Effective Date: September 13, 2026

Overview

Waha (“we,” “us,” or “our”) is committed to protecting your privacy and the personal data we collect about you. This Privacy Notice explains how we collect, use, share, and protect your personal data when you interact with our website (https://waha.app), mobile applications, and related services (collectively, the “Services”). It also describes your rights and choices regarding your personal data and how you can contact us with questions or concerns.

Please review the following to understand how we process and safeguard personal data about you. By using any of our Services, whether by visiting our website, using our apps, and/or by voluntarily providing personal data to us, you acknowledge that you have read and understand the practices contained in this Privacy Notice. This Privacy Notice may be revised from time to time. If we make any material changes to how we process your personal data, we will notify you through appropriate means, such as an app notification or our website banner. Please review this Privacy Notice periodically to remain fully informed about our data practices.

How We Obtain Your Personal Data

The types of personal data we collect depend on how you interact with our Services. We strive to minimize data collection and only gather information necessary to provide and improve our Services. When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide any aspect of our Services, you may not be able to use those Services. In addition, it is possible to change your browser settings to block the automatic collection of certain information.

We collect personal data from the following sources:

• Directly from you: When you create an account (your name and email address), write notes in our apps, contact us, request access to specific content, or make a donation.
• Automatically: When you use our apps and website, we collect usage data (such as the lessons you complete and share and the screens you view), device information (such as device type, operating system, app version, and an app-specific device identifier), and your approximate location (city, region, and country), which we estimate from your IP address. This data is linked to a randomly generated user ID, and to your name and email address only if you create an account or give them to us. We use Google Analytics 4 and Firebase for analytics. We do not collect precise (GPS) location or advertising identifiers.
• Third-Party Service Providers: The service providers listed under “How We Share Your Personal Data” may collect information used to identify you, as may the app stores you download our apps from. You can review the privacy policies for Google Play Services and the Apple App Store.

Additionally, when you make a donation, payment information is collected and processed by a third-party service provider. Waha receives limited donor data (e.g., name, email, donation amount, and, for Apple Pay and Google Pay donations, phone number), which it uses to issue receipts, manage donor communications, and internal reporting.

We do not knowingly collect sensitive personal information such as social security numbers, health, or medical data from any user. Our Services are intended for adults.

How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide, maintain, and improve our Services, including responding to your inquiries and support requests.
• To process voluntary donations through trusted third-party payment processors.
• To facilitate access to advanced content and manage user requests.
• To analyze and improve the performance and effectiveness of our website and apps, and to fix errors and crashes.
• To communicate with you about updates, resources, or events if you have opted in to receive such communications.
• To comply with legal obligations and protect the rights, property, and safety of our users and organization.

We do not use your personal data for advertising or for commercial marketing of third-party products or services. We do calculate simple engagement measures from how you use our apps, such as how many lessons you have completed and shared with others, to understand the impact of our Services and decide which resources and follow-up to offer you. We do not make any decision that has legal or similarly significant effects on you based solely on automated processing.

How We Share Your Personal Data

We do not sell or share your personal data with third parties for their own marketing purposes. We may share your data with:

• Service Providers: Trusted vendors who help us operate our website, apps, and support functions. These providers are contractually obligated to protect your data and use it only for the services they provide to us. They are: Google (Firebase and Google Analytics) for hosting, accounts, and analytics; Sentry for error and crash reports; Expo for push notifications; GeoJS for estimating your location from your IP address; Vercel for website hosting; Stripe and FundraiseUp for payment processing; Attio for managing our contacts and support requests; ActiveCampaign and Resend for sending emails; and OpenAI for our team's internal assistant.
• AI Tools: Some of these providers, including Attio, use artificial intelligence features to process the data we store with them, and our team uses an internal assistant built on OpenAI’s models to search our records, support requests, error reports, and internal communications. This means personal data you send us, such as a support message, may be processed by these AI models to help us respond to you and run our organization. These providers process the data on our behalf, and we do not use your personal data to train AI models.
• Legal or Regulatory Authorities: When required by law or to protect our rights and the safety of our users.
• Partners (with your consent): In rare cases, if you request to be connected with local support or follow-up, we may share your contact information with trusted partners, but only with your explicit consent.

Your Rights Regarding Personal Data

We strive to maintain the accuracy of any personal data collected from you and will try to respond promptly to update our records when you tell us the information in our records is not correct. However, we must rely upon you to ensure that the information you provide to us is complete, accurate, and up-to-date, and to inform us of any changes. Please review all of your information carefully before submitting it to us and notify us as soon as possible of any updates or corrections.

Depending on the laws that apply to you, you may obtain from us certain personal data in our records. If you wish to access, review, or make any changes to personal data you have provided to us through the Services, please contact us at privacy@waha.app. We reserve the right to deny access as permitted or required by applicable law.

Your Canadian Privacy Rights

Residents of Canada are permitted to request and obtain from us information respecting the existence, use, and disclosure of their personal data as well as access to that information (subject to certain exceptions pursuant to applicable laws). Without limiting the above, residents of Canada will, upon request:

• Be informed of whether we hold personal data about you;
• Be provided with an account of third parties to which we have disclosed your personal data;
• Be able to challenge the accuracy and completeness of your personal data and have it amended as appropriate; and
• Be provided with information about our policies and practices with respect to the management of personal data, including: the name or title, and address, of the person who is accountable for our privacy policies and practices; the means of gaining access to personal data; a description of the type of personal data held by us, including a general account of its use; a copy of any brochures or other information that explain our policies, standards, or codes; and what personal data is made available to related organizations.

Your EU and UK Privacy Rights

If you are located outside the United States, we transfer personal data for processing in the United States, including personal data sent via the Services, when you make a donation, or when you otherwise provide it to us. For the purposes of the UK and EU General Data Protection Regulation (the “GDPR”), we are a “controller” of your personal data. By using the Services outside the United States, you acknowledge that we will transfer your data to, and store your personal data in, the United States, which may have different data protection rules than in your country. Personal data may become accessible as permitted by law in the United States, including to law enforcement and/or national security authorities in the United States.

Rights of Swiss, EEA, and UK Residents

Under the GDPR, you may have the following rights with respect to your personal data, including:

• Right to Access and Portability. You have the right to access your personal data and/or receive a copy of the personal data that we have collected about you in a portable format.
• Right to Correct. You have the right to request that we update and correct inaccuracies in your personal data.
• Right to Object to Processing. You have the right to object to the continued processing or use of your personal data in certain situations, including for direct marketing purposes.
• Right to Erasure. You have the right to request to have your personal data blocked, anonymized, or deleted, as appropriate in certain situations.
• Right to Restrict Processing. You have the right to request that we restrict the processing of your personal data under certain conditions.
• Right to Lodge a Complaint. You have the right to complain to a supervisory authority if you believe your personal data has been processed in a manner that infringes applicable data protection laws. If you are in the EU, you can find information about your supervisory authority on the European Data Protection Board website. If you are in the UK, you can contact the Information Commissioner’s Office.
• Right to Withdraw Consent. If you have provided us with consent to use your personal data, you have a right to withdraw that consent easily at any time. Please contact us at privacy@waha.app. Withdrawing consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn.
• Right not to be Subject to Automated Decision-Making.You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects concerning you.

If you qualify, you may exercise these rights by contacting us at privacy@waha.app. We may ask you to provide additional information for identity verification purposes, or to verify that you are in possession of an applicable email account.

Please understand, however, that we reserve the right to retain an archive of such personal data for a commercially reasonable time to ensure that its deletion does not affect the integrity of our data; and we further reserve the right to retain an anonymous version of such information.

This section of the Privacy Notice is applicable to individuals located in the EEA, Switzerland, and the United Kingdom (“European Data Subjects”).

Our purpose for collecting and processing personal data from European Data Subjects is to provide them with the features and functionalities of our Services and information regarding our Services. The legal basis for processing personal data is because:

• It is necessary to provide you with the Services.
• It is related to features and functionality and, in other circumstances, may be necessary for our legitimate interests in making the Services available and secure.
• It is necessary to exercise our rights or comply with legal obligations.
• We also rely on your consent to receive information about our Services.

You may withdraw consent from receiving marketing and promotional communications at any time by clicking the “Unsubscribe” link in the communication or sending an email to privacy@waha.appwith the subject line “Opt Out.” If European Data Subjects do not provide personal data to us or withdraw consent for processing such personal data, we may not be able to provide such individuals with certain features or functionalities of the Services or information regarding the Services, including processing donations. We will only process your personal data for marketing purposes with your prior consent, and withdrawing that consent will not affect your ability to use the core features of the Services. Note that we do not collect any sensitive personal information about you.

Your Choices

You have certain rights regarding the collection and processing of personal data. You may exercise these rights, to the extent they apply to you, by contacting us at the information provided at the end of this Privacy Notice, or by following instructions provided in this Privacy Notice or in communications sent to you. Please be prepared to provide reasonable information to identify yourself and authenticate your requests.

• Communications Opt-Out: You may opt out of receiving marketing or informational emails from us at any time by using the unsubscribe link in our emails or by contacting us at privacy@waha.app.
• Location Information: Our apps do not ask for access to your device’s location. We estimate your approximate location (city, region, and country) from your IP address, so turning off location services on your device does not change it, but connecting through a different network or a VPN does.
• Analytics and Cookies: Our website uses minimal cookies for essential functionality and aggregated analytics. We do not use cookies for advertising or cross-site tracking. Most browsers automatically accept cookies by default, but you can adjust your device and/or browser settings to delete and/or block some or all cookies or provide notifications when you receive a new cookie. Consult the “Help,” “Tools,” or “Preferences” menus on your browser, or the documentation for your device, for more information about how to do this. Please note, however, that blocking or deleting certain cookies may negatively affect your user experience.

Protecting Personal Data

We use reasonable and appropriate physical, technical, and organizational safeguards to protect your personal data, including:

• Secure cloud-based storage with industry-standard encryption in transit and at rest.
• Access controls limiting data access to authorized personnel only.
• Periodic security reviews and adherence to best practices for data protection.
• Data our apps store on your device, such as downloaded lessons, notes, and progress, is protected by your device’s own security features. Security Mode lets you hide the app’s content behind a disguise screen that only your passcode opens.
• No storage of personal data in physical (paper) format.

While we strive to protect your data, no method of transmission or storage is completely secure. We encourage you to use caution when sharing personal information online.

Retention of Personal Data

We retain personal data only as long as necessary to fulfill the purposes described in this notice or as required by law. Specifically:

• If you use our apps without an account and do not open them for a year, we delete the data associated with that installation.
• If you have an account, we keep its data until you delete the account.
• You can delete your account at any time from the account settings in our apps. We delete your account and the data associated with it within 30 days. Lessons, notes, and progress saved on your device stay there, since our apps work offline; you can remove them by deleting the app.
• Messages, feedback, and support requests you send us are deleted two years after you send them.
• Donation records are kept for as long as you support Waha, and for at least seven years after your last gift, as required for receipts and financial reporting, even if you delete your account.
• Error and crash reports are deleted after 30 days.

You may also request deletion of your personal data at any time by contacting us at privacy@waha.app.

International Data Transfers

Waha is based in the United States and operates globally. Personal data collected from users outside the United States may be transferred to and processed in the United States or other countries where our service providers are located.

Children’s Privacy

Our Services are not intended for children under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will promptly delete it.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. When we do, we will notify users by posting a notice on our website, updating the effective date, and, where appropriate, providing additional notice (such as in-app notifications or email).

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact the Waha Privacy Team at privacy@waha.app.

We are committed to addressing your privacy concerns and ensuring your data is handled responsibly.

Accessibility

If you require this Privacy Notice in an alternative format due to a disability, please contact us at privacy@waha.appfor assistance.