Privacy Policy

1. Who we are

The data controller is JABB SARL, a company incorporated under Moroccan law with headquarters in Casablanca (trade registry and registered office on file). JABB LLC, a company incorporated under US law, is part of the same group. For any question about your data, email salim@jabb.cx.

• CNDP declaration F211: JABB platform.
• CNDP declaration F118: data transfer outside Morocco.

2. What this policy applies to

It covers all JABB services:

• the jabb.cx website and its language versions;
• the JABB mobile app (iOS and Android) and the jabb.cx/go redirect page;
• the business workspaces (JABB VOC, JABB CX, Sonar, Keeps, AI Experiences, Three) and the MCP server mcp.jabb.cx;
• the WhatsApp agent and feedback collection calls;
• our forms (demo, contact, partnership, application, resources, newsletter).

When JABB processes data on behalf of a client company (for example, its CCTV images with Keeps), the company is the data controller and JABB acts as a processor under a contract.

3. The data we process

We only collect what serves the measurement and improvement of experience:

• Account data: name, email, phone, language, encrypted password, preferences.
• Contributions: ratings, written reviews, voice notes, photos, answers to guided questions, completed missions.
• Location: GPS position at the time of a contribution or mission, only with your authorization, to verify your presence on site.
• Rewards: JABBeez balance and history, coupons earned and used.
• Technical data: device type, system, app version, IP address, security logs.
• Website analytics: page views, button clicks, scroll depth, visit source, linked to a random session identifier.
• Form data: name, work email, company, phone, message, role, and application link.
• Conversations with Jabby, our AI assistant, to improve its responses.
• Public data (Sonar): reviews, posts and articles published publicly online.
• CCTV footage (Keeps): processed on behalf of our clients, with no facial recognition.

4. Why we process it, and on what basis

Each processing activity relies on a legal basis:

• Provide the services and manage your account: performance of the contract.
• Verify contribution authenticity and prevent fraud: legitimate interest.
• Allocate and convert your JABBeez: performance of the contract.
• Produce analytics and reports for client companies: performance of the contract with those companies and legitimate interest.
• Improve the website, the app and our analytics models: legitimate interest.
• Send you the newsletter or a requested resource: consent, withdrawable at any time.
• Respond to a demo request, partnership inquiry or application: pre-contractual steps.
• Comply with our legal obligations and respond to authorities: legal obligation.

5. Golden Proof Protocol and fraud prevention

To ensure no fake review reaches a dashboard, every contribution is checked: server-side location verification, sealed timestamping, metadata and photo content analysis, and an AI-calculated quality score from 0 to 100. Caps apply (30 reviews per day, 5 reviews per 5-minute period, one review per establishment per 24-hour period). These checks are used only to guarantee data reliability and reward program fairness.

6. Keeps: AI vision on CCTV

Keeps analyzes camera feeds already installed by our clients to detect behaviors and objects (queues, footfall, hygiene, incidents).

• No facial recognition, no identification of individuals.
• Local processing preferred and minimization of transmitted data.
• Limited retention of images and events, based on the settings agreed with the client.
• The client remains responsible for informing filmed individuals (signage) and for the compliance of its video surveillance system.

7. Sonar: web and social media listening

Sonar only processes content made public by its authors (reviews, posts, articles). It does not access any private messages. Content is analyzed in aggregate to measure a brand’s reputation and that of its outlets.

8. Artificial intelligence

We use AI to transcribe, classify, summarize, and recommend. No decision producing legal effects concerning you is made solely on the basis of automated processing. If a contribution is rejected or JABBeez are not awarded to you, you may request human review at salim@jabb.cx. Models used for our enterprise clients may be their own models or models hosted for JABB; your data is not resold to third parties to train their models.

9. Who we share your data with

We never sell your data. It may be shared:

• with client companies, for contributions related to their outlets, in a format suited to their use;
• with our technical processors (hosting, database, email delivery, AI models), bound by confidentiality and security obligations;
• with partner merchants, only to validate coupon use;
• with authorities, when required by law.

10. Transfers outside Morocco

Some of our providers are located outside Morocco. These transfers are declared to the CNDP (declaration F118) and governed by contractual safeguards. For enterprise clients that require it, JABB can be deployed on on-premise infrastructure or a sovereign cloud.

11. How long we keep them

We keep data for as long as necessary for the purposes described, then delete or anonymize it:

• Account: for the duration of use, then three years after the last activity.
• Contributions: for the duration of the service; beyond that, they are kept only in anonymized and aggregated form.
• Commercial requests and newsletter: three years after the last contact, or until you unsubscribe.
• Applications: two years, unless early deletion is requested.
• Audience measurement: up to thirteen months.
• Keeps images and events: short duration defined with each client.

12. Security

We protect data with appropriate technical and organizational measures: encrypted communications (HTTPS), role-based access limited to what is strictly necessary, audit logs, environment separation, and backups. As no system is infallible, we will inform you, as well as the CNDP, of any data breach concerning you under the conditions provided by law.

13. Your rights

In accordance with Law 09-08, you have the right to access, rectify, object on legitimate grounds, and delete your data, as well as the right to withdraw your consent at any time.

• Write to salim@jabb.cx specifying your request.
• We may ask you to verify your identity.
• We respond within a reasonable time, and no later than the legal deadlines.
• You may also contact the CNDP (www.cndp.ma).

14. Minors

JABB services are not intended for children under 16. If you believe a minor has shared data with us, contact us so we can delete it.

15. Changes to this policy

We may update this policy to reflect our services or regulations. The update date appears at the top of the page; in the event of a material change, we will inform you.

16. Contact

JABB SARL · Casablanca, Morocco · salim@jabb.cx · +212 771 532 557