Last updated: 27 October 2026
1. Who we are
This website and its related services ("the Platform") are operated by شركة وسم الهوية (wasm alhawiyah Company), a single-person limited liability company, registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7055407196, with its address at Building 4565, Abi Al Qasim Al Salami Street, Al Basatin District, Jeddah 23719, Additional No. 6596, Kingdom of Saudi Arabia (short address JETA4565) ("we", "us", "our"). "wasmID" is the name of the Platform.
We are the controller of the personal data described in this policy. This means we decide why and how it is used. We are registered as a controller on the National Data Governance Platform of the Saudi Data and AI Authority (SDAIA), registration No. 3260008996. Registration is a legal duty of controllers; it is not an approval or endorsement of wasmID.
- For privacy and data protection: privacy@wasmid.com
wasmID is an independent, privately owned platform. It is not a government service and is not affiliated with, endorsed by or operated on behalf of any government body.
2. What this policy covers
This policy explains what personal data we collect through the Platform, why we use it, who we share it with, how long we keep it, and the rights you have. It is written to follow the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL, Royal Decree No. M/19 of 9/2/1443H, as amended by Royal Decree No. M/148 of 5/9/1444H), its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom, issued by the Saudi Data & AI Authority (SDAIA).
3. What is live
Parts of wasmID that are not offered yet are not shown on the Platform and collect no data.
- Your account. When you sign in, your profile, your pets, your own notes, clinic confirmations, visit requests and changes of owner are stored on our servers (see section 6 for the companies that host them). We send emails for sign-in codes and for the steps of the service.
- Our forms and messages. The feedback form, the contact form, the "For clinics" application, the vet reviewer application, "Ask a question" and "Suggest an article" send what you enter to us (see 4.5 and 4.6); your anonymous "Was this helpful?" vote on an article is sent to us (see 4.5A); and a message that someone sends to a pet's owner from a lost-pet tag is stored on our servers (see 4.3A). Visitors cannot upload documents through the site.
- Clinics. Every clinic shown in Find a clinic is a real clinic that applied and that we approved after checking its licence.
We will update this policy before any other feature starts collecting data.
4. Personal data we collect
4.1 Account and profile
- You sign in with your email and a password you choose after your first sign-in code. A code sent to your email still works if you forget your password. Phone (SMS) codes and "Continue with Google" are not switched on for real accounts yet; the two points below about them apply when they are.
- Password: we keep your password only in a scrambled form that cannot be turned back, so no one, including us, can read it. If you forget it, you set a new one after a code sent to your email, and we email you when it changes.
- Sign-in sessions: when you sign in we keep a record that this browser is signed in (a random session code, when it started, when it was last used and when it ends, and the type of browser and device), so you stay signed in, can see where you are signed in, and can sign out everywhere.
- Sign-in details: your email address, which you sign in with alongside your password and where we send sign-in codes, or your mobile number, used to send you a one-time code; or, if you choose "Continue with Google", the basic details Google shares with us (usually your name, email address and a unique account ID). We never receive your Google password.
- Profile: your full name in Arabic and in English (needed before you add a pet, because a pet's ID carries its owner's name), email, mobile number, how you prefer to be contacted, date of birth, gender (male or female), country of residence, city, nationality and preferred language. Fields other than your name are optional.
- Profile picture (optional): if you choose it, the animal from the "Which animal are you like?" quiz. You can go back to the plain icon at any time.
- Notification choices: whether you want pet reminders and whether you want news.
4.2 Your pets
- Pet identity: name, species, breed, sex, date of birth, colour, weight, neutered status, microchip number and notes, and a photo of your pet if you add one (someone who scans its tag sees it). Only name, species and chip are asked first; the rest is optional.
- Owner notes: health notes you add yourself. These are always labelled "added by you, not confirmed".
- Clinic confirmations: a clinic's confirmation of your pet's microchip and, when a pet changes owner, the rabies-vaccination expiry date. They cannot be edited or deleted afterwards (append-only); corrections are added as new entries. Your own health notes about your pet are part of your pet data above.
Pet information is not personal data on its own, but it becomes personal data when it is linked to you. We protect it in the same way.
4.3 Microchip identity, change of owner and missing pets
- Chip confirmation: the clinic that confirmed the microchip and the date. If you send a confirmation link to a clinic that is not on the Platform, the clinic sees only what it needs to check the chip: the pet's name and kind of animal. It never sees your name or contact details, and it is not shown the chip number: it types the number its scanner reads and we compare the two. Its answer (confirmed or "doesn't match") is recorded. If the person who answers is signed in on the team of an approved clinic whose licence we have checked, the answer counts at once; we then also record which clinic and which account answered, and we can reverse the confirmation if it proves wrong. A licence-checked clinic you booked can also confirm the chip at an agreed or done visit, and you get an email.
- Pre-sale clinic check: when you sell a pet, the clinic that examines it sees your name as on your wasmID account, so it can compare it with the national ID or Iqama you show in person, and, if one is on record and still valid, the date until which the pet's rabies vaccination is valid. We record only that the clinic ticked that the name matched; we never ask for, copy or keep your ID number or a picture of your ID.
- The vet who did a clinic check: when a clinic confirms a chip or a vaccination, or does the pre-sale check, it types the name of the vet who did it. Our team sees it to check the confirmation, and for a sale it is also kept with the contract. We clear it 5 years after the check; the clinic's name and the check itself stay.
- Ownership history and transfer contracts: each change of owner (from whom, to whom, date, reason), the electronic contract both owners signed (reference, signing dates, cancellation), the pre-sale clinic check, and the agreed price and the fees (each owner's).
- What a change of owner records (real accounts): the email address the current owner invites; the time each owner signed and the version of the contract they agreed to; the time wasmID checked the contract; the clinic's pre-sale health check and, where it applies, the date until which the clinic says the rabies vaccination is valid; the payment reference we record when each owner's service fee arrives (and when we send back a fee to be refunded); the current owner's confirmation that the price reached them; the new owner's confirmation of handover; any problem either owner reports and how it was closed; and why a contract was closed (cancelled, closed by itself 30 days after it was created while still waiting for signatures, closed by itself when one owner's fee had not arrived by the fee deadline (3 working days of wasmID asking for the fees, or a later day wasmID set and told both owners), or closed by wasmID). Each owner's service fee is shown only to that owner.
- The current owner's IBAN in a sale: when you sign a sale as the current owner, you give the IBAN the price should go to. The new owner sees it, with your name as on the contract and the contract reference, only once both of you have signed and the contract is authenticated. We delete it when the pet is handed over or the contract is closed. We never receive or hold the price.
- Lost-pet tag and missing reports: the tag's code (made by our server; the QR holds this code, never the chip number); whether the tag is on or paused; when you marked the pet missing and when it was found; where it was last seen; and, if you change the code, the old code and the reason you chose (tag lost or misused). Someone who scans the tag sees only the pet's name, kind of animal, sex, its photo if you added one and whether it is missing, never your name, phone number, address or the chip number. The messages finders send you are stored with the pet and with you as its owner at that time (see 4.3A). We email you only to say that a message arrived, never with its text. If the pet changes owner, the tag moves with it and later messages go to the new owner; earlier ones stay with the owner who received them.
- Chip-check log: each time someone looks up the chip number, we record the time and whether a pet was found; we do not record who looked, and there is no screen that shows these lookups to you. It is part of our activity log (see 4.7).
- Found through the microchip: lost and found runs through the wasmID tag; the microchip is the pet's identity. A vet clinic can read a found pet's microchip, and anyone can type the 15-digit number on wasmID's "Found a pet?" page. Only a chip that a clinic has confirmed for its owner shows as on wasmID, and they see only that, the kind of animal and whether it is reported missing: never the pet's name or photo, your name, phone or address. Nobody can message you from a chip number. A licence-checked clinic on wasmID can tell you "we have your pet": you then receive the clinic's name, district, contacts and a map link, and the clinic receives nothing about you. We record that a lookup happened and whether the chip was found, without the number or the person who looked; lookups are limited so numbers can't be guessed. If a second account types a chip number that is already registered, our team is told both accounts' email addresses and the number, to find out who owns the pet.
4.3A People who find a pet (no account needed)
If you scan a lost-pet tag and send the owner a message, your data is protected too, even though you have no account. We store: your message; the place you typed (optional); your mobile number and whether the owner may call or use WhatsApp (only if you add them); your email address (only if you add it); and the time you sent it. This is stored with the pet and with its owner at that time. Only that owner can read it. The owner sees any phone number or email you choose to add and may use it to contact you, only to get the pet back. If you add neither, the owner sees only your message. If you add your email, we use it once more, only if the owner confirms the pet is back home: to send you one short thank-you email, in the language of the page you wrote from, with a link to wasmID. It never contains the owner's name or details, and we do not email you again about it. We do not ask for your name or age, we do not create an account for you, and we do not use your details for marketing. To stop spam we limit how many messages one visitor can send; that count is kept briefly and is not stored with your message. You can ask us to delete your message and details at privacy@wasmid.com; tell us the date and the pet's name. How long we keep messages: see section 8. Please do not add more than the owner needs to reach you.
4.4 Visit requests to clinics
- Visit requests to clinics: the clinic, your pet, the service, the day and time, your note, the request's status, the clinic's short reply and a reference, stored on our server. The clinic's team sees your name and phone number, your pet's name, kind, age and whether it has a microchip (never the number), and your note. We email you and the clinic's team at each step; those emails carry only the clinic's name, the pet's name, the service and the time. You pay the clinic at the visit; we do not process payment for visits.
4.5 Feedback form
Who you are (for example "I have a pet"), what you came to do, whether you managed it, how easy the site was (1 to 5), what was unclear, whether you would use wasmID, anything else you write, the page you came from, the site language, and your email only if you choose to give it for a reply. Please do not include personal or medical details you don't want us to have. The form is received through our host Netlify (Netlify Forms), which also stores it, and may record the sender's IP address, until we delete it; we delete it by hand within the period in section 8.
4.5A "Was this helpful?" on articles
Which article, your vote (helpful or not) and the site language. It is anonymous: no name or email is asked. The vote is received through our host Netlify (Netlify Forms), which also stores it, and may record the sender's IP address, until we delete it; we delete it by hand within the period in section 8. Your vote is also remembered in your browser so it isn't sent twice.
4.6 Contact, applications and article questions
- Contact form: your name, email, phone (optional), preferred contact method, topic and message.
- "For clinics" application: the clinic's name in Arabic and English, city, district and street, the contacts for pet owners that the clinic chooses to add (phone numbers, WhatsApp numbers and email addresses, as many as it likes), the clinic's licence number, the services it offers, the animals it treats, the applicant's own name and email, preferred contact method and phone, any message, and the acceptance of the clinic listing agreement with its version. After we check the licence and approve the clinic, its name, city, district, services, animals and those contacts are shown publicly in Find a clinic. The applicant's own name, email and phone and the licence number are not published. Before we approve a clinic, we ask by email for copies of its clinic licence from the Ministry of Environment, Water and Agriculture, its commercial registration, its municipal licence and the responsible vet's practice licence. Our team uploads them to private storage that only our team can open, to show which licence we checked; they are never published or shared. A clinic can ask us to change or remove its listing at any time.
- Vet reviewer application: full name, email, mobile number, preferred contact method, country of practice, licence number, issuing authority, years of experience, the animals you work with, and your declarations. We don't take documents through the site: after a first check we ask for your veterinary licence, national ID / Iqama / passport, degree certificate and CV by email. Articles you approve show your name and title ("Medically reviewed by Dr …"), as agreed in the vet reviewer agreement; your name appears only after your licence is verified.
- "Ask a question" and "Suggest an article": the article, your question or topic, and your email only if you choose to give it.
- Clinic accounts: when we approve a clinic, the email address on its application becomes the address that signs in for it, and we email it to say so. The clinic can add staff by email: we store each staff member's email address, their role (owner or staff), who added them, when, and when they were removed, and we email the person to tell them they were added or removed. A clinic's team is seen only by that clinic's owner and by us. The clinic is responsible for adding only people who work for it. A clinic account has two users. Clinic invitation links: each clinic has its own link and QR code. If you create your account through one, we record which clinic's link you used; the clinic sees only how many people signed up through its link and how many of them added a pet, never who.
4.7 Technical data
- Browser storage: see section 11.
- Server logs: when you visit the site, our hosting provider (Netlify) automatically records technical data such as IP address, browser type, pages requested and time of visit, for security and to keep the site running. Netlify keeps these logs for about 30 days.
- Anonymous counting: to improve the site, we count page visits, clicks on the main buttons, and searches on the site that found nothing, without cookies or advertising trackers. For each visit we keep only the page, the language, whether it was a phone or a computer, the city and country, the name of the website you came from (not the full address) and whether you were signed in. To count visitors without following anyone, we make a short code from your IP address and browser with a random value that changes every day and is then thrown away; we never store your IP address, and the code can't be linked to you or to another day. We don't count your visit when your browser asks sites not to track you ("Do Not Track" or "Global Privacy Control"). Only our team sees the totals.
- Activity log: we record what our team does in the dashboard, and also account holders' own actions (sign-ins, profile and pet changes, visit requests, tag messages and chip lookups), with the account and the time, for security and to settle disputes. Only our team can see it.
- Backups: a full copy of the database is made regularly to the company's own computer, and an encrypted copy to Google Drive; each copy is kept for at most 30 days.
- Automatic jobs and team alerts: an automatic job runs every hour to close visit requests and contracts that ran out of time and to send the emails that go with that. When something needs our attention (a new application, a contact message, a fee waiting, a reported problem) we email our team a short alert with counts only: no names and no message text.
4.8 Sensitive data
Under the PDPL, "sensitive data" includes, among other things, a person's health data. Your pet's health records are about your pet, not about you, so we do not treat them as sensitive data about you; we still protect them as personal data because they are linked to you. We do not ask for sensitive data about you. If we ever need it (for example identity documents from vet reviewer applicants), we will ask for your explicit consent first and never use it for marketing.
4.9 Which details are required
Each form marks the fields you must fill in. Everything else is optional, and leaving it out only means the related feature won't work.
5. Why we use your data, and on what basis
| Purpose | Data used | Legal basis under the PDPL |
|---|---|---|
| Create and secure your account; sign you in | Sign-in details | Performing our agreement with you (Terms) |
| Keep your profile and your pets' digital passport | Profile, pet data, owner notes | Performing our agreement with you |
| Microchip identity: confirmation, change of owner, missing reports, finder messages, chip checks | Data in 4.3 | Performing our agreement with you |
| Let a person who finds a pet message its owner, and pass the finder's optional phone or email to the owner | Finder message data (4.3A) | The finder's consent (they choose to write and to add contact details); the owner's and finder's legitimate interest in getting the pet home |
| Count how many accounts were created through a clinic's invitation link | Which clinic's link an account used | Our legitimate interest |
| Let a clinic's signed-in team confirm a chip, pre-sale check or vaccination, and reverse a wrong one | Clinic, account and time of the confirmation | Performing our agreement with you; our legitimate interest in accurate records |
| Send the emails that are part of the service (codes, steps, visit requests, a note that a tag message arrived) | Email address, step details | Performing our agreement with you |
| Run the hourly job and alert our team | Counts only (no personal data in alerts) | Our legitimate interest |
| Send visit requests to clinics and pass on their answers | Visit request data, pet data, contact details | Performing our agreement with you |
| Record each owner's change-of-owner service fee, refund a fee when a contract closes before authentication (to the account the fee came from, using the bank details on the incoming transfer), show the current owner's IBAN to the new owner, and prevent fraud | Contract data, payment and refund references, the payer's bank details on the transfer, the current owner's IBAN | Performing our agreement; legal obligation (e.g. accounting records, VAT) |
| Send pet reminders you asked for | Pet data, due dates, contact details | Your consent (you can switch it off) |
| Send news | Contact details, language | Your prior consent; switching it off is as easy as switching it on |
| Improve the Platform from your feedback, and reply if you left an email | Feedback form data | Your consent (you choose to send it) |
| See which articles help readers | Anonymous article votes | Our legitimate interest |
| Assess clinic and vet reviewer applications and verify licences; name vet reviewers on articles | Application data and documents | Your consent; steps before entering a contract with you |
| Keep the Platform secure, prevent fraud and misuse | Technical data, account data | Our legitimate interest |
| Meet legal obligations and respond to lawful requests | Any relevant data | Legal obligation |
We do not sell your personal data. We do not use your data for automated decisions that have legal or similarly significant effects on you.
6. Who we share data with
We share personal data only as described here, and only what each party needs.
- Clinics you send a visit request to or ask to confirm a chip. A clinic receives your request and the pet details needed for the visit, or the details needed to check the chip. Each clinic is responsible for how it uses the data it receives.
- People who scan your pet's tag or look up its chip see only what their role needs. A finder who scans the tag sees the pet's name, kind of animal, sex, its photo if you added one and whether it is missing, and can message you through wasmID; any phone number or email they choose to add is passed to you, and you then become responsible for using it only to get the pet back. Someone who looks up a clinic-confirmed chip sees only that it is on wasmID, the kind of animal and whether it is missing, and cannot message you. A tag scan never shows the chip number, and none of them sees your name, phone number or address.
- In a change of owner, the new owner sees the pet's records that move with it, and its photo if you added one (you can remove it first); the previous owner's personal details do not move.
- The public sees the names and titles of vet reviewers on articles they approved, and the listing of each approved clinic (name, city, district, services, animals treated and the contacts the clinic chose to publish). Your account, pets and visit requests are never public.
- Payment of the service fee. Today the change-of-owner service fee is paid to us by bank transfer and we record its reference by hand; the price of the pet is paid directly between the two owners and never passes through us. When a payment company is connected it will receive what it needs to process the fee, and we will name it here first; we will not receive or store full card numbers.
- Service providers (processors) that run parts of the Platform for us, under agreements that require them to protect your data and use it only on our instructions:
- Website hosting, the feedback form and article votes (received and stored through Netlify Forms until we delete them) and the hourly timer: Netlify.
- Database and sign-in: Supabase, in Frankfurt, Germany (accounts, pets, tag codes, finders' messages, changes of owner, visit requests, clinic applications and teams, the activity log).
- Email delivery (sign-in codes, password-change notices, change-of-owner and visit messages, chip confirmations, the note that a tag message arrived, account closed, team alerts): Resend, sending from wasmid.com, in Ireland.
- Email routing: messages sent to our addresses (privacy@, contact@, clinics@, admin@) pass through Cloudflare (Email Routing) to the company's inbox.
- Cloudflare: bot check on the sign-in form (when on).
- Email inbox where feedback, messages to our addresses and privacy requests arrive: Google (Gmail).
- Encrypted backup copies of the database: Google (Drive).
- Google, only if you choose to sign in with it. Its own privacy policy applies.
- Licensing bodies, only for clinic and vet reviewer applicants, to check that a licence is valid, with the applicant's consent.
- Authorities, when the law requires it or to respond to a valid legal request.
- A future buyer or successor, if our business is merged or sold, subject to the same protections and notice to you.
Directions buttons open Google Maps or Hudhud with the clinic's location only; your own location is not sent by us.
7. Transfers outside Saudi Arabia
Your account data is stored with Supabase in Frankfurt (Germany). Our email provider, Resend, processes in Ireland. Netlify (hosting, feedback form and article votes, hourly timer), Cloudflare (routing emails sent to our addresses, and the bot check on the sign-in form when on) and Google (Gmail, encrypted backups on Google Drive, and sign-in if you choose it) process data in the United States and in other countries where they run their services. These places are outside the Kingdom. Where data leaves the Kingdom, we transfer it only as permitted by the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, keep it to the minimum needed, and use appropriate safeguards.
8. How long we keep data
We keep personal data only as long as needed for the purpose it was collected for, or as the law requires. Then we delete it or make it anonymous.
| Data | Retention |
|---|---|
| Account, profile and pet data | While your account is open. When you delete your account it closes at once; 30 days later your name, contact details, your own notes about your pets, finders' messages and your notes on visit requests are erased automatically. Until then you can sign in and keep your account. What the law requires us to keep (clinic records, ownership history and change-of-owner contracts) stays, no longer linked to your name or contact details. |
| Which terms of use and privacy policy you accepted, and when | While the account exists, as a record of your agreement |
| Clinic confirmations (microchip; rabies date when a pet changes owner) | As long as the pet is registered on wasmID |
| Service-fee payment and refund records | 10 years |
| The current owner's IBAN in a sale | Deleted when the pet is handed over or the contract is closed |
| Clinic documents (licences and registration) | While the clinic is on wasmID, then up to 12 months after it is removed or rejected; an earlier copy that was replaced is kept with them as the record of what we checked |
| Ownership history and signed transfer contracts | Permanently, as the pet's identity record (cancelled contracts too) |
| Missing reports | 12 months after the pet is found, then deleted automatically |
| Pet photo | Until you remove it or the pet leaves wasmID |
| Finders' messages (message, place, optional phone and email, and the language of the page it was sent from) | 3 months after the message was sent, then deleted automatically. Deleted earlier if the pet is deleted or the finder asks (see section 9). |
| Old tag codes (codes a pet had before you changed the code) | While the pet is registered, so an old printed tag still works as you chose (passing messages on if the tag was lost, or pointing the finder to a vet clinic if it was misused); when a pet leaves wasmID (removed, or its owner's account erased), its tag stops working at once and we keep only its codes, with nothing linked to them (no pet, no owner), so a code is never given to another pet. |
| Visit requests | 24 months after the visit date, then deleted automatically |
| Which clinic's invitation link an account came through | Until the account's details are erased (30 days after it is closed) |
| Team alert records (counts only) | Part of the activity log: 5 years |
| Chip-check log | Part of the activity log: 5 years |
| Name of the vet who did a clinic check | 5 years after the check, on the check and on a sale contract; then cleared (the clinic's name and the check stay) |
| Feedback form | 12 months, or earlier if you ask (we delete it by hand, at Netlify too) |
| Article votes | 24 months (we delete them by hand, at Netlify too) |
| Contact messages, article questions and suggestions | 12 months after the last reply, then deleted automatically |
| Applications not accepted (clinics, vet reviewers) | 12 months |
| Server logs | 30 days (kept by our hosting provider) |
| Anonymous counting (each visit, click or search) | 30 days, then only daily totals are kept |
| Daily visit totals (numbers only) | 24 months |
| Sign-in sessions | Until you sign out or the session ends (at most 30 days) |
| Clinic applications and listings | While the clinic is listed, then 12 months after it is removed or rejected |
| Clinic team members' emails | While the clinic is on wasmID (people who left its team too), then replaced with a placeholder 12 months after the clinic is removed or rejected |
| Activity log: our team's actions in the dashboard and account holders' own actions (who did what, and when) | 5 years |
| Backups (full copies of the database) | Up to 30 days |
| "Two accounts claim the same chip" items in our team's inbox (the chip number and both accounts' emails) | 12 months after we have handled it |
| Vet reviewer application documents received by email | Deleted within 30 days if the application doesn't go ahead; otherwise while the reviewer is active |
| Clinic listing agreement acceptances (the applicant's name and email, or the email of the person who accepted on My clinic, the time and the text's fingerprint) | As proof of the agreement, kept permanently (the record can't be changed or deleted, so it stays reliable evidence of what the clinic agreed to), even if the application was not accepted |
| Change-of-owner problem reports | Kept with the contract, for the same period as the contract record |
| Requests to close an account | 5 years, as proof that the request was handled |
| One-time sign-in codes | Minutes, until used or expired |
9. Your rights
Under the PDPL you have the right to:
- Be informed about how your data is collected and used (this policy).
- Access your personal data and get a copy of it in a clear, readable format.
- Correct data that is inaccurate, incomplete or out of date.
- Ask for deletion of data we no longer need, subject to legal exceptions.
- Withdraw your consent at any time. This does not affect what we did before you withdrew it.
You can change most details and notification choices yourself in your account. For anything else, contact us at privacy@wasmid.com. We may need to confirm your identity first. We will reply within 30 days; if we need more time, we may extend this by up to 30 more days, and we will tell you why before the first 30 days end. When we delete data at your request, we also ask the parties we shared it with to delete it.
Deleting your account. "Delete my account" in your account closes it at once and signs you out on every device. Your lost-pet tags stop passing messages and your upcoming clinic visits are cancelled (the clinic is told). After 30 days your details are erased as set out in section 8; within those 30 days you can sign in and choose "Keep my account". You can't delete your account while a change of owner you are part of is still under way, or while you manage a clinic's account: finish or cancel the change of owner, or ask us to hand the clinic to someone else, first.
Finders. If you sent a message from a lost-pet tag, you have the same rights. Write to privacy@wasmid.com with the date and the pet's name. Because you have no account, we may ask you for something only you would know, such as the words of your message, before we act. We then delete your message and details from our servers. If the owner has already read them, we cannot make them forget, so we ask the owner to delete them too.
Clinic confirmations: we cannot edit a clinic's confirmation ourselves. If you think one is wrong, we pass your request to the clinic that made it, and a correction is added as a new entry. Your own health notes you can change or delete yourself.
Vet reviewers: if you stop being a reviewer, articles you already approved keep showing your name for the review you did, as agreed in the reviewer agreement.
Clinic applicants: the record that you accepted the clinic listing agreement (your name and email, or your email if you accepted on My clinic, and the time) is kept as proof of the agreement and can't be deleted on request.
If you are not satisfied with our answer, you may file a complaint with the Saudi Data & AI Authority (SDAIA).
If an account holder dies, a family member can contact us to close the account.
If your account is paused. We may pause an account while we look into a problem (for example a disputed change of owner). A paused account can still sign in and read and download its data, but cannot change it. We tell you why, and you can ask us to review the pause or to give you a copy of your data through the contact details in section 15.
10. Children
The Platform is meant for adults. You must be at least 18 to create an account. Younger users may use it only with the consent and supervision of a parent or legal guardian. We do not knowingly collect data from children without that consent; if we find we have, we will delete it.
A person who finds a pet may be under 18. We do not ask a finder's age. If you are under 18 and want your message deleted, you or a parent can write to us at privacy@wasmid.com.
11. Cookies and browser storage
We do not use advertising or analytics cookies. We use your browser's storage for these purposes only:
| What | Where | Why | How long |
|---|---|---|---|
| Theme (light or dark) | Local storage | Remember your display choice | Until you clear it |
| Language choice (NEXT_LOCALE) | Cookie, set for any visitor | Remember whether you use the site in Arabic or English | Until you close your browser |
| Page guides on/off and which guides you've seen | Local storage | Don't show a guide again once seen | Until you clear it |
| "Was this helpful?" votes | Local storage | Remember that you voted on an article, so the vote isn't sent twice | Until you clear it |
| Sign-in session (real accounts) | Cookie that scripts cannot read | Keep you signed in | Until you sign out or it ends |
| Working copy of your account | Local storage | Show your profile, pets, notes and finders' messages while signed in | Erased when you sign out or your session ends |
| Unsaved form drafts | Session storage | Keep what you typed when you switch language or go back | Until you save, start over or close the tab |
| Filters, tabs, scroll position, open sections | Session storage | Return you to the same place when you go back | Until you close the tab |
These items are strictly necessary for features you use or remember your own choices. We set two cookies: a language cookie for any visitor, and, when you sign in, a secure session cookie that keeps you signed in, which the page's own scripts cannot read. Your account data is kept on our servers; while you are signed in, your browser keeps a working copy (your profile, pets, notes and finders' messages), which is erased when you sign out or your session ends. The bot check on the sign-in form (Cloudflare Turnstile, when on) runs in Cloudflare's own frame and sets no cookie on our site. You can clear browser storage at any time in your browser settings.
12. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS only), browser protections against other sites framing or tampering with our pages, access limited to people who need it, one-time sign-in codes that expire, and keeping secret keys off the website. Lost-pet tag codes are random and are made only by our server; a browser cannot choose or change one, and we limit how many lookups and messages one visitor can make, so codes cannot be guessed and tags cannot be used to spam an owner. No system is completely secure. If there is a data breach, we will notify SDAIA within 72 hours of becoming aware of it, and if it is likely to harm you, we will tell you without undue delay, in plain language, with what happened and what you can do.
Inside wasmID, only the founder and the team members the founder authorises can open the dashboard. Each team member signs in with their own work email and a password they choose after a first code sent to that email (the code also works as a backup); we keep the password only in a scrambled form that cannot be turned back. Each member can open only the sections the founder gives them; what each person does there is recorded, and their access ends at once when it is removed.
13. Links to other websites
The Platform links to other websites and apps, such as official government pages, Google Maps and Hudhud for directions, WhatsApp, and Google sign-in. We are not responsible for their privacy practices.
14. Changes to this policy
We may update this policy, for example when a new feature goes live. We will change the "Last updated" date and, for important changes, tell you by email or on the Platform before they take effect. Where a change needs your consent, we will ask for it.
15. Contact us
wasmID (operated by the company named in section 1) Building 4565, Abi Al Qasim Al Salami Street, Al Basatin District, Jeddah 23719, Additional No. 6596, Kingdom of Saudi Arabia (short address JETA4565) Email: privacy@wasmid.com (the wasmID privacy team)
16. Language
This policy is available in Arabic and English. If the two versions differ, the Arabic version prevails.