Privacy Policy

Wasl AI is operated by Taha Abdelrahman as an independent product. The service runs on infrastructure rented and administered by the operator. For any question about this policy, or to exercise any right described in it, write to support@hotwasl.tech.

Only what the product needs to function. Specifically:

We do not collect payment card details. We do not ask for a phone number, a date of birth, a physical address, or any special-category data.

This is the part that deserves your attention, because it is the part most policies gloss over. When a flow runs, whatever passes through it is written to the run history so you can inspect it: the text you supplied, the pages a node fetched, the JSON an API returned, the model's reply.

If you push personal or confidential information through a flow, that information is stored in the run record until the run is deleted. Treat run history as being as sensitive as the data you feed it.

Two things are never written to the database in readable form: the credentials you attach (encrypted at rest) and your password (hashed).

Three cookies, all first-party, all functional. No advertising or analytics cookies are set.

Because none of these are used for tracking or profiling, no consent banner is shown. Clearing them signs you out and resets those two preferences; nothing else is affected.

As few parties as possible, and never for advertising. Data leaves this service only in these situations:

• Model providers. When an AI node runs, the prompt and its context are sent to the model endpoint that node is configured to use — your own key if you attached one, otherwise the platform endpoint. Their handling of that request is governed by their own terms.
• Nodes you point outwards yourself. A Read web page, HTTP request, Send to Slack or Call webhook node contacts exactly the address you configured, and sends exactly what you wired into it.
• Google, if you choose Google sign-in, for that authentication exchange only.
• The hosting provider that runs the server, in the ordinary course of operating it.

We do not sell personal data, we do not share it with data brokers, and we do not use your flows, prompts or run history to train any model.

• Account data: for as long as the account exists.
• Flows, versions and run history: until you delete them, or until the account is deleted.
• Credentials: until you remove them in Settings → Credentials.
• API keys: until revoked. Revoked keys keep their hash and prefix so an audit trail survives.

There is no self-service account deletion in the dashboard yet — we would rather admit that than pretend otherwise. Email support@hotwasl.tech from your account address and the account, its workspaces, flows, runs and credentials are erased within 30 days. You can also ask for a copy of your data in the same way.

Depending on where you live, you may have the right to access your data, correct it, export it, have it erased, restrict how it is processed, or object to processing. We honour these requests regardless of whether the law where you live compels us to.

Write to support@hotwasl.tech from the address on the account. Expect a reply within 30 days. We will not charge you and we will not ask you why.

• Traffic is served over HTTPS with a valid certificate; plain HTTP is redirected.
• Passwords are hashed with bcrypt. Attached credentials are encrypted with AES-256-GCM using a key held only in the server environment.
• The session cookie is httpOnly and signed, so it cannot be read or forged by page scripts.
• URLs supplied to fetching nodes are screened against a blocklist that covers loopback addresses and cloud instance metadata endpoints.
• Google sign-in uses OAuth with PKCE and short-lived state cookies.

Two honest limitations. The Run JavaScript node executes in a timed sandbox that stops runaway loops but is not a hardened security boundary, so do not let people you distrust run code in your workspace. And no service can promise it will never be breached — if user data is ever affected, the people affected will be told what happened.

The service is not directed at children under 16 and accounts are not knowingly created for them. If you believe a child has registered, tell us and the account will be removed.

If this policy changes in a way that materially affects you, the date at the top of the page changes and account holders are notified by email before the change takes effect. Continuing to use the service after that point means you accept the revised policy.