At Kabiri, we are committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR). This page explains how we comply with GDPR and outlines the rights available to you as a data subject.
1. Data Controller & Data Protection Officer
Kabiri acts as the data controller for the personal data we collect through our website at kabiri.co and associated services. This means we determine the purposes and means of processing your personal data.
The data controller is Kabiri Workspace Limited, a company registered in England and Wales (Company No. 17140110), with its registered office at Bartle House, Oxford Court, Manchester, England, M2 3WQ. We are registered with the Information Commissioner's Office (ICO) under registration number ZC211063.
Our Data Protection Officer (DPO) can be contacted at privacy@kabiri.co for any data protection enquiries, subject access requests, or to exercise your rights under GDPR.
2. Lawful Basis for Processing
We process your personal data only when we have a lawful basis to do so under Article 6 of the GDPR. The bases we rely on include:
- Consent: Where you have given us clear, informed consent to process your personal data for a specific purpose (e.g. joining our waitlist, receiving marketing emails).
- Contractual Necessity: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract (e.g. providing the Service once you create an account).
- Legitimate Interests: Where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms (e.g. improving our website, ensuring security).
- Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.
3. Your Rights Under GDPR
If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:
- Right of Access: You have the right to request a copy of the personal data we hold about you.
- Right to Rectification: You have the right to request that we correct any personal data that is inaccurate or incomplete.
- Right to Erasure: You have the right to request that we delete your personal data, subject to certain conditions (also known as the "right to be forgotten").
- Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
- Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
- Right to Object: You have the right to object to the processing of your personal data where we are relying on legitimate interests as the lawful basis.
- Right to Withdraw Consent: Where we rely on consent as the lawful basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact our Data Protection Officer at privacy@kabiri.co. We will respond to your request within 30 days.
4. Data We Collect
For a detailed breakdown of the personal data we collect and how we use it, please refer to our Privacy Policy. In summary, we may collect:
- Email address (when you join the waitlist or create an account)
- Name (when you register for the Service)
- Usage data (IP address, browser type, pages visited)
- Cookie data (see our Cookie Policy)
- Data from services you connect, such as your email, calendar, files and tasks (see "Google user data" in our Privacy Policy)
- The name and email address of someone who sends files through a Kabiri user's file request, the names, sizes and types of the files and when they were sent, and a one-way hash of their IP address (see "File requests" in our Privacy Policy)
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:
- Waitlist data: Retained until the Service launches and you are invited, or until you request removal.
- Account data: Retained for the duration of your account. Upon account deletion, all associated personal data is permanently deleted within 30 days, or straight away if you choose immediate erasure, except as set out in our Privacy Policy.
- File requests: The record of who sent which files through a request is kept while the request exists, and deleted with the request or with the requester's account. The files themselves are never stored by Kabiri: they go straight to the requester's own storage.
- Analytics data: Aggregated and anonymised data may be retained indefinitely for statistical purposes.
6. Data Transfers
Your personal data may be transferred to and processed in countries outside the EEA or the United Kingdom. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. The processors we rely on and the safeguards that apply are:
- Google Cloud Platform / Firebase (storage, authentication, infrastructure) - our application servers and database are pinned to the europe-west2 (UK) region. Any onward transfers are covered by Google's Standard Contractual Clauses and UK Addendum.
- Google Gemini API (Kabiri Assistant) - the Gemini API is a global Google endpoint, so individual requests may be processed on Google infrastructure outside the UK / EEA. These transfers are covered by Google's data processing terms and Standard Contractual Clauses, and the data is not used to train Google's models.
- Stripe (payment processing) and SendGrid (transactional email) - transfers are covered by Standard Contractual Clauses and the UK Addendum where data leaves the UK / EEA.
Services you connect yourself are different: they are not our processors, and data moves between Kabiri and them only because you asked it to. For example, if you connect Canva to the optional dashboard widget, Kabiri requests your designs' details from Canva Pty Ltd, which is based in Australia and runs a global service, and sends Canva only what it needs to answer - your connection and anything you type into the widget's search box. Canva handles your Canva account under its own terms and privacy policy, and Kabiri stores no design content. See the Canva section of our Privacy Policy. Instagram and Facebook are similar: if you connect them, Kabiri reads your Pages' and Instagram account's figures and recent posts from Meta Platforms Ireland Ltd when they are shown or asked about, stores none of them, and never posts anything. See the Instagram and Facebook section of our Privacy Policy. Notion is similar: if you connect your Notion workspace, Kabiri reads the pages you chose on Notion's consent screen from Notion Labs, Inc., the US company that makes Notion, when you search them, ask the Kabiri Assistant about them or bring them into Notes, and sends Notion only your connection and the words you search for. Kabiri stores no Notion pages, apart from the notes you choose to bring in, and changes nothing in your Notion workspace except, on Premium, a page you choose to save there and the rows of databases you choose to sync with Kabiri projects. See the Notion section of our Privacy Policy. Todoist works the same way: if you connect Todoist, Kabiri receives task data from across your Todoist account from Todoist Inc., the US company that makes Todoist and keeps its data in the United States, to find the changes to the projects you sync. Kabiri keeps only those projects, and sends Todoist Inc. only the changes made to their tasks and comments in Kabiri, because you asked it to. To show who a synced task is assigned to, Kabiri also keeps the names and email addresses of the people in that project on its servers only, and uses the email addresses just to tell whether someone is you or one of your Kabiri teammates. The comments on synced tasks are kept in step both ways, including those written in Todoist by people who don't use Kabiri: Kabiri keeps their text and their authors' display names (never an email address) with the task, shows them only to people who can see the project, and shows attachments as links into Todoist without copying them. See the Todoist section of our Privacy Policy. With alerts on (Settings > Notifications), Kabiri also checks each task app you connect about every 5 minutes for what mentions you, is assigned to you or has a new comment on something of yours, synced into Kabiri or not, and keeps a short alert (who, what kind, which item and where, never the comment's text) for 30 days. Asana works much the same way: if you connect Asana, Kabiri receives the list of your Asana workspaces and projects, and the tasks in the projects you choose to sync, from Asana, Inc., the US company that makes Asana and keeps its data in the United States unless your organisation has chosen another region. Kabiri keeps only those projects, and sends Asana, Inc. only the changes made to their tasks and comments in Kabiri, because you asked it to. As for Todoist, the names and email addresses of the people named on those tasks are kept on Kabiri's servers only, to tell whether someone is you or one of your Kabiri teammates, and comments and attachments are handled the same way. Kabiri is the controller of that copy, independently of Asana, Inc., so our policies cover it and the Asana Privacy Statement does not. See the Asana section of our Privacy Policy. Jira syncs both ways too (since 2 November 2026; it came in read-only before). If you connect Jira, Kabiri receives the list of your Jira sites and projects, and the issues in the projects you choose to sync, from Atlassian, which makes Jira and hosts Jira Cloud data in the United States unless your organisation has chosen another region. Kabiri keeps only those projects, as a copy it keeps up to date, and sends Atlassian the changes you and your team make to them in Kabiri, as you: creating, editing, moving, commenting on and deleting their issues. A connection made before 2 November 2026 stays read-only until you reconnect and agree to two-way syncing. As for Asana, Kabiri keeps the names and Atlassian account ids of the people named on those issues, and their email addresses when their Atlassian profiles show them, on Kabiri's servers only, to tell whether someone is you or one of your Kabiri teammates; the email addresses are never shown in the app. Atlassian requires Kabiri to report those account ids every 7 days, so that when someone closes their Atlassian account Kabiri erases their name and email address. When a project stops syncing or Jira is disconnected, the tasks Kabiri keeps no longer hold Jira people's names or ids. Kabiri is the controller of that copy, independently of Atlassian, so our policies cover it and Atlassian's privacy policy does not. See the Jira section of our Privacy Policy. Linear works the same way as Jira, with one difference: Linear has no way to report closed accounts. If you connect Linear, Kabiri receives the list of the teams and projects in your Linear workspace, and the issues in the projects you choose to sync, from Linear Orbit, Inc., the US company that makes Linear, so data you sync may be processed outside the UK / EU. Kabiri keeps only those teams, as a copy it keeps up to date, and sends Linear the changes you and your team make to them in Kabiri, as you. A connection made before 2 November 2026 stays read-only until you reconnect and agree to two-way syncing. Kabiri keeps the names and Linear user ids of the people named on those issues, and their email addresses when their Linear profiles show them, on Kabiri's servers only, to tell whether someone is you or one of your Kabiri teammates; the email addresses are never shown in the app. When a project stops syncing or you disconnect Linear in Kabiri, the tasks Kabiri keeps no longer hold Linear people's names or ids, and Kabiri deletes the stored tokens. If Kabiri is removed in Linear instead, Kabiri stops syncing and deletes the stored tokens and its list of people, and the tasks keep those names until you stop syncing the project. Kabiri is the controller of that copy, independently of Linear Orbit, Inc., so our policies cover it and the Linear privacy policy does not. See the Linear section of our Privacy Policy. ClickUp syncs both ways too, with one difference from Jira and Linear: its tasks never stay behind. If you connect ClickUp, Kabiri receives the spaces, folders and lists in the ClickUp workspaces you let it reach, and the tasks in the lists you choose to sync, from Mango Technologies, Inc., the US company that makes ClickUp, so data you sync may be processed outside the UK / EU. Kabiri keeps only those lists, as a copy it keeps up to date, and sends ClickUp the changes you and your team make to them in Kabiri, as you, as well as setting up the webhooks that tell it when a synced list changes. A connection made before 2 November 2026 stays read-only until you reconnect and agree to two-way syncing. Kabiri keeps the names and ClickUp user ids of the people named on those tasks, and their email addresses when ClickUp shows them to apps, on Kabiri's servers only, to tell whether someone is you or one of your Kabiri teammates; the email addresses are never shown in the app. When a list stops syncing or you disconnect ClickUp in Kabiri, its tasks, their comments and that list of people are deleted from Kabiri (they stay in ClickUp), and Kabiri deletes the stored token. If Kabiri is removed in ClickUp instead, the sync pauses and asks you to reconnect; without a reconnect within 7 days, Kabiri deletes them all the same. Kabiri is the controller of that copy, independently of Mango Technologies, Inc., so our policies cover it and the ClickUp privacy policy does not. See the ClickUp section of our Privacy Policy.
The CRM apps work the same way as the task apps. If you connect HubSpot, Pipedrive, Zoho CRM or, once it ships, Salesforce, Kabiri receives the contacts, companies and deals (with their pipelines and stages) in the account you connect, from HubSpot, Inc. (United States), Pipedrive OÜ (Estonia, inside the EU; your company's data may be held in the EU or the US), Zoho Corporation (the data centre you chose when you signed up to Zoho) or Salesforce, Inc. (United States), so data you sync may be processed outside the UK / EU. Kabiri keeps them as a copy in your own Contacts that it keeps up to date, and sends the CRM the changes you make to those records in Kabiri, as you; the CRM stays the record. Kabiri holds your sign-in to each CRM sealed on its servers, never in the browser. When you stop syncing or disconnect a CRM in Kabiri, the records stay in your Contacts without the CRM's ids (or are deleted, if you ask), and Kabiri deletes the stored tokens; when you close your Kabiri account, Kabiri revokes its access at the CRM. Kabiri is the controller of that copy, independently of each CRM's provider, so our policies cover it and theirs do not. See the HubSpot, Pipedrive and Zoho CRM sections of our Privacy Policy.
File requests rest on the same principle: when someone sends files through a Kabiri user's file request, the files go from the sender's browser straight to the Google Drive, Dropbox or OneDrive account the requester connected, which Google, Dropbox or Microsoft holds under the requester's own terms with them, possibly outside the UK / EEA. Kabiri never stores the files; it keeps only the record of what was sent, in europe-west2. See the File requests section of our Privacy Policy.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews. For more details, see our Privacy Policy.
8. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
9. Supervisory Authority
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk.
10. Contact Us
If you have any questions about our GDPR compliance or wish to exercise your data protection rights, please contact our Data Protection Officer at privacy@kabiri.co.