Privacy Policy

Who we are. Bilazann (بلاظن), United Arab Emirates. Contact: info@bilazann.com. This policy covers both Bilazann's briefings/waitlist website and Waqi, its self-serve AI data-protection product — the sections below say which applies where.

What we collect via this website

When you join the waitlist we collect your name, email address, and phone number (with country code). We also collect minimal technical data needed to serve the site (see the Cookie & Analytics Notice on the Terms page).

Why, and on what basis

We process waitlist data on the basis of your consent (UAE Federal Decree-Law No. 45 of 2021 — PDPL) for one purpose: to contact you about Bilazann's launch and early access. We do not sell personal data. We do not use waitlist data for advertising audiences.

Waqi: what we collect and why

Creating a Waqi account collects your email address and password (handled by our authentication provider, Supabase — we never see or store your password ourselves). When you connect a tool (for example Stripe), the API key or credential you provide is encrypted before it is stored, specifically so Waqi can make the calls needed to serve your requests. That credential is never shown again after you enter it, is never logged in plain text, and is deleted immediately if you remove the connector or close your account.

Waqi: what happens to the data it filters

Waqi's entire purpose is to stop your customers' personal data reaching an AI model. When your AI client calls a connected tool through Waqi, the response is scanned for sensitive data (card numbers, emails, phone numbers, government IDs, and similar categories), that data is redacted, and only the redacted result is returned. Waqi logs metadata about each call — which tool, what category of data was caught, whether the call was allowed, redacted, or blocked, and a short preview of the already-redacted response — for your own audit trail. Raw, unredacted response content and the credentials themselves are never written to that log. We do not store the business data your connected tools return — see the data processor section below and our data handling guarantees for how that's enforced in the code, not just promised in this document.

Waqi: our role is data processor, yours is data controller

When Waqi redacts a response from Stripe (or another connected tool), that response can contain personal data about your customers — not us. Under both UAE PDPL (Federal Decree-Law No. 45 of 2021, Article 8) and UK/EU GDPR (Article 28), that makes you the data controller of your customers' data, and Waqi the data processor acting only on your instructions (the tool calls your AI client makes). We process that data solely to detect and redact sensitive fields before it reaches your AI client, we do not use it for any other purpose, and we do not retain it once a call completes. A separate Data Processing Agreement sets out our obligations to you as processor in more detail, including sub-processor flow-down and deletion on request.

WhatsApp communications

If you provide a phone number for briefings, we may contact you on WhatsApp. Every recurring message flow requires your explicit opt-in first, and every message provides a way to stop.

Sub-processors

Every third party that touches personal data on our behalf, published here rather than "available on request" so you can check it yourself. We'll update this list, and notify active customers, before adding or replacing one.

Note: your own AI client (Claude, ChatGPT, Cursor, or whichever you connect Waqi to) is not a Waqi sub-processor — that's a separate relationship between you and your AI provider, governed by their terms. Waqi's job is making sure your customers' sensitive data is redacted before it ever reaches that relationship.

International transfers

Some sub-processors store data outside the UAE. Where personal data leaves the UAE we rely on the PDPL's transfer provisions and contractual safeguards with each provider.

Retention

Waitlist data is kept until launch contact is complete or you ask us to delete it, and no longer than 12 months after collection without renewed contact. Waqi account data and connector credentials are kept for as long as your account is active, and deleted within 30 days of account closure. Audit log entries (metadata only, as described above) are kept for as long as your account is active so you retain a complete history of what was caught.

Your rights

You may request access to, correction of, or deletion of your personal data, withdraw consent, or object to processing. For Waqi account data you can also delete individual connectors or your whole account directly from the dashboard. Write to info@bilazann.com; we respond within 30 days.

Security

Data is encrypted in transit and, for Waqi connector credentials, encrypted at rest. Access is restricted to the people who need it to run the service; credentials are never shared over messaging apps.

Changes

We will post updates here with a new date. Material changes to how we use your data will be notified before they apply.