Privacy Policy

Kebbir turns WhatsApp conversations into orders, invoices, and payments for small businesses. This policy covers two groups:

• Business users — the businesses that sign up for Kebbir. For your account information, we are the Responsible Party.
• Their customers — people who message a business on WhatsApp. For that information we act only as an Operator on the business’s behalf; the business is the Responsible Party, and its own privacy practices apply. See our Operator Agreement.

From business users: business name, contact details, login credentials, WhatsApp Business account and phone number details, payment configuration, and usage records of the dashboard.

On behalf of businesses (their customers): WhatsApp messages sent to the business’s number, sender names and phone numbers, and the order, invoice, and payment records derived from those messages.

Raw chat messages are held only in a short-lived, encrypted buffer so that orders can be extracted from the conversation. Messages that are not part of an order are permanently deleted when the buffer expires and are never shown to anyone. Only structured order data (items, quantities, prices, customer name and number) is kept after that window.

We process personal information to provide the service (capturing orders, generating and sending invoices, reconciling payments), to operate and secure our platform, to comply with legal obligations (such as tax and invoice retention), and to communicate with business users about their account. We process on the basis of performing our contract with the business, our legitimate interests in operating the service, and legal obligations. We do not sell personal information, and we do not use message content for advertising.

We share personal information only with the service providers needed to run Kebbir:

• Meta Platforms — WhatsApp Business Cloud API (message delivery; Meta also processes messages under its own terms as the WhatsApp provider).
• Our AI processing provider — extracts order details from message text.
• PayFast — payment links and payment notifications.
• Our hosting and database providers — the infrastructure the service runs on.

We may also disclose information where required by law or to protect our rights, users, or the public. Some providers process data outside South Africa; where they do, we rely on POPIA s72 (adequate protection through contractual safeguards or the transfer being necessary to perform the contract).

We take appropriate, reasonable technical and organisational measures under POPIA s19, including encryption of message data and personal information at rest, strict per-tenant data isolation, and access controls. No system is perfectly secure, and we cannot guarantee absolute security; business users must keep their credentials confidential.

Raw messages: deleted automatically at the end of the short processing buffer. Unconfirmed order candidates: deleted after a short retention window. Confirmed orders, invoices, and payment records: kept while the business’s account is active and as required by law (e.g. tax records). Account information: kept while the account is active and deleted within a reasonable period after closure, except where law requires retention.

Data subjects may request access to, correction of, or deletion of their personal information, and may object to processing. Business users can contact us directly. If you are a customer of a business that uses Kebbir, please contact that business first — it is the Responsible Party for your information and we act on its instructions; we will assist it in responding. You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

The dashboard uses only the cookies necessary to keep you signed in and secure your session. We do not use advertising or third-party tracking cookies.

Kebbir is a business tool and is not directed at children. We do not knowingly collect children’s personal information as Responsible Party.

We may update this policy from time to time; the current version is always available at this page and material changes will be notified to business users. Questions or requests can be sent to us via your dashboard. This policy is governed by the laws of the Republic of South Africa.