Privacy Policy

Last updated: September 3, 2026

Wakalti is a management platform for real estate agencies in Tunisia. This Privacy Policy explains what information we collect, why we collect it, and what you can do about it.

Two Kinds of People in This Policy

Wakalti is used by agencies to manage information about other people, so it is worth being precise about who is who:

• Agency users are the people who sign in to Wakalti — agency owners, managers and agents. For their data, Wakalti is the controller: we decide what to collect and why.
• Agency contacts are the buyers, sellers, landlords and tenants whose details an agency records in its registers. For their data, Wakalti is a processor: the agency decides what to record, and we hold it on the agency's instructions. If you are one of these people, the agency you spoke to is your first point of contact, and this policy tells you what we do on their behalf.

Definitions

For the purposes of this Privacy Policy:

• Company (referred to as "Wakalti", "We", "Us" or "Our") refers to Wakalti, the real estate agency management platform.
• Service refers to the Wakalti web application and the messaging assistant that connects to it.
• Organization means an agency's workspace on Wakalti. It is the boundary that separates one agency's data from every other agency's.
• Personal Data is any information that relates to an identified or identifiable individual.
• Usage Data refers to data collected automatically about how the Service is used.
• Account means a unique account created for accessing the Service.

What Data We Collect

Account Information

When you create an account we collect your email address and a password, which is stored only as a salted hash and is never visible to us. If you complete your profile we also store your name and, optionally, an avatar image and phone number. When you create or join an agency we store the agency name, its members, and each member's role and invitation status.

Agency Records You Enter

The substance of the Service is the data an agency chooses to record:

• Property offers — address, location, price, surface, type, mandate details and photographs
• Purchase demands — the criteria a buyer is searching against
• Contacts — names, phone numbers, email addresses and notes about buyers, sellers, landlords and tenants
• Appointments and property visits
• Commission invoices and the deals behind them
• Virtual tours and the property media attached to them

An agency decides what goes into these records. We do not require any particular field, and we do not enrich this data from outside sources.

Conversations from Messaging Channels

If an agency connects WhatsApp Business, Instagram, Facebook Messenger or Telegram, we receive and store the messages exchanged between the agency and the people who contact it, together with the sender's platform identifier and display name. These conversations are used to answer enquiries, qualify leads and book visits, and they remain within that agency's Organization.

Usage Data

We automatically collect information about how the Service is used: pages viewed, features used, approximate location derived from IP address, browser and device type, and timestamps. Public virtual tour pages record an anonymous per-session identifier so a single visitor is not counted repeatedly.

How We Use Your Data

We use the data described above to:

• Provide the Service and keep an agency's registers, contacts and appointments available to that agency
• Match recorded purchase demands against recorded offers, which is the core function of the product
• Send transactional email — sign-in links, password resets, invitations and security notifications
• Operate the messaging assistant that answers enquiries on an agency's connected channels
• Understand which features are used, so we can decide what to build next
• Detect, investigate and prevent abuse, and meet our legal obligations

We do not sell personal data, and we do not use agency records or conversations to advertise to anyone.

Where Your Data Lives

Wakalti stores data server-side in a managed PostgreSQL database. Access is enforced in the database itself through row-level security keyed to your Organization, so one agency cannot read another agency's records even in the event of an application bug.

Data Retention

We retain account and agency data for as long as the account is active. When an agency closes its account we delete or anonymise its records within 90 days, except where we are required to keep something longer for legal or accounting reasons. Backups are retained on a rolling basis and are overwritten in the ordinary course.

Cookies and Tracking

We use cookies that are necessary for the Service to work — principally the session cookie that keeps you signed in and the cookie that remembers your language preference.

We also use PostHog for product analytics. You should know that our analytics are not currently behind a consent banner: PostHog is loaded for every visitor outside local development, and it captures page views and interaction events. We are stating this plainly rather than implying a consent step we do not yet have. If you would rather not be measured, most browsers and tracker-blocking extensions will block it, and you may contact us to ask that your events be deleted.

Third-Party Services

We rely on the following processors, each of which may handle personal data on our behalf:

• Supabase — database, authentication and file storage
• Vercel — application hosting and delivery
• Resend — transactional email delivery
• PostHog — product analytics
• AI model providers — the assistant sends conversation text to a third-party model provider in order to generate a reply
• Meta Platforms and Telegram — where an agency has connected WhatsApp, Instagram, Messenger or Telegram, messages pass through those platforms under their own terms and privacy policies

Each of these providers processes data under its own agreement with us and is not permitted to use it for its own purposes.

Data Security

We protect data in transit with TLS, isolate tenants with row-level security, store passwords only as hashes, and restrict administrative access to the database. No system is perfectly secure, and we do not claim otherwise; if we become aware of a breach affecting your personal data we will notify you and the competent authority as required by law.

Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Delete your data, subject to our legal retention obligations
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at the address in Contact Us below. If you are an agency contact rather than an agency user, please approach the agency that holds your details first — we will act on their instruction, or on yours directly where the law requires it.

International Data Transfers

Wakalti serves agencies in Tunisia, but the providers listed above operate infrastructure outside Tunisia, including in the European Union and the United States. Your data may therefore be processed outside your country of residence, under the contractual safeguards we have in place with each provider.

Children's Privacy

The Service is intended for use by real estate professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to This Policy

We may update this policy as the Service changes. We will post the revised version on this page and update the "Last updated" date, and we will give notice of material changes before they take effect.

Contact Us

For any privacy-related question, concern or request:

• Email: support@updates.tanvilla.app

We will respond to all requests within 30 days.

Wakalti is committed to transparency about what we hold and why. If you have questions about this policy or our practices, please get in touch.