Privacy Policy for the iWasp Agent app

Effective date: 23 October 2026 · Legal operator: Dam Computer Systems Company L.L.C., Amman, Jordan.

Erasing your data · النسخة العربية

Who we are

This policy explains how we handle your data when you use the iWasp Agent app, or its web version (wasp.iwaspjo.net), as one of our agents or members. The legal operator responsible for this data is Dam Computer Systems Company L.L.C., registered address Building 79, Jabal Arafat Street, Al Yasmeen, Amman, Jordan. On Google Play this app is, or will be once released, listed under the developer name “D.A.M Technology”; that is a developer name only, not the legal operator.

Data we collect

• Your agent account: your name, phone number, email address and whether it is verified, your referral code, the tier recorded on your account, account status, joining date and commission rate. Our team creates the account from these details; there is no sign-up in the app.
• Your application: if you applied at iwaspjo.net/apply, what you wrote in it (including your city and the tier you chose) stays linked to your account, as does the IP address it was sent from (collected so we could investigate any abuse of the form).
• Your membership: tier, monthly fee, status, start date and next payment due, and your service-fee invoices (amount, period, tier, due date, and payment date and method). Fees are paid outside the app; the invoices in it are records only.
• Every member is also given a wholesale account in the iWasp Jomla app: we create it with the membership from your details if you didn't already have one, and that app's privacy policy (jomla.iwaspjo.net/privacy) covers it.
• Wasp Credit (a balance in dinars held with us, usable only to buy on our platform and not withdrawable as cash): your balance and every movement on it (amount, type, date and its recorded reason), including your purchases with it. Credit is added outside the app: our team records each member deposit after a CliQ transfer, with the transfer reference, and each adjustment with its reason. We don't collect payment card numbers.
• Member points (a recognition score with no cash value; it can't be spent or exchanged): your score and its history, with reasons.
• Your commission: the rate and where it comes from, and an estimate of your commission worked out from your clients' delivered orders.
• Your regions: the geographic regions our team assigns to you.
• Your access rights: which of our agent, wholesale and deals services are open to your sign-in; and, for wholesale and deals, each time one is opened or closed, with the team member who did it and the reason they write (which may name your membership).
• Your clients (other people's data): for each customer who signed up in any of our store apps with your referral code, we show you their name, signup date, region and whether it is in your regions, and the number and total value of their delivered orders — never their phone number, email or address. If a client deletes their account, they stay on your list without their name. Our store policy tells customers this.
• We also record each link between a customer and you (including customers who joined our social app with your code), its confirmation or release, and who recorded it and why; these customers may not appear on your client list.
• Signing in: your phone number and the code we send it by SMS, or — on the web version only — your email address and the sign-in link we send it. If our team creates a new sign-in for you, we email you its first sign-in link.
• Sign-in records: our authentication provider logs sign-in events, including your device's IP address.
• Sign-in activity: we keep in our database when your sign-in account was created, when you last signed in, and whether your phone number and email address are verified; our team can see this, and it stays while your sign-in account exists. For each sign-in session we also keep your device's IP address and the browser or device type, until the session ends, for example when you sign out; sessions do not expire on their own today.
• Crash reports: when the app hits an error it sends a technical report with the page's web address (URL) and the page you came from — without anything after a question mark or a # in either — the browser or device type with its language and time zone, and the app's recent steps: which kind of element you tapped, never its label or text, and the network requests (their addresses without the query, not their contents), and the error itself with your data removed from it. It does not send what the app writes to the browser's console.
• Crash reporting is set not to send your personal data by default and not to store your IP address, and it does not record your screen. Before a report leaves your device, your account details — name, phone number, email and, in the agent app, your referral code — and anything shaped like a phone number or an email are removed from it.
• On your device: the app stores your sign-in session, which includes your phone number and email address, and a short record of the phone numbers codes were requested for and when, used to space out repeated code requests. That record stays until you sign out in the app, or until a new code is requested on this device more than 10 minutes after the last one.
• The app doesn't ask for your location, contacts, photos or files, and needs nothing but an internet connection. We don't collect an advertising ID, don't use advertising tools or analytics services, and don't send push notifications.

How we use your data

To run your agent account and membership, show you your credit, points, invoices, clients and estimated commission, sign you in, support you, prevent abuse and keep the service secure, fix errors, and meet our legal obligations. We process your data to provide the service you ask for, and as far as the laws in force in the Hashemite Kingdom of Jordan allow or require; this policy is governed by those laws. We don't sell your data, don't show ads, and don't send marketing messages: SMS from our sender carries sign-in codes only, and the only emails we send are sign-in emails and our replies to what you write to us.

Who sees your data

• Our team: authorised administration staff see your account, membership, credit, points, invoices and clients, and, for each credit movement, points entry and invoice payment our team records, which team member recorded it, to run your account and support you. Access is limited to authorised staff.
• Your referral code is public by nature: it is printed on your cards and appears in your links and QR code. Its link stops working when your account is paused or your data is erased, so while it works, anyone who knows the code can tell your account is active. Our store apps don't show your name to customers or to store owners.
• Our social app (iwaspjo.com): if a customer joins the social app with your referral code, they may be shown your name so they can confirm the link to you, and we record that link. If you use the social app with the same phone number, the social app receives your Wasp Credit balance and its latest 50 movements (amount, type and date, without reasons or transfer references) and your account's deals access state; you can pay from your Wasp Credit there, those payments appear in your credit history, and import-shipment lots you buy there are recorded under your sign-in; if you ask there to sell as a supplier, we record your request (your business name and the terms version you accepted) on your sign-in.
• Service providers who process data on our behalf:
  • Supabase — database and sign-in: stores your account and the data described under “Data we collect”, except crash reports and what stays on your device.
  • Twilio — sends the SMS codes (receives your number and the message text).
  • Resend — sends sign-in emails, including the first sign-in link when a new sign-in is created for you (receives your email address).
  • Sentry — the crash reports described above.
  • Cloudflare — hosts the app's web version, carries the connections to the administration server our team uses, and stores our encrypted backups.
  • Railway — hosts the administration server our team uses to create and manage accounts and to record credit movements.
  • GitHub — runs our weekly backup job, which handles a copy of the database briefly before it is encrypted.
  • Vercel — hosts our social app (iwaspjo.com), which we run ourselves, and the data of yours it receives, as described above.
  • Google — hosts our email (support@iwaspjo.net and privacy@iwaspjo.net), so it receives what you send us.
• If you message us on WhatsApp, the conversation goes through WhatsApp's service under its own terms.
• Authorities: we disclose your data to a public authority only where the laws in force in Jordan require it, such as an order from a court or a competent authority, and only as far as that requires.

Where your data is stored

Our database is stored in the European Union (Frankfurt, Germany), outside Jordan. Crash reports are stored in the European Union (Germany). Sign-in emails are sent from Ireland, and our email provider keeps its logs in the United States. SMS sign-in codes are processed in the United States. Our other service providers listed above may process data in other countries. We occasionally test our backups by restoring them into a temporary copy in the same EU region (Frankfurt), which is deleted after the test.

How long we keep it

• Your agent account, application and client list: with no time limit today; we don't delete agent accounts, and if you ask for erasure we erase what “Erasing your data” lists, and the rest stays as that section describes. Your membership and regions: while your sign-in account exists.
• Credit, invoice, account-access and client-link records are financial and operating records we don't delete, and we don't delete your member-points history either (a recognition score, not money); there is no time limit today — they stay even after your data is erased.
• When someone opens your printed referral-card link (iwaspjo.net/r/…), we record their browser type, country and referring page, with no IP address and no account, for 90 days; after that only a daily total remains.
• Crash reports, at their provider: for up to 90 days.
• Sign-in logs, and our SMS and email providers' logs, at those providers: sign-in logs at our authentication provider for 7 days; email logs for up to 30 days; and our SMS provider keeps each message's record (your number and the code it carried) available for 13 months under its default settings, then moves it to an archive whose retention we have not yet confirmed. Erasing your data does not reach these logs.
• Messages you send us at support@iwaspjo.net or privacy@iwaspjo.net or on WhatsApp, and anything we ask for to verify an erasure request: kept in our mailboxes and our WhatsApp account for 12 months; erasing your data does not reach them before then.

Erasing your data

Erasure is final: afterwards your agent account can't be reactivated, and your printed cards and your iwaspjo.net/r/ links never work again. To ask for it, write to us at privacy@iwaspjo.net; before acting, we confirm the request is yours with a code sent to your registered phone number, or a written request with proof of identity. There is no erase button in the app: our team carries it out, deactivating your agent account and then erasing your name, phone number and email address from your agent record and, if you applied, everything you wrote in your application and the IP address it was sent from. We complete the erasure within 30 days of your request — or, if the erasure is held as described below, within 30 days of the hold lifting.

Your code stays reserved, so it is never given to anyone else. A store link carrying your code (?ref=) still opens the store, and anyone who signs up through it is still recorded against the code.

If you also have a wholesale account in the iWasp Jomla app — every member is given one — this erasure does not reach it: it keeps the name it was registered under, the contact person, your phone number, your email address and your business address, if you or our team have added one. You can ask for your wholesale account to be erased too, by writing to us at privacy@iwaspjo.net, as that app's policy (jomla.iwaspjo.net/privacy) describes.

What stays: your credit, invoice, membership and account-access records, and your member-points history, linked to your sign-in account's identifier, with what our team wrote on them (such as movement reasons and transfer references); your tier and joining date; your clients' link to the code and the record of customers linked to you; and, if you applied, the record of how your application was decided: the outcome, its date, which team member decided it, and their note.

If, at erasure, your agent account is the last role on your sign-in account — no wholesale account, membership (even a cancelled one, which our team can reinstate) or other role with us remains; a customer account in one of our store apps is not a role here, since Wasp Credit can't be spent there today — and you hold a Wasp Credit balance above zero, your erasure is held until you spend the balance or waive the hold in writing, naming the exact balance. A waiver waives the hold, not the money: the balance belongs to your sign-in account, which erasure does not delete, and it stays yours to spend; if you use our social app (iwaspjo.com) with the same phone number, you can spend it there. Credit is never paid out as cash.

Erasure may not reach what was already sent to our social app (iwaspjo.com), such as your name if it was shown to a customer.

This step does not delete the sign-in account itself, which keeps your phone number and email address. You can ask us to delete it as well: if it carries records that prevent its deletion — such as credit, invoices, member points, import lots or wholesale orders — it can't be deleted yet; otherwise we delete it by hand and record it. If your sign-in also holds a customer account in one of our store apps, that account can't be deleted while the sign-in holds a membership, a wholesale account or any of these records.

We don't edit backups; your data stays in them until they expire: daily backups for about 7 days, weekly encrypted copies for about 35 days, monthly encrypted copies for about 400 days, and encrypted offline archive copies for no more than 12 months. If we ever have to restore a backup made before your data was erased, your erased data could come back; we don't yet repeat erasures automatically after a restore, and you can ask us to erase it again at any time.

Your choices and rights

You can't edit your name, phone number or email address in the app; write to us to ask for them to be corrected or changed. You can ask to see or correct your data by writing to us — we don't yet have a tool to download your data. The laws in force in Jordan may give you further rights over your data; to use any of them, write to us at privacy@iwaspjo.net, and if our answer does not satisfy you, you can complain to the competent authority in Jordan.

Security

We use encrypted connections, encrypt our backups and keep their key offline, and limit access to our operations systems to authorised staff. No system is perfectly secure.

Test accounts

We may keep a small number of test sign-ins that our team and app-store reviewers use to check the app. They belong to no real person, hold no credit or money, and are set up to see only test data, which we check each time we rotate them.

Children

The service is not directed at anyone under 18, we don't knowingly collect their data, and the app has no age check.

Changes to this policy

We post any change on this page with a new effective date. If the Arabic and English versions differ, the Arabic version prevails.

Contact

Privacy, erasure or deletion questions: privacy@iwaspjo.net

For help using the app: support@iwaspjo.net, or WhatsApp +962790444835.