Wasl — Privacy Policy
How the Wasl delivery-agent mobile app handles your data
Effective date: 2026-05-27 · Last updated: 2026-05-31
Wasl ("the App") is published by Pro Comrades for Computer Activities Co. W.L.L. ("Pro Comrades", "we", "us"). This policy describes what data the App handles and how.
Plain-English summary
Wasl is a tool for delivery agents employed by a courier or retailer. It sends data to your employer's own Odoo server so dispatchers can assign you deliveries, customers can track their parcel, and you can capture proof-of-delivery (photo, signature, cash). Pro Comrades does not receive your personal data. Nothing is sold to anyone.
1. Who is the data controller
Your employer (the company running the Odoo instance you connect to) is the data controller. They decide what data to keep and how long. Pro Comrades is a software provider; we do not host your employer's database.
If you have data-access or deletion requests, contact your employer's HR or operations department.
2. What the App collects and why
| Data type | Purpose | Where it goes |
|---|---|---|
| Login credentials (username, password, biometric unlock) | To authenticate you to your employer's Odoo server | Your employer's Odoo server |
| Employee profile (name, employee number, work phone, photo) | Display in the App and dispatcher dashboard so dispatchers and customers can identify the agent on a delivery | Your employer's Odoo server |
| Precise location (GPS) — while a delivery is in transit, including when the App is in the background | Show dispatchers where you are on the live map, compute live ETA, and let the customer track the parcel via their public link | Your employer's Odoo server. Streamed only while a delivery is "out for delivery"; stops automatically when you complete the last stop or end your shift. |
| Camera — photos taken at the customer's door | Proof of delivery (POD), proof of failed delivery (NDR), and KYC document uploads (license, vehicle registration, insurance) | Your employer's Odoo server. Photos are stored against the delivery / your employee record. We do not access your photo library. |
| Handwritten signature captured on screen | Customer signature on POD | Your employer's Odoo server |
| Cash-on-delivery (COD) amount you reported collecting + payment method | Reconcile cash at end of shift with the cashier | Your employer's Odoo server |
| KYC documents (driving license, vehicle registration, insurance — number, expiry date, and a scanned image) | Regulatory compliance: your employer must record that drivers are licensed and their vehicles are insured | Your employer's Odoo server. The App auto-pauses your assignments if a document expires. |
| Delivery customer details (name, address, phone, COD amount) that your employer assigns to you | So you know where to deliver | Read from your employer's Odoo server. Visible to you only while the delivery is assigned to you. |
| Device biometric (Face ID / Touch ID / fingerprint) | Optional in-app unlock | Stays on your device — never transmitted |
| Server URL + API token + language preference | Connect to your employer's Odoo instance and stay logged in | Stored encrypted on your device using iOS Keychain / Android Keystore. Deleted on logout / uninstall. |
| Offline-write queue (POD captures and status changes you made with no network) | Replay them automatically once the network returns so no delivery record is lost | Stored on your device only, until the next successful sync. Cleared after a successful upload. |
We do not collect: your contacts, calendars, photo library, microphone audio, advertising identifier, or browsing history. We do not use third-party analytics or advertising SDKs.
3. Permissions Wasl requests, and what we do with them
| Permission | When we ask | What we do |
|---|---|---|
| Location — while in use | The first time you open the home screen with an assigned delivery | Sort deliveries by distance, draw the live map, auto-mark "Arrived" when you enter ~80 m of the customer pin. |
| Location — always / in background | When you tap "Out for Delivery" on the first stop. We explain why before the system prompt appears. | Continue streaming your position to the dispatcher while the App is in the background or your phone screen is off, so the customer's live tracking link keeps working while you drive. Streaming stops automatically when you complete the last stop, end your shift, or revoke the permission. |
| Camera | When you tap "Take POD photo", "Capture failure photo", or "Upload KYC document" | Capture a single photo; uploaded to your employer's Odoo server with the relevant record. We do not access your photo library. |
| Notifications | When you accept the system prompt | Notify you when a delivery is assigned, when a chat message arrives from your dispatcher, or when the system flags an urgent change. On iOS, your employer's server sends pushes directly to Apple Push Notification service (APNs); Apple delivers them to your device. APNs receives only the push token issued by your phone plus the title and body of each notification (no financial or KYC data). On Android, the App polls your employer's server every 30 seconds for new notifications — no third-party push service is involved. |
| Face ID / Touch ID / fingerprint | When you opt in to biometric app unlock | Verification happens locally on your device. Wasl never receives your biometric template. |
| Foreground service (Android) / location background mode (iOS) | While GPS streaming is active | Android shows a persistent notification while GPS is being streamed, so you always know location tracking is on. iOS shows the blue location bar. |
You can revoke any permission at any time in iOS / Android settings. The App will gracefully degrade — location-dependent features will stop working, but other parts of the App continue to function.
4. Third-party services
| Provider | Purpose | Data shared |
|---|---|---|
| Apple App Store / Google Play | App distribution | Standard install metrics (controlled by Apple/Google) |
| Apple Push Notification service (Apple Inc.) — iOS only. | Deliver push notifications to your iPhone or iPad | The APNs device token issued to your phone, plus the title and body of each notification. Notifications contain only short operational text (e.g. "New delivery assigned", "Message from dispatcher: …"). They never contain financial, KYC, GPS, or POD-photo data. Android uses in-app polling against your employer's server, no third-party push service. |
| OpenStreetMap tiles (via openstreetmap.org) | Render the map tiles you see on the live-tracking screen | Standard HTTP request — viewport coordinates and a tile request. No personal identifier is sent. |
| Google Maps / Apple Maps | Open turn-by-turn navigation to the next stop when you tap "Start route" | The destination coordinates are passed to the external navigation app on your phone. The destination customer name is NOT passed. |
| Your employer's Odoo server | Everything functional in the App | All operational data described above |
Wasl does not integrate with analytics SDKs (no Google Analytics, no Mixpanel, no Amplitude), advertising networks, crash-reporting SDKs (no Crashlytics, no Sentry, no Bugsnag), or any third-party tracking services. The only external service used for notifications is Apple Push Notification service on iOS (Apple Inc.) — see Apple's Privacy Policy for how Apple processes APNs traffic. Wasl does not use any Google or Firebase services on either platform.
5. Data retention
Wasl retains the minimum needed to operate:
- Your server URL, API token, language and timezone preferences live on your device until you log out or uninstall.
- The offline-write queue lives on your device only until the next successful sync; entries are deleted after upload.
- All operational data (deliveries, POD photos, signatures, GPS pings, KYC docs) is sent to your employer's Odoo server. Retention there is governed by your employer's policy.
When you log out or uninstall the App, locally-stored credentials, offline queue, and preferences are deleted.
6. Children
Wasl is not directed to anyone under 18. It is intended for employed adults who are licensed to drive a delivery vehicle in their jurisdiction.
7. International transfers
Operational data goes only to your employer's Odoo server. Your employer chooses where that server is hosted and is responsible for cross-border-transfer compliance.
8. Your rights
For records held by your employer (delivery history, KYC docs, GPS log, POD photos, cash deposits), contact your employer's operations or HR department.
For the small amount of data Wasl stores on your device (server URL, API token, language, offline queue): uninstall the App or use Settings → Logout to delete all of it.
9. Security
- All API traffic uses HTTPS (TLS 1.2+).
- API tokens and server URLs are stored using iOS Keychain / Android Keystore.
- Biometric verification happens entirely on-device using the operating system's secure enclave.
- Offline-write payloads use idempotency keys, so a retry of a request that already succeeded does not double-process the delivery, the POD, or the COD payment.
- Wasl does not embed any cryptographic backdoors or third-party tracking SDKs.
10. Changes to this policy
If we change this policy, we will update the date at the top and, for material changes, prompt you in-app.
11. Contact
Pro Comrades for Computer Activities Co. W.L.L.
Email: info@procomrades.com
Address: Kuwait City, Kuwait
For data held by your employer, contact your employer directly.
© 2026 Pro Comrades for Computer Activities Co. W.L.L. · Wasl Delivery