Privacy policy

Gobee learns what you like so it can pick one real reward for you each day. To do that it stores what you tell it and what you do in the app. It does not sell your data, does not share it with advertisers, and does not track you across other apps or websites. You can delete any of it, or all of it, at any time.

Gobee is the data controller for the personal data described here — we decide what is collected and why.

Because Gobee serves people in Saudi Arabia and the wider Gulf, this policy is written to meet the Kingdom's Personal Data Protection Law (PDPL) and its Implementing Regulations, overseen by the Saudi Data & AI Authority (SDAIA).

Each thing we hold exists for a stated purpose, and is not used for anything else:

• To give you an account. So you can sign in, stay signed in, and recover access if you forget your password.
• To pick your daily reward. Your preferences, city and past reactions decide which single reward you are offered each day.
• To hold a conversation. Your messages let the companion follow the thread and refer back to what you told it.
• To tell you when something you asked for arrives. Requests you make are matched against new offers, and we notify you when one turns up.
• To let you claim rewards. A voucher has to be issued, tracked and shown to the partner business to be redeemed.
• To keep the service working and fair. Rate limiting and abuse prevention, so one account cannot degrade the service for everyone.

• Your account. Email address and a password, stored only as a bcrypt hash — we never hold the password itself.
• Your profile. First name, and optionally city, neighbourhood, timezone, language and the time of day you want to hear from us.
• What you like. Preferences you add yourself, and preferences the companion infers from talking with you. Each inferred one is stored as a plain key, value and confidence, so it can be read and removed individually.
• Your conversations. The messages you exchange with the companion, so it can remember the thread and refer back to what you told it.
• Requests you make. Things you ask us to watch out for, kept so we can tell you when one turns up. These expire after 90 days.
• What you do in the app. Which rewards you were shown, claimed, dismissed or rated, and when. This is what stops the same pick coming round again and makes the next one better.

Directly from you, when you register, fill in your profile, add a preference, or send a message to the companion. And from your use of the app itself — which reward you were shown, whether you claimed or dismissed it. We do not buy personal data, and we do not collect it from third parties or from other apps and websites you use.

The companion is instructed never to ask about or record health or medical details, political views, religious beliefs, sexual orientation, or financial credentials. If you mention any of it, it is not stored — a filter in our own code drops it before it reaches the database, independently of the instruction.

Messages are also scanned for things that look like personal identifiers before they are stored or sent anywhere, and those are replaced. We keep location at city and neighbourhood level to find nearby places; we do not track your position.

We rely on your consent, given when you create an account and when you choose to share something with the companion. You can withdraw it at any time by deleting the data in question or your whole account, and withdrawing it does not affect anything already done lawfully beforehand.

Some processing is also necessary to deliver what you asked for — issuing a voucher you chose to claim, or sending a password reset you requested.

Your conversations are processed by OpenAI to generate the companion's replies and your daily message. We send only what is needed for that: your first name, a window of recent messages, a compact list of what we already know you like, and today's reward. Not your email, not your full history, not your account.

The model never decides what you are eligible for. Which rewards exist, which you can claim, and which one you get are all decided by our own code from the actual campaign rules. The model only writes the words. No decision with a legal or similarly significant effect on you is made automatically.

We use a small number of providers to run the service. They process data on our behalf, under contract, and only to provide their part of it.

• OpenAI. Generates the companion’s replies and your daily message.
• Neon. Hosts the database everything is stored in.
• Vercel. Hosts and serves the application.
• Upstash. Rate limiting and background job scheduling.
• Resend. Sends transactional email — password resets, and updates you asked for.

Partner businesses see that a voucher was redeemed at their branch and whether the customer was new to the platform. They do not see your name, your email, your conversations or your preferences.

We do not sell personal data, and we do not share it for advertising.

The providers above operate outside the Kingdom of Saudi Arabia, so running Gobee involves transferring your personal data abroad. We keep those transfers to what the service needs, send the minimum each provider requires, and hold them to contractual terms covering confidentiality and security.

If you would like to know which provider handles a specific category of data, or where it is located, ask us and we will tell you.

Your data is held in a managed PostgreSQL database, encrypted in transit. Passwords are stored only as bcrypt hashes and password reset links only as a hash, so a copy of our database would not let anyone sign in as you or reset your account. Sign-in cookies cannot be read by JavaScript.

Destruction is deletion, not concealment. When you delete something it is removed from the database rather than flagged as hidden: deleting a conversation deletes its messages, deleting a memory removes that row, and deleting your account erases your profile, preferences, memories, conversations, requests, notifications and reward history in one operation. It takes effect immediately and cannot be reversed by us afterwards.

Data we still hold is kept only as long as it serves the purpose it was collected for. Sign-in sessions expire on their own. Password reset links expire within minutes and work once. Standing requests expire after 90 days. Everything else is kept until you delete it or close your account.

Under the PDPL you have the right to:

• Be informed. To know the legal basis and purpose for collecting your data — that is what this policy is for.
• Access. To see the personal data we hold about you.
• Obtain a copy. To receive your data in a readable, clear format.
• Correct it. To have your data corrected, completed or brought up to date.
• Have it destroyed. To have your personal data erased when you no longer want us to hold it.
• Withdraw consent. To take back permission you previously gave.

Most of these you can do yourself, immediately, without asking us:

• See and correct what we know. Your preferences screen lists everything the companion has inferred, and your profile details can be edited there.
• Delete a single memory or preference. From the same screen. Each one is individually removable.
• Delete a conversation. From the conversations menu in chat. Deleting a conversation removes the messages; what we learned stays unless you remove that too.
• Stop watching for a request. From the updates panel in chat.
• Turn off notifications. From your profile settings.
• Delete your account. From your preferences screen. Immediate and permanent.

For anything not covered by a button — a full copy of your data, or a question about how it is handled — email support@gobee.life. We will respond within 30 days.

If you are not satisfied with how we have handled your data, you can complain to the Saudi Data & AI Authority (SDAIA), which supervises the PDPL.

If a breach occurs that could harm you or your data, we will notify SDAIA within 72 hours of becoming aware of it, as the PDPL requires, and tell you directly where the breach is likely to affect you.

Gobee is not directed at children. If you are below the age at which you can give consent on your own, a parent or guardian must agree on your behalf. We do not knowingly collect data from a child without that consent, and will delete it if we find we have.

If this policy changes we will update the date at the top. Material changes will be announced in the app rather than made quietly.

Questions about your data? Email support@gobee.life.