Privacy policy
Last updated: November 5, 2026
This policy explains how the WELAYO app ("the app", "we") collects, uses and protects data when a merchant installs it on a store on the Salla platform, or visits welayo.com.
1. Data we collect
From Salla, after you install the app
- Your store ID and name.
- The access and refresh tokens Salla issues to connect the app to your store, stored encrypted.
- Product data: name, description, image links, categories, options, SKU, price, quantity, sales and view counts, SEO title and description, and the English name and description where present.
- Technical event notifications from Salla (app installed or removed; product added, updated or deleted), with any secret tokens removed.
From you, when you register
- Business name, owner name, email address and mobile number.
- Business document type (commercial registration or freelance document), its number and an image of it.
- Your store link (optional).
While you use the app
- The Salla user ID that opened the app, and a temporary two-hour session stored as a one-way hash.
- A history of the bulk fixes you approve, with the original values of the fields we changed, so you can undo them.
We do not collect your customers' data, orders or payments, and the app's permissions do not give access to them.
2. How we use data
- To analyze your products and show results and recommendations in the app.
- To apply the bulk fixes you explicitly approve, and to undo them when you ask.
- To review your registration, verify your business and contact you about it, including a call to verify your mobile number.
- To answer your questions and support you.
- To protect the service and prevent misuse.
3. Sharing
We do not sell your data or use it for advertising. We share it only with:
- Salla, to run the connection to your store.
- Infrastructure providers we run the service on: Cloudflare for hosting, the database and email routing, and Google for the support mailbox. They process data on our behalf and only to run the service.
- Any party we are legally required to disclose to.
Data may be stored and processed on servers outside Saudi Arabia by these providers.
4. Security
- Access tokens to your store are encrypted (AES-256-GCM) and never written to logs.
- All connections are encrypted over HTTPS.
- We verify your store through Salla every time you open the app.
- Access to the data and to the application review page is limited to the WELAYO team and protected by sign-in.
5. Retention and deletion
- When you remove the app from your store, we delete the access tokens immediately and syncing stops.
- We keep other data while it is needed to provide the service, and delete it within 30 days of your request.
- To request deletion, email [email protected] from the address you registered with.
6. Your rights
Under Saudi Arabia's Personal Data Protection Law, you may ask to access, correct or delete your data, and withdraw your consent to its processing. We respond within 30 days.
7. Changes
We publish any update to this policy on this page and change its date, and we tell you in the app if a change is significant.