Privacy Policy

Last Updated: July 2, 2026

Welcome to Kabiri ("we", "us", "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at kabiri.co (the "Site") and use our services (the "Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use the service.

1. Information We Collect

We may collect information about you in a variety of ways. The information we may collect includes:

• Account Data: When you create an account, we collect your name, email address, company or organisation name, timezone preference, and other profile information you provide during registration.
• Derivative Data: Information our servers automatically collect when you access the Site, such as your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the Site.
• Integration Data: When you connect third-party services (such as Gmail, Google Calendar, Google Drive, Dropbox, Slack, or other supported integrations), we access and process data from those services on your behalf. This may include emails, calendar events, files, contacts, and messages. This data is used solely to provide the Service and is not used for advertising or sold to third parties.
• Server-Side Search & Sync Index: To keep your unified inbox in sync across your devices, we store email metadata (sender, subject, a short snippet, timestamps, and labels) on our servers. On paid plans we additionally build a server-side search index so full-text search is fast and works on every device; this index holds search terms extracted from your messages and a short preview (up to roughly 300 characters) of each message body. This data is stored in our database in the UK / EU (europe-west2), used solely to provide search and sync, retained until you delete the message or close your account, and permanently erased when you delete your account.
• Usage Data: Information about how you use the Service, including features accessed, searches performed, and interactions with the Kabiri Assistant.
• Payment Data: If you subscribe to a paid plan, payment information is collected and processed by Stripe. We do not store your payment card details on our servers.
• Waitlist Data: If you sign up for our waitlist, we collect your email address and a timestamp of when you joined.
• Local Browser Storage: To make the Service fast and to let you read your inbox while offline, we cache a copy of your synced data - including email metadata and message bodies, calendar events, contacts, and attachments - in your browser's local storage (IndexedDB and localStorage) on each device you use. This cache lives only on your device and is not transmitted back to us. Clearing your browser's site data for kabiri.co (or signing out) removes it.

2. Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customised experience. Specifically, we may use information collected about you to:

• Provide, operate, and maintain the Service, including displaying your connected emails, calendars, files, and messages in the unified workspace.
• Power the Kabiri Assistant, which processes your queries and workspace data to provide smart suggestions, draft responses, and organise information on your behalf.
• Email you regarding your account, subscription, or waitlist status.
• Send periodic emails containing company news, updates, or related product information.
• Monitor and analyse usage and trends to improve your experience with the Service.
• Respond to enquiries and customer service requests.
• Comply with legal obligations.

Under UK GDPR we only process your personal data where we have a lawful basis to do so. The basis we rely on depends on the purpose:

• To provide and operate the Service (your account, connected emails, calendars, files, messages, and the Kabiri Assistant) — performance of a contract.
• To send marketing emails and process waitlist sign-ups — consent, which you can withdraw at any time.
• To secure the Service, prevent abuse, and analyse and improve usage — our legitimate interests in running and improving a safe, reliable Service, balanced against your rights.
• To meet our legal, tax, and accounting obligations — compliance with a legal obligation.

Email read receipts

Kabiri's email composer includes an optional read-receipt feature. It is off by default and only applies when the sender switches it on for an individual message. When enabled, the outgoing email contains a tiny invisible image; when the recipient's email app loads that image, we record that the message was opened.

• We record only an open count and the time of the most recent open. We do not store the recipient's IP address, device details, or location, and we do not share open data with anyone other than the sender.
• If you receive a tracked email, your email app may block the image automatically (most webmail services load images through a proxy or let you turn image loading off), which prevents or masks the receipt.
• We process this data on the basis of our users' legitimate interests in knowing whether important mail arrived, balanced against recipients' rights by keeping the data collected to the bare minimum. To ask about or object to this processing, contact privacy@kabiri.co.

3. Disclosure of Your Information

We do not sell, trade, or otherwise transfer your personal information to third parties except as described in this Privacy Policy or with your consent. We may share information with:

• Service Providers: We use third-party service providers to perform functions on our behalf, including:
  • Google Cloud Platform / Firebase for data storage, authentication, and infrastructure.
  • Google Gemini API to power the Kabiri Assistant. Queries and relevant workspace context are sent to the Gemini API to generate responses. Data sent to the Gemini API is processed in accordance with Google's data processing terms and is not used to train Google's models. While our application servers and database are pinned to europe-west2 (UK / EU), the Gemini API is a global Google endpoint and individual requests may be processed by Google infrastructure outside the UK / EU. Logs of assistant requests (used for rate-limiting and quota enforcement) are retained for up to 90 days; files you attach to an assistant turn are deleted from our storage within 30 days.
  • SendGrid for transactional email delivery.
  • LanguageTool to power the composer's optional grammar & style check. When the feature is enabled, the text you are composing is sent to LanguageTool to be checked and a list of suggestions is returned. LanguageTool is EU-based (Germany) and does not retain text submitted through its API. The feature is off-able in Email Settings; when it is off, nothing is sent.
  • Stripe for subscription billing and payment processing. Payment card details are handled entirely by Stripe and are never stored on our servers.
  • DocuSign for electronic signatures, when you choose to send a file for signature. The document and your recipients' names and email addresses are sent to DocuSign to create the signing request; DocuSign processes them under its own data processing terms. We store only a reference to each signing request and its status, not a copy of the signed document.
  These providers only have access to the information necessary to perform their functions and are obligated to maintain confidentiality.
• Connected Services: When you connect third-party services (Gmail, Google Calendar, Dropbox, Slack, etc.), data flows between Kabiri and those services via their official APIs. We only access the data necessary to provide the features you have enabled. You can disconnect any integration at any time from your account settings.
• Legal Requirements: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, or protect the safety of users or the public.

4. Security of Your Information

We use administrative, technical, and physical security measures designed to help protect your personal information. Your data is stored securely using Google Cloud Platform's Firebase suite. While we have taken reasonable steps to secure the personal information you provide, no security measures are perfect or impenetrable.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. When you delete your account, all associated personal data is permanently deleted within 30 days. Waitlist data is retained until you are invited to the Service or until you request removal. Aggregated, anonymised analytics data may be retained indefinitely for statistical purposes.

One exception: files and messages you have shared into a shared team or workspace conversation are part of that shared history that other members rely on, so they are not automatically removed when you delete your account. If you need shared content removed as well, contact our Data Protection Officer at privacy@kabiri.co and we will handle it in line with your rights and the legitimate interests of the other team members.

Cached data stored locally in your browser (see Section 1, "Local Browser Storage") is retained on your device until you clear your browser's site data for kabiri.co, sign out, or your browser evicts it under its own storage limits. Account deletion removes data on our servers; it does not reach into other devices to clear local caches there.

6. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by contacting our Data Protection Officer at privacy@kabiri.co. You can also export a copy of your data and permanently delete your account from your account settings within the app. For full details of your rights under GDPR, see our GDPR Compliance page.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

7. Children's Privacy

Kabiri is intended for professional and business use and is not directed at children. You must be at least 18 years old to use the Service. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact our Data Protection Officer at privacy@kabiri.co and we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically.

9. Contact Us

If you have questions about this Privacy Policy, please contact our Data Protection Officer at privacy@kabiri.co, or reach us at hello@kabiri.co.