Privacy policy

Jalsa runs this website, the booking pages providers make on it, and their dashboards. The provider you book with uses your details to serve your booking; Jalsa keeps them and provides the software. For any question about your data, message us on WhatsApp.

From clients who book:

• Your account: your name, phone number, email address and, if you add one, your photo; and how you sign in: a code by WhatsApp or email, or your Google, Facebook or Apple account.
• Your bookings: what you booked, with whom, when and where, and what you give when you book: a note, answers to the provider's questions, your address for an appointment at your place, a contact email, or a phone number to call you back.
• Payments: what was paid, when and how (cash, a transfer, or online through Wayl), and any refund. Your card details go to Wayl; Jalsa never sees or keeps them.
• Notifications: the emails we send you and, if you allow notifications, your browser's or phone's push subscription.
• Sign-ins: the IP address and the browser or device (user agent) of each sign-in.

From people who run a business or work on a team:

• the business's details: its name, page, services and events, prices, hours, places, photos, team and settings;
• its plan, its invoices and their payments;
• the private notes the owner keeps about a client, which the client never sees;
• the apps you connect: your Wayl store key, kept encrypted, and your Google or Zoom account for meeting rooms.

On every visit we also record how pages are used and any errors, through the services listed below.

• to make, show, move and cancel bookings, and to remind you of them;
• to sign you in and keep you signed in;
• to let providers run their business: their calendar, clients, payments and reports;
• to bill providers for their plan;
• to send emails, notifications in Jalsa and push notifications about bookings, payments and your account;
• to answer support requests, stop abuse and fix errors;
• to understand how Jalsa is used and improve it.

We do not sell personal data and do not use it for advertising.

• The provider you book with and their team see your booking and what you gave with it, your name, phone number, email and photo, and what you paid. The owner also sees your bookings with their business and the notes they keep about you.
• A provider's own systems: a provider on a plan with webhooks may have booking details sent to an address of their own. That copy is theirs to look after.
• The services that run Jalsa, listed below, each only for its own part.
• Authorities, when Iraqi law requires it.

• Railway hosts our servers, our database and the storage for photos.
• Resend sends our emails.
• OTPIQ sends sign-in codes by WhatsApp.
• Wayl takes online payments: a client's to the provider's own store, and a provider's plan to Jalsa's store.
• Sentry receives error reports, with the page and the signed-in account's ID.
• PostHog (in the EU) records how pages are used and replays some visits, with everything typed and the digits on screen hidden. Once you sign in, your account ID, name and email are attached.
• Google, Facebook and Apple sign you in when you choose one of them; Google also makes Google Meet rooms when a provider connects it.
• Zoom makes Zoom meeting rooms when a provider connects it.
• Your browser's push service delivers the notifications you allowed.

Some of these services keep data outside Iraq.

• Your account and your bookings: as long as your account exists. When you delete it, see below.
• A sign-in lasts 30 days from when you last used it; signing out ends it.
• Emails we sent: 400 days, apart from a few reports to providers, which are kept.
• A business's notifications in Jalsa: 90 days once read, and 180 days at most.
• Wayl's payment notifications: 730 days, and longer while a payment is still being resolved.
• Booking details sent to a provider's webhooks: 30 days.
• Payment records and invoices stay, because providers and Jalsa need them for their accounts.

If you are a client, you can delete your account yourself: in your account, open Settings and choose Delete account. You can't delete it while you have an upcoming booking; cancel it first.

Deleting your account:

• signs you out on every device;
• removes your ways to sign in, your devices for push notifications and your photo;
• replaces your name, email and phone number with a placeholder;
• erases, from your bookings, the contact email, notes, answers, address and call-back phone you gave, and the private notes providers kept about you.

Your bookings and their payment records stay, without your name or contact details, because providers need them for their records and accounts.

If you run a business on Jalsa or work on a team, message us on WhatsApp to delete your account; we handle it by hand.

We use only the cookies Jalsa needs to work: one keeps you signed in, one remembers whether you chose Latin digits, and short-lived ones keep a step such as signing in with Google or connecting an app working. PostHog keeps an identifier in your browser to tell visits apart. We use no advertising cookies.

Jalsa is served over HTTPS only, and Wayl store keys are stored encrypted. A provider's team sees only the business they work in. No system is perfectly safe: if something puts your data at risk, we tell those affected as the law requires.

• See and correct your name, email, phone number and photo in your account.
• Turn notifications off for each device, in your browser or in your account.
• Unlink Google from your account.
• Delete your account, as above.
• Ask us for a copy of your data, or about anything in this policy, on WhatsApp.

You can also ask the provider you booked with about the details they hold.

When we change this policy, we update the date at the top. If a change affects how your data is used, we tell you by email or in Jalsa before it applies.

For any question or request about your data, message Jalsa support on WhatsApp.