--- title: "Privacy Policy: How Karobar Protects Your Data" url: https://karobar.io/privacy language: en description: "How Karobar collects, uses and protects your account data and your customers’ messages, including data from Meta, Google and YouTube." --- Legal # Privacy Policy Last updated: 4 October 2026. This policy explains what Karobar Software collects, why, who we share it with, and how you can exercise your rights. ## Who we are Karobar Software (61-B, Faisal Town, Lahore, Pakistan) operates Karobar, a shared inbox and CRM for social sellers. We are the data controller for your Karobar account and for the personal data we need to run the service (billing, login, support). When you use Karobar to message your own customers, you are the controller of their data. We process that data on your instructions, only to provide the Service. ## What this covers This policy covers the Karobar.io website, the Karobar iOS and Android apps, and the web CRM at app.karobar.io. ## What we collect What we collect depends on how you use Karobar. - Account details you provide: name, email address, phone number and password. - Business data you create in the workspace: contacts, leads, conversations, orders, bookings, products and team members. - Data from channels you connect: messages, comments, profile names and avatars, and advertising or engagement metrics from WhatsApp, Instagram, TikTok, Facebook Pages, YouTube and Google Business Profile. - Technical data needed to run the service: device push tokens, session identifiers, IP address at the time of a request, and error logs. - Payment metadata from our payment partners when you subscribe: billing name, email and transaction references. Card numbers are entered on the payment partner’s own checkout and are never stored on Karobar. - Product usage data: which screens you open and which features you use in the web CRM and the apps, the app version and type of device, and the fact that a screenshot or screen recording was made while the app was open. We record only the name of the screen, never the image. - Approximate location: the city and country worked out from the IP address of the device you use, so we can see where our customers are. We do not use GPS and do not ask your device for its location, and we do not store the IP address with this record. ## Our mobile apps The iOS and Android apps collect the same data as the web CRM. They also use these phone features, only when you use them: contacts you pick from your phone to add to a WhatsApp phonebook, your location when you tap Use my location to fill in your business address, and the camera and microphone for photos and voice notes you send in chats. Subscriptions bought in the apps are sold and billed by Apple (App Store) or Google (Google Play). They send us the purchase details we need to activate your plan; we never see your card. You manage or cancel those subscriptions in your Apple or Google account. On iPhone, connecting Facebook or Instagram uses Facebook Login, provided by Meta. The apps use Firebase to deliver push notifications. ## Google user data If you connect a Google account to Karobar, we access, use, store and share Google user data only as described in this section, and only after you complete Google’s consent screen. When you connect, Google may share your name, email address and profile photo so we can identify the Google account you authorised (userinfo). Google Business Profile: we access the locations you manage, their reviews, and review replies. We use this only to show Google reviews in Karobar and to post or delete replies you send from the product. YouTube: Karobar uses YouTube API Services. We access channel identity, videos, comments and analytics for the YouTube channels you connect. We use this only to provide YouTube inbox, comments, publishing and insights inside Karobar. By using YouTube features you also agree to [YouTube's Terms of Service](https://www.youtube.com/t/terms). How Google treats data is described in the [Google Privacy Policy](https://policies.google.com/privacy). Access: we retrieve this data through Google OAuth after you click Connect. Use: we use it solely to operate the matching Karobar features you turned on. Store: we store encrypted access tokens and a synced copy of the connected Google Business Profile and YouTube data in your workspace. Share: we do not sell Google user data. We do not use it for advertising. We share it only with Stripe or PayFast, Cloudflare R2, Google Cloud (Vertex AI), our other AI service providers, Firebase, and our email provider when they are required to run those features, with the connected Google service itself when you take an action (for example posting a review reply), or where the law requires it. You can disconnect Google Business Profile or YouTube in Karobar Settings. You can also revoke Karobar’s access at any time from your [Google Account permissions](https://myaccount.google.com/permissions). Disconnecting or revoking stops new access; see retention below for what happens to already-synced copies. ## Limited Use of Google user data Karobar’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve user-facing features that are prominent in Karobar. Today, those are Google Business Profile reviews and YouTube inbox, comments, publishing and insights. We do not transfer Google user data to third parties except to run those features (with your consent), for security and abuse investigation, to comply with law, or as part of a merger or sale of Karobar after obtaining your prior consent. We do not use Google user data to serve ads, including retargeting or personalised advertising. We do not sell it to data brokers or use it to determine credit-worthiness. Humans do not read Google user data unless you ask us to look at specific items for support, it is necessary to investigate a security or abuse issue, it is required by law, or the data is aggregated for internal operations. ## How we use it To operate the product: delivering and syncing messages, drafting replies with AI where you ask for it, managing orders and contacts, and sending notifications you have enabled. To bill you and to prevent abuse such as automated signups and credential stuffing. To provide support when you contact us. We do not sell your data or your customer lists, and we do not use your business data to train third-party AI models. ## AI features When you use an AI feature, the relevant message or content is sent to our AI providers to generate a response. Today those are Google Cloud (Vertex AI and Gemini) and our other technology partners. They process it to return a result for you; they are not permitted to use it to train their models. That Google Cloud processing is Karobar sending content you already have in the product. It is not access to your Google Account. AI features are optional and are only invoked when you use them. ## Product usage analytics and session recordings We record how Karobar is used so we can see where people get stuck and improve the product: screens opened, features used, sign-ins, channels connected, and screenshot or screen-recording events. This is stored on our own servers, linked to your account, kept for up to 180 days and seen only by Karobar staff. We never record the content of your messages, comments, media, contacts or customer details. In the web CRM and the apps we may also use Microsoft Clarity to make session recordings: a replay of the taps, clicks, scrolling and screens you move between. Text and images inside the product are hidden before anything leaves your device or browser, and chats, customers, media and anything you type are never captured. Microsoft processes these recordings for us as a service provider under the Microsoft Privacy Statement. If you are in the European Economic Area, the United Kingdom or Switzerland, we ask before session recording starts, and it stays off unless you choose Allow. Elsewhere it is on by default. Anyone can switch it off at any time in Settings → Account → Session recordings. ## Who we share it with Only the providers needed to run the service, each of which handles a specific job: payment partners (PayFast for Pakistan when enabled, Stripe for other markets), Cloudflare R2 for stored media, Google Cloud (Vertex AI) and our other technology partners for AI features, Firebase for push notifications, and our email provider for transactional email. The messaging and social platforms you connect receive only what is necessary to send and receive on your behalf. Some providers may process data outside Pakistan. We also disclose data where the law requires it. When session recordings are switched on, Microsoft Clarity receives the masked recordings described above. Microsoft does not receive your messages, customers or media. ## Cookies The marketing site and the web CRM store cookies and similar data that are needed to keep you signed in, remember language and theme, and, on the marketing site only, count visits. Details, including how to block them, are in our [Cookie Notice](https://karobar.io/cookies). ## How long we keep it Business data is kept for as long as your account is active. When you delete your account we schedule the whole workspace for deletion and hold it for 14 days so it can be restored if you change your mind, after which it is permanently destroyed. Some records, such as invoices, are kept longer where tax or accounting law requires it. Channel history you import can be purged earlier from the channel settings. If you disconnect Google Business Profile or YouTube, we revoke the access tokens immediately. Synced Google and YouTube data is deleted or refreshed within 30 days of disconnect or of Google access being revoked. Product usage events are deleted after 180 days. Microsoft Clarity keeps session recordings for 30 days, except recordings we mark to keep, which it holds for up to 13 months. ## Your rights Depending on where you are, you may have the right to access, correct, export or delete personal data, to withdraw consent, and to lodge a complaint with a supervisory authority. In Karobar you can access and correct your account details, export your data, and delete your account at any time from Settings, from the app, or from our [account deletion page](https://karobar.io/account-deletion) without installing anything. To withdraw Google access, disconnect the channel in Settings or use [Google Account permissions](https://myaccount.google.com/permissions). To exercise any other right, or if you have questions about how we handle your data, contact us at [support@karobar.io](mailto:support@karobar.io) or [03054410164](tel:+923054410164). ## Security Data is encrypted in transit. Passwords are hashed and never stored in readable form. Access tokens for connected channels are stored encrypted and are revoked when you disconnect a channel or delete your account. Sessions can be revoked server-side, and changing your password ends every existing session. ## International transfers Some providers process data outside Pakistan, including in the United States and the European Union (Stripe, Cloudflare, Google Cloud and Firebase among them). We use them only to run the Service. Microsoft Clarity session recordings may be processed in the United States. ## Children Karobar is a business product and is not intended for anyone under 18. We do not knowingly collect data from children. ## Changes to this policy We post updates to this page. If we change how we use Google user data, we will update this policy before we use that data in a new way. ## Contact Questions about this policy, or a request about your data, can go to [support@karobar.io](mailto:support@karobar.io), [03054410164](tel:+923054410164), or by post to 61-B, Faisal Town, Lahore, Pakistan. [Back to home](https://karobar.io/)