Privacy Policy
Last updated: 12 August 2026
This policy explains what we do with your personal data when you visit kabiri.co or join the Kabiri waitlist. It covers this site only - when the Kabiri workspace itself launches, the app will have its own policy covering the data you keep inside it.
1. Who we are
Kabiri Workspace Limited is the controller of your personal data. We are registered in England and Wales, company number 17140110, with our registered office at Bartle House, Oxford Court, Manchester, England, M2 3WQ.
- Privacy questions and data rights: privacy@kabiri.co
- Everything else: hello@kabiri.co
We are established in the UK, so the UK GDPR and the Data Protection Act 2018 apply to what we do. Because the waitlist is also open to people in the EU and EEA, the EU GDPR applies to them as well, and this policy is written to meet both.
We have not appointed a Data Protection Officer, and we are not required to have one - we are a small company, we do not monitor people at scale, and we do not handle special category data. Privacy questions come straight to us at privacy@kabiri.co.
2. What we collect
When you join the waitlist:
- Your email address - the only thing we ask you to type. We do not ask for your name, and there are no payment details on this site.
- When and where you signed up - a timestamp and which page the signup came from.
- Whether you have unsubscribed, and when - so we can make sure we do not email you again.
Collected automatically when you visit:
- A one-way hash of your IP address, used only to rate-limit the signup form. It is a fingerprint, not an address - your actual IP is not stored and cannot be recovered from it.
- Standard server logs kept by our hosting provider for security and reliability.
- Analytics data, only if you allow it - which pages you view, where you arrived from, your approximate location derived from your IP address, and your device and browser type. None of this is collected unless you accept analytics cookies. See section 4.
- Advertising measurement data, only if you allow it - if you reached us from one of our ads on Google or Meta, and you accept advertising cookies, those platforms are told that the browser which saw the ad reached our site and joined the waitlist. That is how we find out whether an ad worked. Nothing is sent unless you accept advertising cookies. See section 4.
There is no marketing preference to collect, because there is no marketing list. The waitlist does one thing: it tells you when Kabiri is live. We do not run a newsletter, and your email address will not be used to send you news or product updates. If that ever changes we will ask you to opt in separately, and saying no would not affect your place on the list.
We do advertise Kabiri on Google and Meta, and if you accept advertising cookies those platforms are told that a browser which saw one of our ads reached our site - see sections 4 and 5. That is the one place your data meets advertising, it happens only with your consent, and it is about measuring our own ads rather than profiling you for anyone else's. We do not use your data to train anything, and we never sell or rent it.
3. Why we use it, and our legal basis
We have to have a lawful reason for every use of your data. Here is each one, with the basis we rely on:
| What for | Data used | Legal basis |
|---|---|---|
| Emailing you when Kabiri launches | Email address | Consent. You gave it by submitting a form that says we will email you at launch. You can withdraw it at any time. |
| Keeping the signup form from being abused | Hashed IP address | Legitimate interests - keeping the form working and our costs predictable. |
| Understanding how the site is used | Analytics data | Consent, through the cookie banner. |
| Measuring whether our ads on Google and Meta work | Advertising cookie identifiers, pages viewed | Consent, through the cookie banner - the Advertising category, which is separate from Analytics. |
| Proving we honoured an unsubscribe or a consent | Email address, signup and unsubscribe records | Legal obligation - data protection law requires us to be able to demonstrate this. |
| Replying to you | Whatever you put in your message | Legitimate interests - answering people who contact us. |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and concluded they do not override them. You can object to any of it - see section 8 - and you can ask us for our reasoning.
4. Cookies and similar technology
Nothing optional runs until you say yes. We use Google Consent Mode v2, which starts in the denied state, so no analytics cookies are written and nothing is stored on your device until you accept them in the banner. If you reject analytics, it stays that way.
To be precise about one thing: Google's analytics tag still loads with the page and sends Google a signal recording that consent is denied. That signal includes your IP address, which Google uses to work out an approximate country and then discards. It does not read from or write to your device, and no analytics cookies are set.
| Name | Type | Purpose | Expires |
|---|---|---|---|
| kabiri_cookie_consent | Essential (local storage) | Remembers the cookie choice you made, so we do not ask again on every page. | 6 months |
| _ga | Analytics (Google) | Tells one visitor apart from another. | 2 years |
| _ga_LR5JRQ7WR7 | Analytics (Google) | Keeps track of a single visit to the site. | 2 years |
| _gcl_au, _gcl_aw | Advertising (Google) | Records that you arrived from one of our Google ads, so a later waitlist signup can be attributed to it. | 90 days |
| IDE, test_cookie | Advertising (Google, on doubleclick.net) | Measures ad performance, and checks whether your browser accepts cookies at all. | Up to 13 months / 15 minutes |
| _fbp, _fbc | Advertising (Meta) | Identifies your browser to the Meta pixel, so a signup can be attributed to an ad you saw on Facebook or Instagram. | 90 days |
| fr | Advertising (Meta, on facebook.com) | Used by Meta to deliver and measure advertising. | 90 days |
Analytics and advertising are separate questions, and the banner asks them separately - saying yes to anonymous usage stats is not saying yes to being tracked for advertising. The advertising rows above are only written if you turn that category on. Reject all, and none of them appear.
We load these tags through Google Tag Manager. Tag Manager itself sets no cookies and collects nothing about you - it is the container the other tags sit in, and it holds them back until you have answered the banner.
Change or withdraw your choice at any time: . There is also a small cookie button in the bottom-right corner of every page. We ask again every six months so an old decision does not stand forever.
Our emails contain no tracking pixels and no click tracking. We do not record whether you opened an email or which links you followed.
We do not host our fonts on Google's servers. They are served from kabiri.co, so visiting the site does not hand your IP address to a third party before you have made a cookie choice.
5. Who we share it with
We do not sell or rent your data, and we never share it for anyone else's marketing - only, with your consent, to measure our own. We use a small number of service providers who process data on our instructions, under contract:
- Google Cloud Platform / Firebase - hosting, the database the waitlist lives in, and the functions behind the signup form. The functions run in Google's europe-west2 (London) region.
- Twilio SendGrid - delivers the waitlist emails we send you.
- Google Analytics - site usage measurement, and only if you have accepted analytics cookies.
- Google Tag Manager - the container we load the tags above and below through. It stores nothing about you itself.
Two more receive data only if you accept advertising cookies, and they are not processors acting on our instructions - each decides for itself what it does with what it receives:
- Google Ads (Google Ireland Limited) - conversion measurement and remarketing for our ads. Google acts as an independent controller under its controller-controller data protection terms.
- Meta (Meta Platforms Ireland Limited) - the advertising pixel for our Facebook and Instagram ads. Meta is a joint controller with us for the collection and transmission of pixel data, under Meta's Controller Addendum. What Meta then does with that data is governed by its own privacy policy, and you can exercise your rights against Meta directly as well as against us.
Neither of them is sent your email address or anything else you typed into the waitlist form.
We may also disclose personal data where the law requires it, or where we need to establish, exercise or defend legal claims.
6. Sending data outside the UK and EEA
Some of those providers are based in the United States. Where personal data leaves the UK or EEA, we rely on:
- the EU-US Data Privacy Framework and its UK Extension, where the provider is certified under it - Google LLC and Meta Platforms, Inc. both are; or
- Standard Contractual Clauses, with the UK International Data Transfer Addendum where the transfer is from the UK, together with a transfer risk assessment.
You can ask us for a copy of the safeguards that apply to any particular transfer at privacy@kabiri.co.
7. How long we keep it
| What | How long |
|---|---|
| Your waitlist entry | Until Kabiri launches and you have had your invitation, and no more than 6 months after launch. Deleted sooner if you ask. |
| Consent and unsubscribe records | Kept as evidence that we honoured your choice. An unsubscribe record is just your email address and the fact that you opted out, and exists only to stop us emailing you again. |
| Analytics data | Held by Google Analytics under the retention setting on our property - a maximum of 14 months for event-level data. |
| Advertising measurement data | The cookies themselves expire within 90 days (13 months for Google's IDE). What Google and Meta hold after that is governed by their own retention policies, not ours. |
| Hashed IP addresses used for rate limiting | Rolling window of a few hours, then discarded. |
| Emails you send us | Up to 2 years after the conversation ends. |
8. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- Be informed about how we use your data - this policy.
- Access your personal data and get a copy of it.
- Rectify anything inaccurate or incomplete.
- Erase your data (the "right to be forgotten").
- Restrict how we process it.
- Portability - receive the data you gave us in a structured, commonly used, machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time - an objection to marketing is absolute and we must stop.
- Withdraw consent at any time, without affecting anything we did before you withdrew it.
The quickest way to stop our emails is the unsubscribe link at the bottom of every one we send. It takes one click and removes you from the list immediately.
For anything else, email privacy@kabiri.co. We will respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to. Exercising your rights is free; we will only charge, or refuse, if a request is manifestly unfounded or excessive, and we will explain why if that ever happens. We may need to check who you are before we act.
If you are unhappy with how we have handled your data, please tell us first so we can put it right - but you do not have to, and you can complain to a regulator at any time:
- In the UK: the Information Commissioner's Office, ico.org.uk, helpline 0303 123 1113.
- In the EU or EEA: the supervisory authority in the country where you live, where you work, or where the problem happened. The full list is at edpb.europa.eu.
9. Automated decisions and profiling
We do not make any decisions about you by automated means, and we do not profile you. Nothing on this site produces legal effects for you or affects you in any similarly significant way.
10. Children
Kabiri is a tool for working professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us their details, email privacy@kabiri.co and we will delete them.
11. Security
Your data is held in Google Cloud Platform's Firebase suite, encrypted in transit and at rest, with access limited to the people who need it. The site is served over HTTPS only. No system is perfect, and we will tell you and the relevant regulator if there is ever a breach that requires it.
12. Changes to this policy
We may update this policy. The "last updated" date at the top always reflects the current version. If a change materially affects how we use data you gave us with your consent, we will tell you and, where the law requires it, ask you again rather than assume the old answer still stands.
13. Contact us
Privacy questions and data rights: privacy@kabiri.co. Everything else: hello@kabiri.co.
Kabiri Workspace Limited, a company registered in England and Wales (No. 17140110). Registered office: Bartle House, Oxford Court, Manchester, England, M2 3WQ.