Privacy Policy

1. Who is responsible

DBU Group is the data controller for the accounts it creates and the operator of Kapten. Registered address: [to be confirmed]. Commercial registration: [to be confirmed].

For the information a company puts into Kapten about its own business, its customers and its staff, that company decides what is entered and why; DBU Group processes it on the company's behalf to provide the service.

A person a company invites into a shared room as a guest (for example a board member or an advisor) holds an account with DBU Group; what they write in that room is shared with the company that invited them.

Contact for anything in this policy: hello@dbugroup.net.

2. What we hold

Account: your name (and, if you give it, your name in Arabic), your work email, a one-way hash of your password, your two-step sign-in settings, your language and role.

Access requests: the name, email, phone, company, country, sector, size and message you send when asking for access.

Your company's material: the profile you enter, the documents you upload, the facts, decisions, reports, research and plans created in Kapten.

Conversations with Ask Kapten and with Amal (support). Ask conversations are private to the person who had them, even inside their own company.

Shared rooms: if a company invites you as a guest, your name, email, the title the company gave you (for example “Board member”), the views you give on decisions and the messages you write in the room. The company that invited you sees them.

Market watch: the topics a company chooses to follow (a competitor, a sector, a regulation) and the public news items found about them, each with its link.

Records that keep the service safe and fair: sign-in events (time, address and browser; your email is stored only as a hash), usage of your package's allowances, and an audit trail of significant actions.

We do not collect payment card details: invoices are paid by bank transfer.

Please do not upload sensitive personal data about individuals — health, religion, criminal records and the like — unless it is genuinely needed; the company that uploads it is responsible for having a lawful basis to do so.

3. Why we use it

To provide the service you or your company signed up for (contract).

To keep accounts secure, prevent abuse and investigate problems (legitimate interest).

To bill for the package and keep financial records (legal obligation and contract).

We do not sell personal data, and we do not use it for advertising.

The analysis engine studies a company's business. It makes no decision about any individual that has legal or similarly significant effect; people decide.

4. Who else processes it

Hosting — Kapten runs on servers rented by DBU Group, where all company data is stored, encrypted documents included. Provider and region: [to be confirmed].

Anthropic (United States) — when your company uses the cloud analysis engine, the relevant company context, documents and questions are sent to Anthropic's Claude models to produce answers. Under Anthropic's commercial terms, this data is not used to train its models. Organisations that do not enable the cloud engine are served by a local engine and nothing leaves our servers for analysis.

Web searches for research and market watch are run through Anthropic's search tool. A search carries only the question — for example a sector, a country or a competitor's name — never your personal data or your company's figures.

Backblaze (cloud storage) — nightly backups, encrypted before they leave our server with a key Backblaze does not hold, kept for up to 31 days. Region: [to be confirmed].

Your browser's speech service — only if you press the microphone in Ask. In Google Chrome the audio is processed by Google to turn it into text; nothing is sent to Kapten until you press Ask.

Public data sources — World Bank, IMF, exchange-rate publishers and OpenStreetMap receive only the search terms needed for market research (a country, an indicator, a place), never your personal data.

Email delivery — a provider will send account and notification emails. Provider: [to be confirmed].

5. Transfers outside Bahrain

Some processors above are outside Bahrain, including in the United States. We transfer personal data abroad only as far as the service needs, under contractual safeguards with each processor, and on a basis the Personal Data Protection Law allows: because the transfer is necessary to provide the service you or your company asked for, or with your consent.

[to be confirmed]: counsel to confirm the transfer basis for each country and whether the Authority must be notified or must authorise it.

6. How long we keep it

A conversation you delete is removed permanently after 30 days; the words of Ask answers are cleared from our operational records after 30 days.

When a company asks to delete its organisation, there is a 30-day period in which it can withdraw the request; after that its data is deleted. Encrypted backups expire within 31 days of that.

The audit trail of a deleted organisation is kept for 60 days and then archived, encrypted, for [to be confirmed] (proposed: five years, for legal claims), then deleted. Invoices are kept for as long as the law requires financial records to be kept.

A guest removed from a shared room loses access at once. What they wrote stays in the room as part of the company's record until the company's organisation is deleted.

Market-watch items are kept while the company keeps its organisation; a company can hide any item at any time.

Sign-in records (time, address and browser; your email only as a one-way code) are kept for 12 months for security and then deleted — for every account, closed or not.

When your account is deleted, your name, email, password, sessions and private conversations go; what you did inside a company's record stays there under “Former user”.

7. Your rights

You may ask to see the personal data we hold about you, to correct it, to have it deleted, to object to a use of it, or to withdraw a consent you gave. A company owner can download all of the company's data from Settings.

You can delete your own account at any time in Settings › Data and privacy (guests: at the foot of their room). It is deleted 14 days after you ask; until then you can sign in and keep it, and we email you when you ask, two days before, and if you keep it. After the 14 days it cannot be undone.

Write to hello@dbugroup.net; we answer within 30 days. You may also complain to Bahrain's Personal Data Protection Authority.

8. How we protect it

Each company's data is separated at the database level, so one company cannot read another's. Stored documents are encrypted, backups are encrypted, team access to the platform needs two-step sign-in, and every cross-company access by DBU staff is logged with its reason. A guest sees only what was shared into their room.

If a breach puts personal data at risk, we will tell the companies and people affected, and the Personal Data Protection Authority, as the law requires and without undue delay.

9. Cookies

We use only what the service needs to work: a sign-in cookie, a cookie that remembers your language, and one that remembers which company you are working in. Your browser also keeps your theme and the hints you have closed. There are no advertising or analytics cookies.

10. Changes

If this policy changes in a way that matters, we will tell account holders before it takes effect.