Privacy Policy

This Privacy Policy explains how KabData (“KabData”, “we”, “us”) collects and uses personal data when we operate the KabData websites and business-to-business software platform (together, the “Service”).

The intended controller is the company being incorporated in the Republic of Cyprus under the intended name KabData. Before this Policy becomes effective, its full registered legal name, Cyprus registration number, registered office, and effective date will be inserted here. Its current correspondence address is Cyprus, Cyprus, and its team operates from Cyprus and Israel.

1. When this policy applies

This policy applies when we decide why and how personal data is processed, for example when we:

• manage KabData user accounts and organisations;
• operate, secure, monitor and support the Service;
• communicate with customers, prospective customers and users;
• administer subscriptions, contracts and legal compliance; or
• analyse product reliability using information that identifies an account or user.

Customers also use KabData to import and process data from AppsFlyer and other services. For that Customer Data, the customer generally decides the purpose and means of processing and is the controller (or equivalent under applicable law), while KabData acts as its processor/service provider. Our Data Processing Addendum governs that processing. If your personal data appears in Customer Data, please contact the relevant customer first; we will assist that customer with your request as required by law.

This policy does not govern a third-party website, application or service, even if it connects to KabData.

2. Personal data we collect

The information we collect depends on how you interact with the Service and which features your organisation enables.

2.1 Account and profile information

We may collect:

• name, business email address, password hash and email-verification status;
• company name, role, organisation memberships and permissions;
• contact name and email, additional business contacts, organisation description, website and business contact handles for Teams, Slack, LinkedIn or WeChat;
• notification preferences;
• two-factor authentication status, encrypted two-factor secret and encrypted recovery codes; and
• account-creation, update and deletion timestamps.

2.2 Organisation and commercial information

We may collect organisation name, branding and logo, account owner and administrators, invitation details, subscription/order information, communications and support records. When Stripe billing is activated after Provider's incorporation, Stripe will process checkout, recurring payments, invoices and payment recovery. KabData will receive billing contact, customer, subscription, invoice, payment-status and limited payment-method metadata, but is not intended to receive or store full payment-card numbers.

2.3 Integration and credential information

Depending on your organisation's configuration, we may collect:

• AppsFlyer app identifiers, API connection names and encrypted API tokens;
• encrypted AppsFlyer login email, password, TOTP secret and filtered browser-session data where the managed crawler is enabled;
• Microsoft tenant/client identifiers, sender email, encrypted client secret and refresh token, and Teams chat/channel identifiers;
• Slack workspace, team, bot and installer identifiers, scopes and encrypted bot access token;
• Telegram chat name/type, chat/thread identifiers and connecting Telegram user identifier;
• OAuth client, access-token metadata and last-used timestamps for the authenticated KabData MCP interface.

2.4 Customer and AppsFlyer data

At a customer's direction, the Service may import, derive and store:

• app, media-source, campaign, channel, ad, ad-set, publisher and sub-parameter identifiers;
• clicks, impressions, installs, conversions, in-app events, event timestamps, revenue, ROI and payout information;
• country/region information and attribution metadata;
• Protect360 fraud, rejection and blocking signals;
• publisher permission values, token assignments, tracking links, deals, caps and wishlists; and
• raw report fields supplied by AppsFlyer, which may include pseudonymous device or advertising identifiers, IP/device/network information, customer user identifiers, event values and other data selected or collected by the customer through its apps and AppsFlyer configuration.

The precise raw fields are controlled by the customer and AppsFlyer. Customers must not use KabData to import data they lack a lawful right to process.

2.5 Usage, device and security information

We may collect:

• IP address, browser user agent, session identifier and login/security events;
• pages, features, organisations and integrations accessed;
• request timestamps, status, duration, error and rate-limit information;
• sync, crawler, workflow, system-tool, notification and export activity;
• OAuth client details and access-token usage; and
• cookie, local-storage and interface preference values described in our Cookie Policy.

2.6 Communications

We process messages and attachments you send us, support requests, meeting notes, feedback and security reports. The public website wait-list/contact form collects your name, business email, company, selected publisher-count range, message, submission time and related request metadata. Optional fields may be left blank.

2.7 Information from other sources

We may receive personal data from:

• your employer, organisation administrator or another user who invites you, shares a token with you or lists you as a contact;
• customers and their AppsFlyer or other connected accounts;
• Microsoft, Slack, Telegram or another integration you enable;
• public app-store pages and public business sources; and
• service providers that help us prevent abuse or operate the Service.

3. How and why we use personal data

We use personal data for the following purposes:

| Purpose | Typical data | GDPR/UK GDPR legal basis where applicable | | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | Create and administer accounts, organisations, roles and subscriptions | Account, profile, organisation and commercial data | Contract; steps requested before a contract; legitimate interests in providing a B2B service | | Provide dashboards, imports, exports, tracking links, deals, caps, notifications, automations and integrations | Customer Data, integration data and settings | Customer's instructions under the contract; for our own account data, contract and legitimate interests | | Authenticate users and protect the Service | Credentials, 2FA, session, IP, user agent, logs and activity | Contract; legal obligations; legitimate interests in security, fraud prevention and enforcing terms | | Provide support and communicate about the Service | Contact, account, support and diagnostic data | Contract; legitimate interests in customer service and product administration | | Maintain reliability, debug and improve functionality | Usage, performance, error and limited Customer Data needed to reproduce a problem | Contract; legitimate interests in maintaining and improving the Service, balanced against user rights | | Send service and security notices | Email, account, organisation and security information | Contract; legal obligation; legitimate interests in secure administration | | Send marketing communications to business contacts | Business contact details and preferences | Consent where required; otherwise legitimate interests, subject to direct-marketing law and the right to object | | Comply with law and protect legal rights | Relevant account, transaction, communication, security and Customer Data | Legal obligation; legitimate interests in legal claims and protecting persons, property and the Service |

Where we rely on legitimate interests, we consider whether our interest is necessary and proportionate and whether your rights override it. You may object as described below.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

Providing mandatory account fields is not generally required by statute, but without them we cannot create or secure an account or provide the requested Service. Fields marked optional may be left blank. We use the information for the purposes described above and disclose it to the types of recipients described below. Where Israeli law applies to collection in Israel, the same explanation is intended to provide the notice required for those fields.

4. How we disclose personal data

We may disclose personal data to:

4.1 Your organisation and authorised users

Organisation owners and administrators can manage membership, roles, integrations and Customer Data. Members and publishers see information permitted by their role and assigned data dimensions. If you join more than one organisation, each organisation controls its own workspace; your global profile may be visible where needed to administer membership.

4.2 Service providers and subprocessors

We use vendors for hosting, database/compute operations, content delivery, object storage, deployment, email, website forms, security and other business operations. They may process personal data only to provide contracted services and must be subject to appropriate confidentiality and data-protection terms. The current operational list is maintained on our Subprocessor page.

Production and planned services include:

• Hetzner for application/worker compute and PostgreSQL hosting in Germany;
• Cloudflare for network delivery/security, managed AppsFlyer onboarding email routing/queues and R2 object storage; the current R2 bucket uses an Eastern Europe (EEUR) location hint rather than a guaranteed EU jurisdiction, and KabData does not promise EU-only R2 storage;
• Zoho Mail for hosted business email and, after the planned SMTP migration, transactional emails sent by the Service; the Zoho account region and contracting entity still require verification;
• SMTP2GO for transactional application email during the transition to Zoho; it must remain disclosed if it is still in use when this policy becomes effective and may be removed after migration and data-deletion obligations are complete;
• Stripe, once activated after Cyprus incorporation, for subscription checkout, recurring billing, invoices, payment recovery and the billing portal;
• Laravel Forge for server provisioning/deployment operations, infrastructure metrics, health checks and job monitoring;
• Netlify, where the configured public-website form is used, for website delivery and form handling;
• no separate error-reporting, product-analytics, CRM or customer-support platform is currently known to be used; and
• professional advisers and support providers where necessary.

4.3 Customer-enabled Third-Party Services

At your organisation's direction, we disclose relevant data to:

• AppsFlyer for requests made against the customer's AppsFlyer account;
• Microsoft Teams/Microsoft Graph for connected chat discovery and notifications;
• Slack for workspace/channel discovery and notifications;
• Telegram for chat connection and notifications; and
• Apple App Store or Google Play sources for public app metadata lookups.

Your organisation decides whether to connect these services. Their own terms and privacy policies apply to their processing.

4.4 Corporate events

We may disclose information to an actual or prospective investor, buyer, lender or adviser in connection with financing, restructuring, merger, acquisition or sale, subject to appropriate confidentiality and, where required, notice.

4.5 Legal and safety disclosures

We may disclose information where we reasonably believe it is necessary to comply with law or legal process; protect rights, safety or property; investigate fraud or abuse; or establish, exercise or defend legal claims. Where lawful, we will seek to notify the affected customer before disclosing Customer Data and will disclose only what is required.

We do not sell personal data or share it for cross-context behavioural advertising.

5. International data transfers

Provider is intended to be incorporated in Cyprus, an EU Member State, and to operate with personnel in Cyprus and Israel. Once incorporated, personal data available to KabData personnel in Israel may be transferred from Cyprus or another EEA country to Israel. The European Commission currently recognises Israel as providing adequate protection for relevant personal-data transfers, so a covered transfer may rely on that adequacy decision.

Our infrastructure and optional vendors may process data in other countries. Before publication, we will identify the actual hosting and vendor locations. Where a transfer requires additional protection, we will use an appropriate mechanism, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, an adequacy regulation/decision, and supplementary measures where appropriate.

Transfers from Cyprus or elsewhere in the EEA will be made under the EU GDPR. Transfers from Israel will be made in accordance with Israel's Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761–2001, where applicable. You may contact us for information about the relevant safeguard.

6. Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose, including to provide the Service, comply with law, resolve disputes and enforce agreements. Retention may be extended for a documented legal hold or shortened on valid instruction.

Our retention schedule is:

| Data | Typical retention/trigger | | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User account and profile | While the account is active; deleted on valid account deletion, subject to shared business records, security, legal and backup requirements | | Organisation Customer Data | For the subscription and a 30-day post-termination export window; deletion from active systems is intended within the following 30 days, subject to law and verified launch controls | | Generated CSV export files and export rows | 7 days | | AppsFlyer API request logs | 14 days | | Crawler logs | 30 days | | Crawler test visual artifacts | 24 hours by default | | Crawler test audit rows | 30 days by default | | AppsFlyer onboarding inbound receipts | At least 30 days, subject to configured anti-replay retention | | AppsFlyer sync logs | 90 days, while the newest successful record per connection/app may be retained longer for sync continuity | | Raw in-app event data in the live database | Current month plus four full calendar months by default, after which completed monthly partitions may be archived | | AppsFlyer raw data, including R2 archives | Rolling maximum of 12 months from the relevant event date during an active subscription; after termination, deletion within the active-system period described below | | Failed background jobs | 30 days | | Web sessions | 120 minutes of inactivity by default; a “remember me” login may persist longer | | Contract, invoice and legal records | At least six years where required for Cyprus VAT records, and longer where another tax, accounting, legal-hold or claims period applies | | Hetzner Cloud Backups | Created daily in the EU with seven rolling backup slots; data ordinarily ages out within seven daily backup cycles after active deletion. Encryption at rest is not currently confirmed |

Some records may remain in de-identified form. A customer controls deletion in its connected Third-Party Services.

7. Security

We use technical and organisational measures intended to protect personal data, including:

• logical tenant separation and tenant-scoped access controls;
• role- and permission-based access, including publisher-level data filtering;
• encryption in transit;
• application-level encryption at rest for supported integration tokens, crawler credentials/TOTP/session data and two-factor secrets;
• password hashing, email verification, optional two-factor authentication and rate limiting;
• CSRF protection, signed/HTTP-only session cookies and session rotation;
• restricted, expiring exports and private object storage where configured;
• credential and sensitive-output redaction in crawler tooling; and
• retention jobs and deletion workflows for specified logs and artifacts.

No system is completely secure. You are responsible for choosing appropriate permissions, securing your devices and integration accounts and notifying us promptly of suspected compromise.

Security reports should be sent to [email protected]. Please do not include sensitive personal data or exploit data beyond what is necessary to explain the issue.

8. Your rights

Depending on where you live and the context, you may have rights to:

• receive information about processing;
• access personal data about you;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive portable data in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent at any time; and
• complain to a competent data-protection authority.

Israeli law provides rights to inspect personal data held about you in a database and request correction of information that is incomplete, unclear or inaccurate, subject to applicable law. Additional deletion and retention rights may apply to information transferred to Israel from the EEA.

Where a US state privacy law applies to KabData as a business/controller, residents may also have rights to know the categories and specific pieces of personal information processed, correct or delete information, receive a portable copy, opt out of covered sale, sharing or targeted advertising, limit certain uses of sensitive information, and appeal a refusal. In the preceding 12 months, the categories collected and disclosed for operational business purposes are those described in sections 2 and 4. KabData does not sell personal information, share it for cross-context behavioural advertising or use sensitive personal information to infer characteristics. We will honour a legally recognised authorised agent and applicable browser opt-out signal where the relevant law requires it.

To exercise a right or appeal a response, email [email protected]. The monitored support team will route privacy and security requests to the assigned internal owner. We may need to verify your identity and authority using information reasonably related to the request. If your request concerns Customer Data, identify the relevant customer/organisation; we may refer the request to that controller. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

These rights are not absolute. We may decline or limit a request where permitted by law and will explain the reason and available complaint route.

For EEA processing, you may complain to the supervisory authority where you live, work or believe an infringement occurred. KabData's Cyprus supervisory authority is the Office of the Commissioner for Personal Data Protection. For UK processing, you may complain to the Information Commissioner's Office. In Israel, you may contact the Privacy Protection Authority.

9. Automated decision-making

KabData includes customer-configured automations. KabData does not itself intend to make solely automated decisions about individuals that produce legal or similarly significant effects. Customers determine how they use reports, fraud indicators, caps, permissions and automations and are responsible for required notices, lawful bases, safeguards and human review.

If you believe a customer has used KabData to make a significant decision about you, contact that customer. We will assist it where required.

10. Children

The Service is a business platform and is not directed to children. Authorised Users must be at least 18 years old and able to enter a binding business agreement. Customers must not intentionally submit children's personal data unless Provider has expressly agreed in writing and all legal requirements are met. If you believe a child has provided account information, contact us.

11. Cookies and local storage

We currently use authentication, security and user-interface storage technologies, not third-party advertising cookies. Details, names and durations are in our Cookie Policy. If we introduce non-essential analytics or advertising technologies, we will update the policy and provide a consent choice where required before setting them.

12. Changes to this policy

We may update this policy as the Service, vendors or law changes. We will update the date above and provide additional notice of a material change where appropriate. If we need consent for a new purpose, we will request it.

13. Contact details

• Entity: KabData — Cyprus company under formation
• Full registered legal name: to be inserted after incorporation
• Cyprus registration number: to be inserted after incorporation
• Registered office: to be inserted after incorporation
• Current correspondence address: Cyprus, Cyprus
• Privacy, security and support contact: [email protected]

KabData has not currently designated a Data Protection Officer. We will document the Article 37 assessment and publish DPO contact details if a DPO is appointed.