Security

• Wasil never sees, stores or transmits your card number. Card details are entered directly into Stripe's own payment form and go straight to Stripe.
• Stripe is a PCI DSS Level 1 certified service provider — the highest level defined by the payment card industry. stripe.com/docs/security
• What Wasil stores is a Stripe customer reference. Nothing else about your card.

That is a statement about Stripe, not about Wasil. Wasil is not PCI certified and does not claim to be: because card data never touches our servers, we qualify for the simplest self-assessment there is. Anyone who tells you their marketplace is "PCI certified" is usually describing their payment provider.

1. Nothing is charged when you post a request. Only when you accept a bid.
2. The charge lands on Wasil's Stripe balance. Not in the traveller's account.
3. It is released only after you read your six-digit code to the traveller at handover.
4. Full refund, any time before the item is marked delivered.
5. If you raise a dispute the money stays held while a human reviews it.

One honest word about that: this is an escrow-style hold on a platform balance, not a regulated escrow account with a licensed third party. The money genuinely does sit with Stripe rather than with your traveller, and it genuinely is not released until you give the code — but when a marketplace describes a platform balance as a regulated arrangement, the phrase is doing more work than the thing behind it.

• Signing in is a six-digit code sent to your email. There is no password — so there is nothing to leak in a breach, and nothing to reuse from someone else's.
• Codes expire after 15 minutes.
• Three wrong codes lock that email address for about twenty minutes.
• We never ask for your code. Nobody from Wasil will ever ask you for it, by email or in chat. It is in the sign-in email too, for the same reason.

What we hold: your email, display name, home city, any addresses you add, item photos, receipts, chat messages and ratings.

Who else processes it

• Stripe — payments and card data.
• Convex — the application database and file storage.
• Resend — transactional email.
• Vercel — hosting and delivery.

That is the whole list. Wasil runs no analytics, no advertising pixels and no third-party trackers — not as a policy we intend to adopt, but as a fact about what is installed today. If that changes, this line changes with it.

Privacy policy — retention and deletion

• Before you accept a bid: display name, home city, delivery count, ratings.
• After you accept: the above, plus any address you chose to share. A meet handover shares no address at all.
• Never, at any point: your email address.

You see the same about them, and nothing more.

This section is the one that earns the five above it.

• We do not verify identity documents. Accounts are confirmed by email only.
• We do not supervise handovers. Meeting safely is on both of you.
• We do not insure items. If something is damaged in a bag, Wasil cannot replace it.
• We are a pilot. Wasil started in August 2026 and is early — we would rather say so than imply a track record we have not earned yet.

Meeting a stranger — how to do it sensibly

Write to hello@hey.usewasil.com. Report something in good faith and we will not pursue you for it — no legal threats, no account penalty for looking.

We are a small team, so the honest answer on timing is that you will hear from a person within a few days rather than within an hour. We would rather give you that than a response time we cannot keep.