Privacy Policy

1. Your data (the account owner)

• Account: your email, name, and profile photo if you sign in with Google, and your country and city if you add them.
• WhatsApp number (optional): if you add it, we use it to contact you about your account and about Labiq offers and news. You can delete it in Settings at any time.
• Business profile: business name, products and prices, current offer, logo, and anything you write about your business. Labiq writes from this.
• What you create: posts, images, videos, articles, ads and schedules.
• Connected accounts (Facebook Page, Instagram, WhatsApp, Telegram, ad account, your own email for campaigns): we store their access keys encrypted. That covers tokens, your Meta App Secret if you connect an ad account with your own token, and your email password if you connect it. Encrypted means stored so that nobody can read it without a key we hold. We use them only to publish, reply and renew the connection (the ad account connection is renewed automatically before it expires, and if Facebook does not allow it you will see a "reconnect" alert). We never display or share them, and they are deleted when you disconnect or delete your account.
• Usage: which tools you use, the balance used (posts / replies / videos), and the AI cost of each action. The cost is stored as numbers only, not your text.
• Payments: your card details never pass through us; Dodo Payments handles them. We keep the amount, status and reference. For InstaPay or bank transfer we keep the sender name, transfer reference and the receipt image you upload.

2. Your customers' data (people who contact your business)

When you use auto-replies, broadcasts, follow-ups or email campaigns, Labiq stores data about your customers:

• Their messages and your replies on WhatsApp, Messenger, Instagram and Telegram.
• Their names and numbers or handles, as the platform provides them.
• Emails you import or add, together with your confirmation that they agreed to hear from you.
• Comments on your posts, and people who left details through an ad or campaign link.

Who is responsible? You own this data and are responsible for it; we handle it only on your behalf (in legal terms, you are the "controller" and we are the "processor"). So you must have the right to contact these people and their consent to receive messages from you. We never use your customers' data for anything except your service: we do not sell it, contact them on our own behalf, or use it to train any AI. If one of your customers asks to be erased, email us and we will remove them (this is a manual request today).

3. Visitors who have not signed up

• Text typed into the homepage generator is sent to the AI to write the post. If you leave your email, we keep it to send you the result.
• To know which ad or link brought you, we set a small cookie (named lbq_src) for 90 days. It records the source name only, not who you are.

4. What we use data for, and on what basis

• To provide the service you asked for: writing, designing, publishing, replying and sending on your behalf, charging and refunding your balance, and sending login codes, payment confirmations and account alerts. (Basis: performing our contract with you.)
• To show the right price and payment method for your country, protect the service from fraud and abuse, and see what works from aggregated, anonymous counts. (Basis: legitimate interest.)
• To send Labiq offers and news. Stop them with the unsubscribe link in any email, or by deleting your number. (Basis: your consent.)
• To keep payment records as the law requires. (Basis: legal obligation.)

5. Who receives what (service providers)

Each provider receives only what it needs for its job:

• Anthropic (Claude): writes text, auto-replies, articles and analysis. Receives your input, your business profile, and the customer messages being answered.
• Google (Gemini): makes images, posters and video voice-over. Receives your description and your product photos if you upload them. Google also provides sign-in if you choose it.
• Replicate: runs third-party models for video (Kling), backgrounds (Flux) video captions (Whisper), and voice for some videos (MiniMax) when enabled. Receives the description and the images or video to be processed.
• Cloudinary: stores images, videos, logos and transfer receipt images.
• MongoDB Atlas: the database holding your account and everything above.
• Vercel: the servers the website runs on.
• Labiq's own server at Hetzner: runs WhatsApp QR sessions and video processing.
• Meta (Facebook / Instagram / WhatsApp / Ads): we publish, reply and run ads on your own accounts. Meta sees the content and messages like anything else on its platform.
• Telegram: if you connect a bot.
• Dodo Payments: card payments. Receives your card details directly, not through us.
• Brevo: sends Labiq's own emails (login codes, payment confirmations, account alerts, weekly reports, Labiq news, and the result email for visitors who asked for it on the homepage). Email campaigns to your customers are sent from your own email account that you connect.
• ipapi.co: your browser asks it for your country from your IP address, to preselect language and dialect.
• Facebook SDK: a Facebook script loaded on the connected accounts page; Facebook may set its own cookies there.

Some of these providers operate outside your country, so your data may be stored or processed in other countries. We choose established providers and each receives only the minimum its role needs. We never sell your data or your customers' data, and never use it for anyone else's advertising.

6. Cookies and local storage

• Sign-in session cookie, to keep you signed in.
• Language cookie, to remember Arabic or English (1 year).
• Source cookie lbq_src: which ad or link brought you (90 days).
• A short-lived security cookie while connecting Facebook.
• Stored on your device only: your preferences, a discount code if you arrived through a link with one, and your last generator try.
• We do not use Google Analytics or Facebook Pixel.

7. How long we keep data

• While your account exists, your data exists.
• Customers' messages: we plan to start deleting message text older than 12 months soon. This is not in place yet, and we will update this page when it is.
• Labiq's internal notifications are deleted automatically after 180 days.
• Payment records (card transactions, InstaPay or bank transfers with receipt images, and the admin log of balance changes): kept for 5 years from the payment date, in line with Egyptian commercial and tax record-keeping rules. After that, receipt images are deleted and the record is unlinked from your name and email. This is our policy; the automatic purge after that period is not built yet.

8. Deleting your account

• Settings → "Delete account permanently". Deletion from the database is immediate and covers: business profile, content, your customers' messages and contacts, campaigns and broadcasts, connected accounts and their keys, the WhatsApp session, and your balance.
• If you have an active subscription, deletion is blocked until it is cancelled. Contact support@labiqtech.com and we will cancel it.
• What we keep: payment records and the admin log of balance changes, for the period above (5 years), for accounting, tax and refund checks.
• Still in progress, stated honestly: media files on Cloudinary are not yet deleted automatically; email us to remove them now. Access you gave Labiq at Facebook and Google is removed on our side only, so revoke Labiq in those apps' settings; for Telegram, send /revoke to @BotFather to cancel your bot token. For WhatsApp QR, the session record on our side is deleted immediately, but the open link on your phone stays until you remove it under "Linked devices".

9. Your rights

Wherever you live, you can ask for a copy of your data (in a format you can move elsewhere), ask us to correct it, delete it, or object to a particular use. Email support@labiqtech.com from your account email; we reply within 30 days at most. Copies are prepared manually; there is no download button yet.

If you are in the EU or UK, you can also complain to your local data-protection authority. None of this removes any mandatory right your own country's law gives you.

10. Security

• The whole site runs over HTTPS, so the connection is encrypted.
• Connected-account keys and your email password are stored encrypted.
• Internal access to data is restricted.
• No system is 100% secure. If we confirm a breach affecting your data, we will tell you without undue delay and within 72 hours of confirming it.

11. Age

The service is for business owners aged 18 or older, and we do not knowingly collect data from anyone younger. If we discover it, we delete the account.

12. Changes

If we make a material change, we will email you 14 days before it takes effect, and update the "Last updated" date above.

13. Contact

For any question about your privacy or data: support@labiqtech.com, or the support WhatsApp button on the site.