Privacy policy

Last updated 25 October 2026

Babara helps freelancers and small businesses follow up on unpaid invoices. This policy explains what we collect, why, how long we keep it and the choices you and your clients have. The short version: we only use data to run Babara, we never sell it, and our reminder emails contain no tracking pixels.

Who we are

Babara is operated by Mahmoud Shayeb, an individual (sole trader) ("we"). Contact us at privacy@babara.app. We're based in Tulkarm, Palestine. More details are in our legal notice.

Two different roles

  • Your account (you, the Babara customer): we decide how this data is used, so we are the controller.
  • Your clients’ details (the names, emails and invoices you add, and what your clients do on their pay page or reply to a reminder): you decide why it’s used, so you are the controller and we act as your processor under our Data Processing Addendum.

What we collect, why, and on what basis

  • Account data: your name, email, business name, timezone and settings. Used to provide Babara (performance of our contract with you).
  • Billing: handled by Paddle.com as Merchant of Record, which acts as an independent controller for payment and tax data. We never see or store card numbers.
  • Clients and invoices you add: client names, billing and CC emails, invoice numbers, amounts, dates and your payment details. Used to send reminders on your behalf.
  • Pay-page activity: that the pay page was opened (at most once an hour), and what your client chose there: paid, a promised date, a question, or “not expecting this email”. Used to show you what happened and to pause reminders or add a fitting line to them. Pay pages set no cookies.
  • Replies to reminders: when reply handling is on, replies pass through Babara so reminders pause and the reply is forwarded to you. Babara reads the newest part of a reply (up to 1,500 characters) to spot a promised pay date, using an AI model run by Cloudflare (Workers AI), which doesn’t use it to train models; you can correct what she understood. We keep the first 1,200 characters as a note in the invoice history. Automatic out-of-office replies are only noted.
  • Invoices you email to Babara: when you BCC your private Babara address, the message and its PDF or Word file are read in memory to make a draft invoice (client, number, amount, dates). We keep only those invoice details. Files you email to Babara are read in memory to create a draft, then dropped. We never store them. The file is never attached to any email we send. Reading a document uses an AI service (see the subprocessor list); only mail from your own address counts, up to 5 MB per file.
  • Paperwork you save: a tax form (such as a W-9) or a bank details letter you upload in Settings, kept as a PDF in Cloudflare’s file storage. Only the account owner can open or replace it, and it is emailed to a client only when someone on your account presses send. Removing it, or closing your account, deletes it.
  • Messages to support: the name, email address and message you send with the support form, the page you came from and, if you’re signed in, your account. It goes to our support inbox so we can reply (our legitimate interest in helping you). Babara’s own copy is deleted after 90 days.
  • Invoice files you drop in: a PDF or Word file is read in your browser and never uploaded. Free rules read it first. Only if they miss something, a short piece of its text (up to 3,000 characters, chosen around the amounts, dates and invoice words) goes to an AI model run by Cloudflare (Workers AI) to fill the form; it isn’t stored or used to train models. The answer is kept for 30 days under a one-way fingerprint so the same file costs nothing twice.
    Your file stays on your device. If our rules miss something, a short piece of its text is read by our AI provider (Cloudflare) to fill the form, and it isn’t stored.
    Ihre Datei bleibt auf Ihrem Gerät. Wenn unsere Regeln etwas nicht erkennen, liest unser KI-Anbieter (Cloudflare) einen kurzen Ausschnitt des Textes, um das Formular auszufüllen. Er wird nicht gespeichert.
    Votre fichier reste sur votre appareil. Si nos règles ne trouvent pas tout, un court extrait de son texte est lu par notre fournisseur d’IA (Cloudflare) pour remplir le formulaire, et il n’est pas conservé.
  • Delivery events from our email provider: delivered, bounced or marked as spam. Used to keep sending safe and to stop emailing addresses that bounce or complain (our legitimate interest in deliverability and preventing misuse).
  • Security data: IP addresses in short-lived rate-limit records and logs. Used to keep Babara secure (legitimate interest).
  • Website visits: we count visits to babara.app and the Babara app (including pay pages) with Cloudflare Web Analytics: which page, where the visit came from, the country, the device type and how fast it loaded. It sets no cookies, stores nothing on your device and doesn’t follow you across sites. Used to see which pages help people (legitimate interest).
  • How Babara is used: our own server notes which Babara page you opened (on the website and in the app, never your clients’ pay pages), which tool you used (for example adding an invoice or the free reminder writer), whether it worked and, if not, a short error code (never what you typed), the site that sent you, campaign tags in the link and your country. To count people rather than clicks, it makes a short code from your IP address, your browser name and a random value that changes every day. The IP address itself isn’t stored, and the old daily value is deleted, so the code can’t follow you from one day to the next. If you’re signed in, the note is linked to your account and deleted with it. Your account also keeps the site that sent you before you signed up and the date you first emailed a client through Babara. Kept for 400 days and never shared. No cookies. Used to learn which pages and tools help people (legitimate interest).

No inbox tracking. Since September 2026 Babara’s emails carry no tracking pixels and no per-recipient link tracking. Open data collected before then has been deleted.

Pay DNA and predictions

Babara shows each customer a reliability score for their own clients (Pay DNA) and an estimated pay date for open invoices. They are worked out with simple, transparent rules from that customer’s history with that client only: days late, how often they paid on time, and promises kept. Scores are never shared between customers, Babara makes no decisions on its own with them, and they are not a credit check. You, or a client of our customer, can ask us how a score was worked out or object to it at privacy@babara.app.

Who we share data with

Only the service providers that run Babara (see the subprocessor list): Cloudflare, Inc. and Resend, plus Paddle.com for billing. We never sell data and never use your clients’ details for our own marketing. We may disclose data if the law requires it.

International transfers

Our providers may process data in the United States and other countries. These transfers rely on the EU–US Data Privacy Framework (including the UK Extension) and Standard Contractual Clauses. Where Babara’s own operator accesses data from outside the EU or UK, the Standard Contractual Clauses in our Data Processing Addendum apply.

How long we keep data

  • Account, client, invoice and email history: until you delete it or close your account. Closing your account deletes it from our live database at once; database backups roll off within 30 days.
  • Sign-in emails and sessions: 30 days. Used or expired sign-in links: 1 day. Rate-limit records: 1 day.
  • Notes on how Babara is used (pages and tools, see above): 400 days, or until you close your account.
  • Do-not-email records (bounces, spam complaints, “not me” reports): as long as needed to honour them. If you close your account, we keep a one-way fingerprint of your email with the addresses that asked not to be emailed, so their request still holds if you sign up again.
  • Messages to support: Babara’s copy for 90 days; the reply thread stays in our support inbox as long as we need it to help you.
  • Remembered browsers (the sign-in cookie below): one year after you last signed in on that browser.
  • Billing records: kept by Paddle.com as tax law requires.

Your rights

You can ask to access, correct, export, restrict or delete your data, and object to processing based on legitimate interests. Email privacy@babara.app and we’ll reply within one month. If you’re unhappy with how we handled your data, tell us first: we acknowledge complaints within 30 days and tell you the outcome. You can also complain to your data protection authority (in the UK, the Information Commissioner’s Office).

Received a reminder from a Babara customer? The business that sent it is responsible for your data; you can contact them, or us and we’ll help. The “Not expecting this email?” button on the pay page stops the reminders straight away. More in our note for email recipients.

Cookies

Three essential cookies in the app: one keeps you signed in, one marks the browser that asked for a sign-in link (so a link opened elsewhere asks first), and one remembers browsers you’ve signed in on (so nobody can lock you out by requesting links for your email). The website and pay pages set no cookies for visitors; one more cookie is only ever set in the Babara team’s own browsers, so our own testing isn’t counted. Our visit counter (Cloudflare Web Analytics) works without cookies, and there are no advertising cookies, so there is no cookie banner.

Security

Everything runs over HTTPS. Sessions and sign-in links are stored only as one-way hashes, every account’s data is kept separate, and sending is rate-limited to stop misuse.

Children

Babara is a business tool for adults and isn’t meant for anyone under 18.

Changes

We’ll post any changes here with a new date, and email account holders about important ones before they apply.