Privacy

This policy explains what Kabsi collects, why, who helps us process it, how long we keep it and what you can ask us to do. It covers the website, the Kabsi app, emails from Kabsi, the free review link tool, Kabsi review links, QR codes and cards, WhatsApp messages with Kabsi, and the Kabsi Partners program.

Who is responsible

Kabsi is operated by Rashid Abou Hamzy. Contact: hello@kabsi.co.. The operator is also the data controller for the personal data described here.

1. Who we are

Kabsi is operated by Rashid Abou Hamzy, who is responsible for the personal data described here. Contact: hello@kabsi.co.

Kabsi is independent. It is not affiliated with, endorsed by or sponsored by Google, and Google does not partner with Kabsi. Google and Google Business Profile are trademarks of Google LLC.

2. What we collect

If you chat with Nora (the AI assistant on our pages): your messages, the page you asked from, the country your connection comes from, your browser's time zone and language, the kind of device and the site that sent you (never your IP address), and any contact details you choose to give (name, email, business name, phone, city). We use them to answer, to send the Kabsi team a short report of each chat, to follow up and, only if you say yes, to send you occasional Kabsi news. Nora is an AI model run by Anthropic on our behalf; if she passes your question to a person, we reply from hello@kabsi.co.

If you use Kabsi for your business:

• Your email address (to sign in with a code and to receive Kabsi emails), and any extra alert addresses you add.
• Your business name, address, country, time zone and Google identifiers (Place ID and Business Profile location). Kabsi first reads the name and address from Google and keeps them for as long as your account exists, because they say which business is yours.
• The facts you give Kabsi for drafting and for watching your listing: sign-off, tone, phone number, hours, what to mention, staff names and answers to customer questions. Earlier versions of a fact are kept as a history.
• Your Google reviews (reviewer's public name, rating, text and dates), the replies we draft and the replies you post; posts, photos and special hours you prepare; your listing's name, phone, address, hours, website and category, to detect changes.
• Your plan and payments: the plan, the amount and the date.
• The date and wording of the authorisation you gave Kabsi.
• A log of the emails we send you (address, subject, time and delivery status).
• A record of what you approve and change: who did what and when, from the app or an email link, with the country of the connection and the browser, never your IP address and never review text.

If you tap or scan a Kabsi card or open a Kabsi review link: the card code, the time, the country the request came from, whether the phone was Android or iPhone, whether it came from the chip or the QR code, and whether it looked like an automated crawler. We don't know who you are and we never store your IP address. You're sent to Google's own review page, which Google's privacy policy covers.

If you use the free review link tool: your search text is sent to Google's Places API to find the business. To stop abuse we keep a one-way, salted hash of your IP address for one hour, never the address itself. Nothing else is stored.

If you use the free Google Profile Check: your search text is sent to Google's Places API, and what Google shows publicly about the business you pick (rating, review count, opening hours, phone, website, category and whether it has photos) is shown to you and not kept; only the business's Google Place ID is kept. We keep the same one-way, salted hash of your IP address for one day to enforce the limit of 3 checks a day. If you ask for the check by email, we keep your address, the Google Place ID of the business, whether you ticked "Send me tips on managing my Google profile", those words, the page and the time, as proof of your choice. The check uses public information only and never your Business Profile.

From launch, if Kabsi checks where your business shows: your business name, category, address and the keywords you confirm are sent to DataForSEO, which looks up Google Maps results around your business and what ChatGPT and Perplexity answer. Geoapify receives map points (coordinates) to draw the map image. We keep the results: your rank at each point on the map, the AI answers (shown as samples, because they change from run to run) and the public details of the competitors you pick: name, rating, number of reviews, category and new reviews a month. No review text and no personal details of your customers are sent for this. These results are kept apart from the numbers Google gives us about your own profile.

From launch, if you apply to Kabsi Partners: your name and email, country and city, what you do, where you will share Kabsi and roughly how many local owners that reaches, one line on how you will recommend it, your advertiser permit number if you give one, your WhatsApp number, and the time you accepted the partner terms. When you choose how to be paid, your payout details are kept encrypted in our database vault and shown only as the last 4 characters. We also keep the visits, scans, trials and payments that came through your partner link or code, so we can pay you correctly.

If you write to us through a form: what you enter (for example name, email, Instagram handle, country and message).

When you visit the website or app: anonymous usage statistics and error reports (see section 7).

3. Why we use it

• To provide Kabsi: draft replies and posts, send your emails, watch your listing, publish what you approve, and run your plan. We rely on our contract with you.
• To process reviews written by your customers so you can answer them. This is in your legitimate interest and theirs: the reviews are public and replies go on the same public page.
• To keep Kabsi secure, prevent abuse and fix errors. This is our legitimate interest.
• To keep payment records, because tax and accounting law requires it.
• To answer messages you send us.

We don't sell or rent personal data, we don't use it for advertising, and we don't send marketing emails without asking you first.

4. Google data

• You give Kabsi access by inviting the Kabsi business group (Kabsi Clients, ID 5481006796) as a Manager on your Business Profile. Kabsi uses Google's official Business Profile APIs to read your reviews and profile information and to publish only what you approve. We also use the Places API for public details such as your category, area and public rating. When Kabsi accepts the invitation we email you within 48 hours to say what changed and how to remove Kabsi.
• We use Google data only to provide and improve the Kabsi features you use. We never sell, rent or transfer it, never use it for advertising or retargeting, and never use it to train AI models. People at Kabsi read it only with your consent, to keep Kabsi secure, or when the law requires it. The only others who receive it are the service providers in section 6 that help us run Kabsi.
• Kabsi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.
• Kabsi's access to Google is held on our servers only. It never reaches your browser or anyone else's, and Kabsi does not store a Google token of yours. We never ask for your Google password or a verification code.
• To disconnect Kabsi from Google, open Settings in Kabsi and choose Disconnect Kabsi from Google; only the signed-in owner can do it. Kabsi stops at once: no new drafts, no review emails and nothing more sent to Google. Approvals still waiting are cancelled, open review tasks are closed and email links stop working. Kabsi then removes its own Manager access and emails you a confirmation with how to check it under People and access. If Google does not let Kabsi remove itself, our team removes it within 7 business days of your request and we tell you the date.
• You can also remove Kabsi yourself, without asking us. On your Business Profile open Menu (or More), then Business Profile settings, then People and access, select Kabsi Clients and choose Remove person. Kabsi stops reading and posting at once.
• Disconnecting does not change your ownership of the profile or your reviews on Google. Google data Kabsi kept is deleted 30 days after access ends, unless access comes back.

5. How drafts are written

• Review text and your business facts are sent to Anthropic's API to draft replies and posts. Anthropic does not use this data to train its models. Photos are checked by Kabsi's own code and are not sent to an AI model.
• From launch, to see what AI assistants say about your business, Kabsi sends questions in your customers' words that name your category and area (for example "best dentist in Jumeirah") to DataForSEO, which asks ChatGPT and Perplexity for them. The answers change from run to run, so Kabsi shows them as a sample and never as a promise.
• For posts, Kabsi may also use your category and area, phrases from your reviews and, once connected, the search terms Google reports for your profile.
• A person, you, approves every reply, post, photo and listing change before it's published. Kabsi makes no automated decisions that have legal or similarly significant effects on anyone.
• We never put a reviewer's personal details into a reply.

6. Who helps us (processors)

"From launch" marks a company that starts handling data when the feature that uses it is switched on. We list it now so this page is complete before that day.

• Supabase: database, sign-in and file storage, in Frankfurt, Germany.
• Cloudflare: card and review links (go.kabsi.co), the bot check on our forms, and R2, where our encrypted backups are kept.
• GitHub: keeps our code and runs the weekly backup. The backup is encrypted before it leaves that job, with a passphrase only Kabsi holds.
• Vercel: hosting the website and app, and Speed Insights, which measures how fast pages load for visitors without cookies or any identifier.
• Creem: card payments. Creem is our merchant of record and receives what it needs to take a payment.
• Resend: sending email, through Amazon's EU (Ireland) region.
• Anthropic: drafting replies and posts. Review text and your business facts reach Anthropic only for this.
• Google: the Business Profile and Places APIs.
• From launch, DataForSEO: Google Maps results and AI answers for the keywords you confirm (sections 2 and 5).
• From launch, Geoapify: the map pictures, from map points only.
• From launch, Meta, for the Meta Pixel and the Conversions API: measuring which of our ads bring owners (section 7).
• PayPal: only if you are a Kabsi Partner and choose it to be paid. Partners paid in USDT or USDC are paid from Kabsi's own wallet and no company receives your data.
• Sentry: error reports, EU region, without IP addresses, review content or Google data.
• PostHog: anonymous usage statistics, in the United States.
• Zoho: the mailbox for hello@kabsi.co, which holds the messages you send us.

Some of these providers are outside the United Arab Emirates and the European Union, for example in the United States. They process data only on our instructions and under their data protection terms, including standard contractual clauses where the law requires them.

7. Cookies and similar storage

• Sign-in: your browser stores your session so you stay logged in. This is essential.
• Preferences: the app remembers which business you last opened, in your browser only.
• Your privacy choices: your browser remembers the choice you made, for 12 months, so we don't ask again. We keep a record of each choice (an anonymous id, the country and rule applied, the exact wording, the page and the time) as proof. It holds no IP address, email or name.
• Statistics: PostHog counts visits without cookies and without any identifier until you say yes. If you say yes, it also stores an anonymous identifier to see which pages are used, and may record screens on public pages, never inside the app and never with review text, names, email addresses or phone numbers. If you say no, it stops. IP addresses are anonymised.
• Where you came from: for the length of your visit, your browser keeps the campaign details in the link you arrived by (the utm fields), the first page you saw, the site that sent you and an ad click id (gclid or fbclid), with no cookie, and we save them with your account when you sign up, so we know which campaigns work. A Meta click id is kept only where your privacy choice allows advertising. If you came from a Click to WhatsApp ad, the click id of that chat is kept with the conversation.
• Referrals: a Kabsi link with a referral code (via=CODE) sets a first-party cookie, kabsi_via, for 60 days. If you follow another referral link, the newest one counts. When you sign up we save the code with your account and your business. It is not used for ads.
• Usage events: PostHog receives events such as "reply approved" or "post published" with ids, counts and channels only, never review text, names or email addresses. They pass through kabsi.co, and events about access, publishing and payment are sent from our servers. Nothing is sent for the demo workspace.
• Advertising: we use no advertising cookies today and don't track you on other sites. From launch, the Meta Pixel runs on our public pages only, never inside the app, the sign-up screens, the staff pages or the links in our emails. It sees page views and a few steps: the pricing page, a finished free scan, a sign-up, a trial and a plan bought. For a trial or a plan, Kabsi also tells Meta from its own servers (the Conversions API), with your email and phone number scrambled by a one-way hash as Meta requires. If you came from a Click to WhatsApp ad, Kabsi sends Meta the click id of that chat, so the ads learn which ones bring paying owners. In the EU, the UK, Switzerland, the United Arab Emirates and Saudi Arabia a small bar at the bottom asks once, Accept or Only necessary, and nothing for ads loads before you accept. Elsewhere there is no pop-up, and Your privacy choices has one switch, "Let Kabsi measure its ads", on or off. Your answer is remembered for 12 months. Kabsi does not sell your data to Meta or anyone else.
• You can change your choice any time with Your privacy choices, also at the foot of every page.

8. Agencies and partners

No agency or partner sees your business in Kabsi unless you invite them to your team in Settings, Team. They then see and do only what their role allows. Kabsi has no partner workspaces and no partner who can see your reviews, drafts, replies, photos or reports.

Kabsi Partners are different: they recommend Kabsi and are paid a share of what the businesses they bring pay. A partner sees the trade and area of a business that joined through their link, and counts of visits, scans, trials and payments, never its name, its reviews or its data. The one exception is a business that says yes, once, to "Can we tell Sara you joined?". A cancelled trial shows to the partner only as a count. The rules partners agree to are on the partner terms.

9. How long we keep it

One table sets these limits, and a job that runs every day applies it. Google's own content is never kept for more than 30 days.

Review text and reviewer name

30 days after Google last sent it to us

Why: Google's API policy

Review id, star rating, dates and reply state

While you use Kabsi

Why: Needed to run the reply workflow

Details of your profile that Google shows, as Kabsi read them

30 days

Why: Google's API policy

Facts and values you approved

While you use Kabsi; deleted when you delete the business

Why: They are your own data

Google's performance figures, such as rating snapshots

30 days; fetched again when needed. The calls, clicks, views and search terms in Insights are read when you open the screen and are not stored. The customer activity and search terms in a Weekly Care Report copy are dropped after 30 days

Why: Google's API policy

Reply drafts and the exact text sent to Google

Cleared together with their review

Why: They are linked to Google content

Photos you upload to Kabsi

The file is deleted 30 days after the photo is on Google, or soon after you skip it

Why: Not needed once Google has it

The record of approvals and changes (who did what and when)

24 months; the details are blanked as in the rows above

Why: Proof of what you approved

The log of emails we sent you

12 months

Why: Settling delivery disputes

Conversations with Nora, the assistant

12 months

Why: Support

Google data of a business whose access was removed

Deleted 7 days after the business leaves Kabsi, unless access comes back

Why: Google's API policy

Also:

• Your business data: while you use Kabsi. If you ask us to delete a business (Settings, or by email), everything is deleted 7 days later, and you can cancel before then.
• Quotes in weekly reports sent before 4 October 2026 are removed after 30 days. Newer reports carry no review quotes. Your business category and area, read from Google, are refreshed at least every 30 days. Your business name and address are kept while your account exists (section 2).
• Contact details you gave Nora: until you ask us to remove them. News emails stop the moment you unsubscribe.
• Visibility and AI answer results, and the competitors you pick (from launch): while you use Kabsi, and deleted with the business.
• WhatsApp voice notes (from launch): the audio is deleted as soon as it has been turned into text. We keep only the text, like any other message. Notes over 10 MB or 3 minutes are refused and never stored.
• Backups: encrypted copies of the database, the photos and our code are kept for 21 days in Cloudflare R2, then deleted. Supabase also keeps its own short-lived backups. A business you delete stays in older backups until they expire, at most 21 days, and is never restored into the live service afterwards.
• Internal job logs: 90 days.
• Email action links: they work once, expire after 72 hours and are removed 30 days after that.
• Payment records: as long as tax and accounting law requires, with the business link removed when the business is deleted.
• Card and link taps: kept without personal data, for counts.
• Free tool abuse limits: 1 hour. The free Profile Check keeps its daily limit for 1 day.
• Google's public details for a business you checked: not kept, read from Google each time. Your email request for the check, with your choice about tips: until you ask us to remove it.

10. Your rights

You can ask to see the personal data we hold about you, correct it, delete it, receive a copy in a common format, or object to how we use it. You can do most of this in the app. For anything else, email hello@kabsi.co from the address on your account and we reply within 30 days. To get a copy of your data, ask by email: we send you a file you can open in a spreadsheet or a browser within 30 days, covering your business, your reviews and replies, your posts, your settings and your messages with us. If you think we got something wrong, you can also complain to the data protection authority where you live.

If you left a review for a business that uses Kabsi and have a question about it, contact us and we'll help, together with that business.

11. Deleting your data

In Settings, choose Delete this business (you have 7 days to change your mind), or email hello@kabsi.co from your account email. We delete the business's reviews, drafts, posts, photos, reports and settings, and confirm by email. Older backups hold a copy until they expire, at most 21 days later (section 9). To stop Kabsi reaching your Google profile, disconnect Kabsi as described in section 4. To delete your login as well, say so in your email.

12. Security

Data is encrypted in transit. Each business's data is separated at the database level so only its members, and Kabsi staff when helping you, can read it. Email action links work once, expire after 72 hours, belong to the person they were sent to and are stored only as a hash. Profile changes and reviews that need care also need that person signed in. More detail is on the security page. Access to Google and to our providers is held on our servers and limited to what Kabsi needs.

13. Children

Kabsi is for businesses and is not meant for anyone under 18.

14. WhatsApp

Kabsi has no WhatsApp number at the moment. Write to hello@kabsi.co and a person at Kabsi answers. We never ask for your Google password or a code Google sends you, by email or anywhere else. If you wrote to Kabsi's earlier WhatsApp number before 22 October 2026 and want that chat deleted, email hello@kabsi.co from the address on your account and we tell you when it is done.

When Kabsi has a WhatsApp number, you can also send a voice note. The audio is turned into text by a speech to text provider, deleted as soon as the text is ready, and only the text is kept.

15. Changes

If we change this policy in a way that matters, we email account holders before the change applies. The date at the top shows the latest version.