Skip to main content

Privacy Policy

Last updated: 16 October 2026

1. Who we are

Waha ("we", "us") is a free directory of children's activities, classes, clubs and nurseries in Dubai and the wider UAE. Parents browse without an account and contact providers directly, usually on WhatsApp. Providers can claim their listing and keep it up to date.

For anything about this policy, or to use your rights, email [email protected].

2. Parents: no account, no children's data

There are no parent or child accounts on Waha. We don't ask for your name, your children's names or ages, or anything else about your family. The search filters you use (for example an activity, an area or an age range) and the words you type into the search box are used to show you results. We also record them in our analytics, without your name or contact details, to learn what parents look for and improve the site; they are not linked to who you are.

Like every website, we process the technical data your browser sends (IP address, browser and device type, pages viewed) to serve the site, keep it secure and understand how it is used. If you allow location access, your position is used only in your browser to sort providers by distance; it is not sent to or stored on our servers.

"Message on WhatsApp" opens WhatsApp on your device with a short message to the provider. From that moment the conversation is between you and the provider, under WhatsApp's own terms and privacy policy. Waha does not see, store or receive those messages. We record only that the button was clicked, to understand which listings help parents.

3. What we collect

When you use the listing form

The listing form on the For providers page (waha.kids/for-providers) collects what you choose to send: the listing you pick, the kind of request (claim, correct, remove or report a problem), your message, an email address or phone number so we can reply, and, optionally, your name. We use it only to handle your request.

When you claim a listing

To claim a listing we ask for your name, your role at the business and your work email, and we email you a one-time sign-in code. We check whether that address is one the listing already shows, or is at the business's own website domain; if it isn't, we contact the business on the details on its listing to confirm before handing it over. Changes you send for your listing are kept with the date and the decision, so we can review them and undo one if needed.

Provider accounts

  • Sign-in details: email address (or your Google account, if you sign in with Google)
  • Business profile, contact details, venues, photos and logo you add
  • Class schedules, prices and availability you enter

4. Provider listings and public business information

To make Waha useful, we publish listings for activity providers that have not (yet) claimed their page. These listings are built from information the business has already made public: its Google Business Profile (name, address, phone number, opening hours, category, rating and review count, photos) and its own website. We may add a short description of the activity and the provider, checked against those sources. We do not publish reviews written by parents on other platforms, and we do not invent prices, ages or schedules; where we do not know, the page says so.

If you run a listed business you can claim your page, correct any detail or ask us to remove it with the listing form on the For providers page (waha.kids/for-providers), or by emailing [email protected]. Removal requests are actioned within 7 days. Where a listed phone number belongs to an individual (for example a sole-trader coach), that number is personal data and your rights in section 9 apply.

5. How we use data

  • Show providers, classes and nurseries that match what you search for
  • Open a WhatsApp conversation with a provider when you choose to
  • Handle claim, correction and removal requests
  • Run provider accounts and the tools providers use to keep their listing up to date
  • Keep the site secure, fix errors and understand which features are used, in aggregate

We do not sell data. We do not use it for advertising, on Waha or anywhere else.

6. Legal basis (UAE PDPL)

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) we rely on:

  • Legitimate interest: running the directory, publishing public business information so parents can find providers, security, error monitoring and aggregated analytics
  • Your request: handling a message you send through the listing form, and running a provider account you open

7. Storage, security and cookies

Data is stored with Supabase (PostgreSQL) and the site is served by Cloudflare. We use:

  • Encryption in transit (TLS) and at rest
  • Row-level security on every database table, so listing reports and provider data are readable only by the people who should see them

Waha uses local storage to remember things like recently viewed listings on your device, essential cookies to keep providers signed in, and PostHog and Google Analytics cookies to understand how the site is used. We do not use advertising cookies. You can clear these in your browser at any time.

8. Third-party services

  • Supabase: database, provider sign-in and serverless functions
  • Cloudflare: hosting and delivery of the website
  • Meta (WhatsApp): the messaging app you open when you contact a provider
  • Google: Google Business Profile data behind provider listings, Google sign-in for providers who choose it, and Google Fonts (your browser requests them from Google)
  • OpenFreeMap and OpenStreetMap: the maps on browse and provider pages. Your browser loads the map from OpenFreeMap (tiles.openfreemap.org), which sees your IP address as any website you visit does. If that map can't load, we fetch OpenStreetMap tiles through our own servers, and your browser only contacts the OpenStreetMap tile server directly if that fails too
  • PostHog: product analytics and session recordings (EU-hosted): how pages are used, such as clicks, scrolling, the pages you visit, the filters you pick, the words you search for and which listings, WhatsApp buttons and links you tap, so we can improve the site. Session recordings mask anything you type. Apart from the search box, nothing you type is recorded, and we remove anything that looks like an email address or phone number from searches. It is not used for advertising
  • Google Analytics: visit statistics (pages viewed, how you arrived, device type); it sets cookies, and Google processes the data
  • Sentry: error monitoring, so we can fix crashes; reports may include your browser and the page you were on
  • Resend: email to providers about their listing or account
  • Anthropic (Claude): AI that helps us draft and check listing descriptions from the public sources in section 4

9. Your rights and how to use them

Under the UAE PDPL you can:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Ask us to delete it, including a listing or a provider account
  • Object to processing based on legitimate interest
  • Receive a copy of your data

Email [email protected] or use the form on a listing; we reply within 7 days.

10. How long we keep data

  • Listing form messages: only as long as needed to handle the request
  • Provider accounts: while the account is active; deleted within 30 days of a deletion request
  • Provider listings built from public information: while the business is open; removed on request (section 4)
  • Analytics events stored in our database: 90 days, then deleted automatically

11. Changes to this policy

When we change this policy we update the date at the top of this page. Continuing to use Waha after a change means you accept the updated policy.