Privacy Policy

Hamza Oblouch operating as Babliy ("we," "us"). Primary operations and governing law context: Morocco.

Operator location: Agadir, Souss-Massa, Morocco. Service contact is the email below. This is not a trade-register office address.

Privacy contact: hello@babliy.ai.

When you use Babliy for your business, you are the data controller for your end-customers' personal data (names, phone numbers, messages, orders, leads). You decide what data is collected and how it is used in your business.

Babliy is a data processor for that customer data. We handle it to provide, secure, and improve the service you configure. We do not decide why your customers' data is collected for your business.

For your own account data (you as a Babliy customer), we act as a controller for account, billing, and marketing where applicable.

• Account and billing data: name, email, workspace / store name, password (stored hashed or via auth provider), team membership, and subscription details.
• Content you connect: messaging channel IDs, message content, delivery status, product catalog, orders, Company Knowledge files, agent settings, and integrations you enable (for example Slack, Meta, Google, Cal.com).
• Lead and form data: when you submit contact, hire, quiz, academy, or cabinet forms: name, email, and optional business details you enter.
• Technical data: logs, device and browser type, IP address, approximate location derived from IP where used for security or localization, and product usage events.
• Payment data: processed by Polar (and local payment rails where offered). We do not store full card numbers.
• Marketing attribution: UTM and click IDs (gclid, fbclid) from your landing URL are stored in session storage only after you accept Marketing cookies, so we can attribute signups. If you reject or withdraw Marketing consent, we do not write those IDs and we clear any stored attribution.

We use data to:

• Run the service: agents, inbox, AI replies, catalog, orders, knowledge, and team workflows.
• Bill subscriptions, prevent fraud, and enforce plan limits.
• Secure Babliy, fix bugs, and improve reliability.
• Send service emails (password reset, security alerts, billing notices).
• Measure marketing and product analytics only when you consent to optional cookies (see Cookie Policy).
• Comply with law and respond to valid legal requests.

We do not sell your personal information in the common sense of trading mailing lists for money. We do not use your end-customer chat content for third-party advertising. We do not share your data with third parties for their independent marketing.

Babliy staff do not routinely read your message content or customer conversations. Data is processed automatically by our systems to deliver the service.

We may access specific data only when:

• You contact us for support and ask us to investigate a specific issue.
• We need to respond to a security incident or abuse report.
• We are required to do so by law or a valid legal process.
• We use aggregated or anonymized data to understand product usage (no individual customer identity).

When you enable AI features, message content and knowledge you provide may be sent to third-party AI providers solely to generate replies and outputs on your behalf. We do not use your customer data to train unrelated models for other customers. AI provider policies may apply; email hello@babliy.ai for the current provider list.

Where GDPR / UK GDPR applies, we process data based on contract (providing the service), legitimate interests (security, service improvement, B2B communications where allowed), consent (optional cookies and where we ask explicitly), and legal obligation.

If you are a consumer covered by the CCPA/CPRA or similar US state laws, you may have rights to know, delete, correct, and opt out of certain sharing. Babliy does not sell personal information for money. If our use of advertising cookies is treated as "sharing" or "targeted advertising" under those laws, you can opt out by rejecting Marketing cookies via Cookie preferences or emailing hello@babliy.ai.

We share data only as needed to run Babliy, including with:

• Meta / WhatsApp for messaging and Business Platform APIs when you connect them.
• Infrastructure such as Supabase / hosting providers for database and storage.
• Polar for payment processing.
• Google if you choose Google login or Google Ads / Analytics (with consent).
• Microsoft Clarity for optional analytics (with consent).
• AI providers when AI features are enabled.
• Email delivery providers for transactional mail.
• Cal.com / Calendly if you use booking integrations.

Email hello@babliy.ai for the current sub-processor list.

You must have a lawful basis to message and store data about your customers, including compliance with WhatsApp, Meta, Slack, and other channel policies. Babliy processes customer data only on your instructions through the service you configure.

We keep account and message data while your account is active and for a reasonable period afterward for backups, disputes, and legal requirements. You may request deletion subject to limits (for example messages already delivered to customers or records we must keep by law).

We use encryption in transit, access controls, and industry-standard practices. No system is fully secure. Notify us promptly at hello@babliy.ai if you suspect unauthorized access.

Depending on your location, you may have the right to access, correct, delete, or export your data, and to object or restrict certain processing.

To exercise these rights, email hello@babliy.ai. You may also lodge a complaint with your local data protection authority.

We use necessary cookies and local storage for login sessions and preferences. Optional analytics and marketing cookies (Google Analytics, Google Ads, Meta Pixel, Microsoft Clarity) load only after you consent in our cookie banner. Details: Cookie Policy. Manage choices anytime via Cookie preferences.

Babliy is for businesses, not children under 16. We do not knowingly collect data from minors.

Data may be processed in Morocco and other countries where our providers operate (including the United States and EU regions). We use appropriate safeguards where required by law.

We may update this policy. We will post the new date at the top and, for material changes, provide notice in the app or by email. Continued use after changes means you accept the updated policy where permitted by law.

See also our Terms of Service, Cookie Policy, and Refund Policy.