Back to app

Privacy Policy

Last updated: October 3, 2026

This is a translation provided for convenience. In case of any discrepancy, the Arabic version is the reference.

Abeely ("we", "us") respects your privacy. This policy explains what we collect, how we use it, and how we protect it across our website, the Telegram Mini App and the Abeely chat on Telegram, and across WhatsApp and our iOS and Android apps once we make them available. For each kind of data we say whether it is required or optional and what happens if you do not provide it, and for each purpose its legal basis.

1. Data we collect

Phone number (required) — to create your account and send OTPs; without it we cannot create your account or confirm that it is yours.
Name and avatar (optional) — shown on your profile; leaving them out costs you nothing in the service.
Location (optional) — to match your request to nearby providers. Your precise location is blurred (~500m) until both parties accept an offer; without it we match your request by its city, without a precise location.
Request and offer content, with their questions and additions — text, photos, voice recordings. This is the service itself: a request is not published without text or a photo, and an offer is not sent without a price; photos and recordings are optional.
Notification identifier (optional, with the permission you give in your browser or device) issued by your browser or device, and your browser type — to deliver new-offer notifications; without it you get no browser or device notifications.
Basic usage data (collected automatically as you use the app) — session time, device type, app version, and your device’s network address to protect the platform from abuse. No ad-tracking.
Your record of agreement to our documents (required) — when you agree to the Terms of Service and this policy, at sign-up, when you add a business and when you confirm you have read a change to them, we keep the document, its version and a fingerprint of its text, the time and language of your agreement, and your device’s network address, a description of your browser and a fingerprint of it, as evidence of the contract and as your electronic signature (Terms of Service, clause 15); without your agreement, sign-up or adding a business cannot be completed.
Store or business data, if you make offers — its name, description, the cities it serves, the products and services it offers, and a contact number we verify with a code sent to that number; its name, description and offerings are shown to those who see its offers and on its page. That public page — its name, description, city, offerings and rating, never its contact number — appears in search engine results, and its owner can hide it at any time with “Show my profile publicly”, after which no one is shown it. A name and a verified contact number are required to make any offer; without them no offer can be sent.
Business verification document (only if you ask to be verified; required to make an offer priced above SAR 10000): a copy of the commercial registration, freelance certificate or professional licence and its number, which may carry your name and ID number. We use it to check the business details and to show the “Verified” badge. It is not shown to customers or to your team members, only Abeely’s review team can see it, and it is kept in private storage that no public link opens.
Bank transfer receipt (for those who pay their commission by bank transfer): the photo of the receipt and what it shows — the sender’s name and bank, part of the account number, the amount and its date — and the transfer’s bank reference number if you enter it. We keep it in private storage that only our finance team can see, so it can check that the amount arrived; we record who reviewed it and when, and we keep it with the commission entries as a financial record for as long as the law requires (§5). Without it the transfer cannot be confirmed.
Your Telegram or WhatsApp account identifier, if you use Abeely from a chat there, including the identifier WhatsApp assigns to your account for our business: we keep it to link the chat to your Abeely account, and to send you there notifications about your requests and, when you open a link that reached you there, the sign-in code for your account — we use it for nothing else. On Telegram the chat is linked after you share your phone number with the official share button in your private chat with the bot; on WhatsApp, after you tap “ابدأ” (Start) in your chat with us, since WhatsApp sends us your number with your message. The link is removed at your request or when you delete your account. With it we keep your name and username as Telegram shows them for your account, if you use Abeely from inside Telegram, to address you by name and to show them to our moderation team in its alerts (§3); they are erased when you delete your account.
Your messages in the bot chat, and its state: we keep what you write or send to the bot (text, voice, a photo or a location) and the bot’s replies, and the state of the chat (the draft, the location you send, and what the chat is waiting for from you), to carry out your request and so the bot can follow the conversation. We delete each message 180 days after it was sent and the chat state 180 days after the last activity in it, and both when you delete your account. If, before it answers you, the bot asks you to share your number on Telegram or to tap “ابدأ” (Start) on WhatsApp, we keep one message you sent before that so we can continue your request once the chat is linked, without processing it before then, and we erase it if the chat is not linked within an hour.
Preferences inferred from the bot chat: the bot keeps what it learns about you in the conversation so it can tailor its replies and not ask again — your city from your requests, your name if you mention it, and your writing style — and an AI model infers from your latest messages your preferred budget and timing and the kinds of things you ask for (§4). We use them for nothing else, and we delete each preference 180 days after it was last updated, or when you delete your account.
The link and unlink record: we record every link of a chat to your account and every unlink or refusal (the time, the channel, your number masked, and a one-way fingerprint of the chat identifier), without the text of any message, to protect your account from a link made without your knowledge; we keep it for 400 days and then delete it. When you delete your account the record is detached from it and stays until the end of its period.
The record of what we send to your chat, and its links: when notifications about your requests reach you in a Telegram or WhatsApp chat, we record each notification we send you there — its type, the request and offer it concerns, the message number in the chat, and whether it was sent, held or not sent and why — without its text, so that the same notification never reaches you twice and what we held during your quiet hours is sent when they end; we delete it after sixty days. For each link we send you in the chat to open your request or sign in to your account, we keep a one-way fingerprint rather than the link itself, together with your account and the request it concerns, and how many times it was opened and used to try to sign in; we delete it a week after it expires. Both are deleted when you delete your account.

2. How we use the data, and the legal basis for it

Matching requests to suitable providers — legal basis: performing our agreement with you (Terms of Service).
Showing your public request — its title, description and photos — to registered providers so they can make offers on it, without your name, phone number or exact location. A visitor who has not signed up yet sees its title, city, time of publishing and a short excerpt of its description, without its photos; a title or description that carries a number or any contact detail is not shown to them — legal basis: performing our agreement, since showing the request to providers is the service you ask for.
Delivery request (courier): if you ask for a courier to bring what you accepted, or the provider whose offer you accepted asks for one, we create a delivery request that couriers in the pickup city can see: one line describing what is carried and its size, the pickup and delivery districts, and the distance by road with its approximate time, without your name, phone number, request text or the price you paid. That line is written by an AI model from the request and the offer, with no name or number. Only the courier whose offer is accepted sees the exact pickup and delivery points and the store’s number, the route between them is drawn on the map only for you and that courier, and both parties to the request see the courier’s name and number once accepted, the time they promised to pick up, and the expected arrival time after pickup — legal basis: performing our agreement, since delivery is a service one of the parties asks for.
Delivering offers, their questions and answers between the two parties — legal basis: performing our agreement.
Sending notifications about offers, questions and updates — legal basis: performing our agreement; browser and device notifications also rest on the permission you give, which you can withdraw at any time.
Fraud prevention and platform integrity — legal basis: our legitimate interest in protecting the platform and its users, and our legal obligations.
Understanding and matching your request, and tailoring the bot’s replies, with AI models (see §4) — legal basis: performing our agreement.
Verifying stores and reviewing their documents — legal basis: performing our agreement with the store, and our legitimate interest in protecting customers from high-value offers made by an unidentified party.
Calculating the commission on an accepted offer, issuing account statements, collecting them and deciding objections to them — legal basis: performing the services-marketing contract with the store (Terms of Service, clause 15), and our legal obligations to keep financial records.
Proving the contract: keeping your agreement to our documents and the record of what was concluded through the platform, to rely on in a dispute — legal basis: our legal obligation to keep the data of what is concluded through the platform, and our legitimate interest in proving our rights and yours.

3. Third-party processors

We share the minimum necessary data with processors who act on our behalf:

Hosting, database and file storage — keeps your account, requests, offers and photos, and runs the app’s servers — in Germany; the hosting provider may keep technical operating logs in the United States.
Content delivery networks — deliver the app’s pages and files to your device from the point nearest to you, in several countries, including a Telegram script library your browser loads so that sign-in works from inside Telegram; they receive your device’s network address and browser type.
AI processing — understanding your request whether typed, spoken or photographed, turning speech into text, classifying the request and matching it to stores, automated content screening, and translation (§4) — with providers in the United States.
Mapping service — showing the map and searching for a place on it, turning the coordinates of a location you set into a city and district name, and calculating the route between the pickup and delivery points of a delivery request, with its distance and time — with a provider in the United States.
Verification codes by text message — sending your sign-in code to your phone, so it receives your phone number and the code — with a Saudi verification-service provider, over telecom networks in the Kingdom.
Telegram and WhatsApp, if you choose to use Abeely from inside either: sign-in, verification codes, the bot chat and notifications, so its operator receives what you exchange with us there, which is also governed by its own privacy policy — Telegram’s operator is in the United Arab Emirates and the British Virgin Islands, WhatsApp’s operator is in the United States, and their data centres are in several countries.
Moderation alerts — we use Telegram for internal alerts to our team about a request or store that needs a look (content review, a request that matched no store, or a store verification), whichever channel you use Abeely from, even if you have never used Telegram, carrying only what the review needs: the request text and city, the name of its author or the store and their Telegram identifier where there is one, the phone number masked, or a link to the verification document — with Telegram’s operator in the United Arab Emirates and the British Virgin Islands, and its data centres in several countries.
Notification services provided by your browser or device operating system — delivering the app’s notifications, so they receive your subscription identifier and the notification in encrypted form — with providers in the United States.
Error monitoring — recording server errors and their technical context so we can fix them, after phone numbers are masked out of them; a record may still carry your account or request identifier — with a provider in the United States.
Support email — delivering what you send to our email address — in France and the United States.

Where your data is processed and who receives it: your data is stored and our servers run in Germany; each provider above receives only what its task needs, in the countries named with it, and our providers may access it from other countries for technical support and security under their contracts. Your data is therefore processed outside Saudi Arabia: in Germany, the United States and France; in the United Arab Emirates, the British Virgin Islands and the countries of Telegram’s data centres, because your browser loads a script library from Telegram and our moderation and verification alerts pass through it whichever channel you use; in the countries of the content-delivery points that serve your device; and in the countries of WhatsApp’s data centres if you use WhatsApp. We will update this policy before we engage a provider in a country not named here. These providers process it to deliver the service to us and on our instructions, under contracts or terms that bind them to protect it. We disclose it to no one else except: the other party to a request, to the extent described in §2; a licensed payment gateway when you pay a commission — we send it the amount, its reference and the store’s name and phone number, you enter your card details on its own page so they never reach us, and we receive only the result and reference of the payment; if we offer automatic payment and you turn it on, the gateway keeps your card, not us (Terms of Service, clause 15); and government and judicial authorities where the law requires it. You may ask us for the names of the entities that process your data, and we will give them to you by email (§10). We disclose a bank transfer receipt to no one; if we return an amount you transferred, we send it through our bank to the account the payment came from, so our bank receives that account holder’s name, its IBAN and the amount.

4. AI processing

We use AI models run by specialist providers for: understanding your request whether typed, spoken or photographed and drafting it as a request; turning your voice recording into text; suggesting questions that clarify your request; classifying it and matching it to the most suitable stores; automated screening of what the other party will see for abusive language or contact details before acceptance; and translation (§4.1). We send them only what the task needs — the request text, its additions and your answers, its photos and voice recording when you use them, offer and question texts, store profiles, and names shown to the other party — and we never attach your phone number or exact location to it ourselves; the model reads only what you write or send. If you use Abeely from a Telegram or WhatsApp chat, an automated language model reads your messages in the chat together with the preferences the bot has saved about you (§1), and turns your voice messages into text, to understand what you are asking for, reply to you and draft it as a request, and it infers from your latest messages preferences about your requests; if, before it answers you, the bot asks you to share your number on Telegram or to tap “ابدأ” (Start) on WhatsApp, the model reads nothing you send before the chat is linked. Data is sent over an encrypted connection; under the providers’ terms it is not used to train their models, and they may keep it for a limited period to detect misuse. Automated decisions: which stores are alerted to your request is decided automatically, and your public request stays visible to providers as described in §2; automated screening may mask a word or ask you to rephrase, and refers a suspected request to human review before it is published. You may ask for human review of any automated decision about you by email (§10). We do not sell your data or use it to train external models. After an offer is accepted, we also send them the texts of the request, the offer and its questions and answers to draft the parties' “agreement card”, without any name, mobile number or exact location.

Your consent before anything is sent: we send nothing you write, attach or record to these models before your explicit consent, and your consent is the legal basis for this processing. It is part of your acceptance of the terms and this policy, and you give it once: in the app with a single “I agree” button under a line that describes this sending, and in the Telegram and WhatsApp chat with the button that creates your account or links the chat, under the same line; if you accepted the terms before they carried that line, you are asked the same way the first time you take an action that needs it. You can withdraw it any time in the app, from My account → General → Your consents. While you have not consented, or after you withdraw, we send no new content, and you cannot publish a request, submit an offer, or add or edit anything — such as adding a product or a licence, or editing your business profile — because matching and review run on this processing. Withdrawing does not affect what was sent before it. Translation under section 4.1 is part of delivering your request and your offer to someone who reads another language, and its basis is your acceptance of the terms.

4.1. Translating incoming content

Automatic translation is on by default for every signed-in account that has not changed it: we send the texts of requests, offers and questions that reach you in a language other than the app’s to the translation service as they arrive. You can turn it off at any time in Settings, and after that we send only the text you tap to translate. We never automatically translate what you wrote, the original text is never changed, and “Show original” is always available. We may keep a translation for up to 30 days to show it to others reading the same text in your language without translating it again.

5. Data retention

We keep your account for as long as it is active. When an account is deleted (see clause 7) we immediately erase your phone number, email, name and photo from your profile, the links to your Telegram and WhatsApp chats, your messages in the bot chat with its state and the preferences inferred from it, your Telegram name and username, and the record of what we sent to your chats and its links; and we delete the photos of your requests and your business verification documents 30 days after the deletion. We keep the data of what was contracted through the platform — requests and offers — for three years from the date the contract was concluded, which is the minimum period the Implementing Regulation of the E-Commerce Law imposes on intermediary platforms. After deletion we also keep the record of your agreement to our documents, because it is the evidence of the contract relied on in a dispute and is never altered once written, and the link and unlink record until the end of its period (clause 1). Financial records — invoices and commission entries — are kept for the period required by the Kingdom’s tax and commercial laws. We delete the image of a verification document as soon as the request is rejected or the document is replaced, and 30 days after it is approved; after that we keep only the document type, its number, its expiry date and the review decision, for as long as the verification stands.

6. Security

All traffic uses TLS. Passwords (if used) are hashed. OTPs expire after 5 minutes.

7. Your rights & account deletion

You may at any time:

Access your data from inside the app.
Correct or update any data.
Delete your account from Settings → Delete Account.
Ask for human review of any automated decision about you (§4).
Ask for the names of the entities that process your data (§3).
Obtain a copy of your personal data in a readable and clear format, by request to the email in §10.

8. Children

Abeely is not directed at children under 13. If we learn we have collected data from a child below the age of consent, we remove it immediately.

9. Changes

We may update this policy; if we make a material change, we will alert you to it when you open the app so you can confirm you have read it.

10. Contact

For any inquiry: support@abeely.app — we reply within two business days at most. The details of who controls your data — its name and legal status — are in the Terms of Service (clause 13).