your data in accordance with our retention and deletion policy, retaining only what is required for legal, accounting, or security purposes where necessary.
Issued invoice data, artifacts and review and issuance records are retained as needed for the service, traceability and applicable obligations. Subscription expiry or assistant disconnection does not delete those records. Access to preview files expires at the displayed time; this does not necessarily mean every stored copy is deleted at that exact moment. The service uses scheduled tasks to delete certain operational files and rotate server logs. Backups may retain copies of some data after it is deleted from the service interface; deleting an account does not mean that all copies are deleted immediately. A deletion request may require retention of specific records rather than deletion or alteration of an issued invoice; we explain applicable restrictions when handling the request. You can ask which categories we retain and why using the contact details below.
9) Your rights and contact
Depending on your country of residence, you may have additional rights under applicable laws (such as the Personal Data Protection Law in the Kingdom of Saudi Arabia, or privacy laws applicable in the United States). In all cases, you have the right to access your data, correct it, and request its deletion. To exercise these rights or for any inquiry: support@dotinvo.com.
10) Children
The service is intended for adults and is not directed at children under the legal age in their country of residence, and we do not knowingly collect their data.
11) Changes to this policy
We may update this policy from time to time, and we will notify you of material changes inside the app.
12) Cookies and analytics
On our marketing website (waaraq.com) we use Google measurement tools — such as Google Ads and Google Analytics — to understand how visitors reach us and to measure the effectiveness of our advertising. These tools may set cookies or similar identifiers to measure clicks and visits; they are not used to collect your invoices or financial documents. For visitors in the EEA, the UK, and Switzerland, these tools are activated only after your consent (Consent Mode). You can always manage cookies in your browser settings.