Privacy Policy

PRIVACY POLICY

1. Introduction

This Privacy Policy explains how Kafy For Information Technology LLC, a limited liability company incorporated in the Kingdom of Saudi Arabia under Commercial Registration number [CR NUMBER], trading as Kafy (“Kafy,” “we,” “us,” or “our”), collects, uses, stores, shares and protects personal data.

This Privacy Policy applies to:

• the Kafy website at kafy.io
• the Kafy web application and related mobile or desktop interfaces
• accounts, workspaces and subscriptions created through Kafy
• customer support, sales, onboarding and training
• product notifications and service communications
• email, SMS, WhatsApp and other electronic communications
• integrations, APIs and connected third-party services; and
• any other service that links to this Privacy Policy.

Our registered address is:

Kafy For Information Technology LLC
Kingdom of Saudi Arabia

2. Our roles under data-protection law

Depending on the circumstances, Kafy may act as:

2.1. Data controller

Kafy acts as a controller when we determine why and how personal data is processed, including account registration, subscription administration, billing, fraud prevention, security, support, website analytics and our own marketing.

2.2. Data processor

Kafy generally acts as a processor when a business customer uploads, creates or manages personal data inside its Kafy workspace, including data relating to the customer’s clients, employees, contractors, leads, suppliers or other contacts.

In that situation:

the workspace owner or subscribing organization is the controller;
Kafy processes the data according to the customer’s instructions and the applicable agreement;
users should first direct requests concerning workspace data to the relevant workspace owner; and
Kafy may assist the workspace owner in responding to legally valid requests.
3. Personal data we collect
3.1 Account and identity information

We may collect:

• full name
• business name
• email address
• telephone number
• country and city
• preferred language
• profile image
• job title
• password-related authentication records
• account identifiers
• verification status
• workspace memberships
• roles and permissions; and
• login, password-reset and invitation records.

We do not store passwords in readable form. Authentication credentials are processed through our authentication service providers using secure password-management methods.

3.2. Company and workspace information

We may collect:

• company name and business type
• company size and industry
• Commercial Registration and VAT information
• address and contact information
• branding and logo
• currency and tax settings
• workspace configuration
• subscription plan
• team members and permissions
• onboarding progress; and
• service preferences.
• 3.3 Customer content

Depending on the modules used, customers may submit:

• customer and lead records
• names, emails, telephone numbers and addresses
• projects and assigned users
• tasks, notes and activity records
• quotations, invoices and payment records
• products and services
• sales and expense records
• supplier information
• employee and contractor information
• HR records entered by the customer
• tickets and support records
• uploaded files and attachments
• messages and communication history; and
• custom fields and other business information.

Customers are responsible for ensuring that they have a lawful basis and appropriate authority to upload and process this information through Kafy.

3.4. Financial and billing information

We may process:

• billing name and address
• subscription plan
• transaction reference
• amount, currency and tax
• invoice history
• payment status
• renewal and cancellation information; and
• limited payment-method metadata.

Full card details may be collected and processed directly by our payment processor or merchant-of-record provider. Kafy does not intend to store full card numbers or card security codes on its own servers.

3.5. Technical and usage data

We may automatically collect:

• IP address
• device and browser type
• operating system
• language and time zone
• login date and time
• approximate location derived from IP address
• pages and features used
• clicks, navigation and session activity
• error reports and diagnostics
• application performance
• referral source
• cookie identifiers; and
• security and audit logs.
• 3.6 Communications

We may retain:

• support requests
• emails
• WhatsApp conversations
• SMS communications
• sales calls and meeting notes
• survey responses
• feedback
• complaints; and
• records of marketing consent, opt-out and communication preferences.

Calls or meetings will not be recorded without appropriate notice where notice or consent is required.

3.7. Information from integrations

When a customer connects Kafy to another service, we may receive information from that service according to the customer’s settings and the third party’s authorization process.

Connected services may include:

• email providers
• calendars
• payment processors
• WhatsApp and communications platforms
• accounting or ERP systems
• e-commerce platforms
• analytics tools
• cloud-storage providers
• automation tools; and
• AI-service providers.

We access only the data reasonably required to provide the requested integration.

4. How we collect personal data

We collect personal data:

• directly from users
• from a workspace owner or administrator
• from forms, account registration and onboarding
• through use of Kafy
• through customer-support and sales interactions
• from connected integrations
• through cookies and similar technologies
• from payment providers
• from referral partners
• from publicly available business sources where legally permitted; and
• from authorized service providers.
• 5. Purposes and legal grounds for processing

We may process personal data for the following purposes:

5.1. Providing the service

To:

• create and manage accounts
• create and operate workspaces
• authenticate users
• assign roles and permissions
• process subscriptions
• provide Kafy modules and features
• synchronize connected integrations
• provide dashboards, reports and insights
• send operational notifications
• maintain records; and
• deliver customer support.
• 5.2 Performing our agreement

We process information necessary to provide the service requested by the customer, administer the subscription and meet our contractual obligations.

5.3. Consent

We may rely on consent where required, including for:

• optional marketing communications
• non-essential cookies
• certain direct-marketing activities
• optional integrations
• processing that requires explicit permission; and
• any other activity for which applicable law requires consent.

Users may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

5.4. Legitimate and lawful interests

Where permitted by applicable law, we may process data to:

• protect and improve Kafy
• prevent fraud and misuse
• secure accounts
• understand product usage
• maintain service quality
• manage business relationships
• establish or defend legal claims; and
• communicate with business customers about relevant services.

We will not rely on such interests where the rights of the individual override them.

5.5. Legal obligations

We may process and retain information to comply with:

• Saudi laws and regulations
• tax and accounting requirements
• court orders
• lawful government requests
• anti-fraud and anti-money-laundering obligations where applicable
• consumer-protection obligations; and
• data-protection and cybersecurity obligations.
• 6. Marketing communications
• 6.1 Channels

Where legally permitted and, where required, with consent, Kafy may send promotional or marketing communications by:

• email
• SMS
• WhatsApp
• telephone
• in-app message
• browser or mobile notification; and
• other electronic communication channels selected by the user.

Marketing may include:

• product updates
• new features
• discounts and offers
• trial and subscription promotions
• educational materials
• webinars and events
• partner offers
• surveys
• abandoned-registration reminders
• renewal opportunities; and
• other Kafy-related commercial communications.

Saudi regulations address unsolicited messages and calls, and direct marketing under the PDPL includes direct physical or electronic communications containing marketing material.

6.2. Consent and customer responsibility

A user may grant marketing permission by:

• selecting an opt-in checkbox
• subscribing to a newsletter
• submitting a marketing form
• requesting information or a demonstration
• selecting communication preferences
• starting a trial where the relevant notice is presented; or
• otherwise providing valid consent.

Workspace customers who use Kafy to send messages to their own contacts are solely responsible for:

• having a lawful basis to contact each recipient
• collecting valid consent where required
• keeping evidence of consent
• respecting opt-outs
• complying with WhatsApp, telecom and platform rules
• avoiding misleading sender identities
• not sending spam
• maintaining suppression lists; and
• complying with all applicable marketing and privacy laws.

Kafy does not grant customers the right to contact individuals without lawful permission.

6.3. Opting out

Recipients may opt out by:

• clicking an unsubscribe link
• replying “STOP” where supported
• changing communication preferences
• contacting privacy@kafy.io; or
• following the opt-out instructions in the communication.

We will process opt-out requests within a reasonable period and retain limited suppression information to ensure the person is not re-added unintentionally.

6.4. Operational communications

Opting out of marketing does not stop essential service communications, such as:

• verification emails
• password resets
• security notices
• billing notices
• subscription-renewal or cancellation confirmations
• changes to legal terms
• service outages
• workspace invitations
• project assignments
• compliance notices; and
• responses to support requests.
• 7. Artificial intelligence and automated features

Kafy may offer AI-assisted features such as:

• summaries
• business insights
• suggested KPIs
• suggested text
• automated categorization
• customer-service assistance
• document extraction; and
• workflow recommendations.

AI outputs may be incomplete, inaccurate or unsuitable for a particular purpose. Users must independently review outputs before relying on them.

Customers must not submit highly sensitive or confidential information to optional AI features unless they are authorized to do so and understand how the feature processes that information.

Kafy does not make legally binding, employment, medical, credit or similarly significant decisions solely through automated processing unless expressly disclosed and lawfully implemented.

8. Cookies and similar technologies

We may use:

8.1. Essential cookies

Required for:

• authentication
• security
• session management
• language preferences
• workspace selection; and
• core functionality.
• 8.2 Analytics cookies

Used to understand usage, errors and performance.

8.3. Preference cookies

Used to remember interface and account preferences.

8.4. Marketing cookies

Used only where legally permitted and, where required, after consent, to measure campaigns or personalize advertising.

Users may manage non-essential cookies through the available cookie controls or browser settings. Blocking essential cookies may prevent Kafy from functioning correctly.

9. How we share personal data

We may share data with:

9.1. Service providers

Including providers of:

• cloud hosting and databases
• authentication
• email delivery, including Resend
• business email
• payment processing
• analytics and monitoring
• communications
• customer support
• file storage
• cybersecurity
• backups
• AI services
• accounting; and
• professional advice.

Service providers may process data only for agreed services and subject to appropriate contractual or legal safeguards.

9.2. Workspace owners and administrators

Workspace owners and authorized administrators may access and manage data associated with their workspace, including user identity, activity, roles, permissions and customer content.

Users should not expect personal privacy from their employer or workspace administrator regarding business data entered into a company-controlled workspace.

9.3. Connected third parties

When a user enables an integration, information may be exchanged with the selected provider. The third party’s own privacy terms apply to its processing.

9.4. Legal and regulatory disclosures

We may disclose information where reasonably necessary to:

• comply with law
• respond to a lawful authority
• enforce our agreements
• investigate fraud, misuse or security incidents
• protect individuals or property
• establish, exercise or defend legal claims; or
• complete a corporate transaction.
• 9.5 Corporate transactions

If Kafy is involved in a merger, acquisition, financing, restructuring or sale of assets, information may be transferred subject to confidentiality and applicable law.

We do not sell personal data as a stand-alone commercial product.

10. Cross-border data transfers

Kafy and its service providers may process data in Saudi Arabia or other countries.

Where personal data is transferred outside Saudi Arabia, we will take measures required by applicable law, which may include:

• verifying an applicable transfer basis
• using contractual safeguards
• assessing the destination and recipient
• limiting the data transferred
• applying security controls; and
• obtaining approvals where required.

Customers must not configure integrations or exports in a way that violates applicable data-transfer restrictions.

11. Data retention

We retain information only for as long as reasonably necessary for:

• providing the service
• maintaining the account
• meeting contractual obligations
• security and fraud prevention
• dispute handling
• backups
• tax and accounting requirements
• regulatory compliance; and
• establishing or defending legal claims.

Typical retention principles include:

• active account data: for the subscription duration
• customer content: while the workspace remains active and for a limited post-termination period
• billing and tax records: for the legally required period
• security logs: for a reasonable security period
• support communications: for service, quality and legal purposes
• marketing-consent records: while relevant and for a reasonable evidentiary period
• suppression records: as needed to honor opt-outs; and
• backups: until overwritten according to backup schedules.

After termination, customers should export necessary data before the account closes. Data may be deleted, anonymized or rendered inaccessible after the applicable retention period.

12. Security

We use reasonable administrative, technical and organizational safeguards, which may include:

• encryption in transit
• access controls
• multi-tenant workspace separation
• authentication controls
• role-based permissions
• logs and monitoring
• backups
• secure development practices
• vendor review; and
• incident-response procedures.

No online system is completely secure. Customers remain responsible for:

• strong passwords
• protecting devices
• managing workspace permissions
• promptly removing former users
• reviewing integrations
• maintaining lawful backups or exports where appropriate; and
• reporting suspicious access.

Security concerns may be reported to security@kafy.io.

13. Personal-data breaches

If we become aware of a personal-data breach, we will investigate and take reasonable containment and remediation measures.

Where required by applicable law, we will notify the relevant authority and affected individuals within the legally required period.

Customers must promptly notify Kafy of suspected misuse or compromise affecting their workspace.

14. Your data-protection rights

Subject to applicable law and exceptions, individuals may have the right to:

• be informed about processing
• access personal data
• obtain a copy in a clear format
• request correction or completion
• request destruction or deletion
• withdraw consent
• object to certain direct marketing
• request restriction where applicable
• submit a complaint; and
• exercise other rights available under applicable law.

Requests may be sent to privacy@kafy.io.

We may need to verify identity before completing a request. Where Kafy processes data only on behalf of a business customer, we may direct the request to that customer or assist it in responding.

15. Workspace customer obligations

Customers must:

• provide legally required privacy notices
• identify a lawful basis for processing
• obtain necessary consents
• collect only necessary data
• maintain accurate data
• apply appropriate permissions
• respond to data-subject requests
• delete data when no longer needed
• avoid uploading prohibited data
• supervise authorized users
• report incidents; and
• comply with applicable privacy, employment, marketing and communications laws.
• 16. Children

Kafy is intended for businesses and authorized adult users. It is not directed to children.

Users must not create accounts for children or upload children’s personal data unless they have lawful authority and appropriate safeguards.

17. Third-party links

Kafy may contain links to third-party websites or services. We are not responsible for their privacy practices, content or security. Users should review the third party’s own policies.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• legal or regulatory changes
• service changes
• new features
• security practices; or
• business requirements.

Material changes may be communicated by email, in-app notice or website notice. The updated version will apply from the stated effective date.