Privacy Policy

Effective 1 November 2026 · Last updated 1 November 2026

Who we are

Kashif is an automated website-audit service operated and billed by Chatwiser Inc., a Delaware corporation and a BottleTech company, at 8 The Green, STE R, Dover, DE 19901, USA. Kashif scores a website and lists what to improve, and it can re-audit a verified domain on a schedule. This policy explains what personal data we collect when you use Kashif at https://kashifaudit.com, how we use it, and the choices you have.

Chatwiser Inc. is the controller of the personal data described here. If you have any question about this policy, email us at hello@kashifaudit.com.

What we collect

We keep the data to a minimum. We collect:

• Your account email. You give us an email address to create and sign in to your account.
• The website URLs you submit. These are the sites you ask Kashif to audit.
• Audit results. The scores and the list of improvements Kashif produces for the sites you submit.
• Usage and log data. Basic technical records such as your IP address, browser type, the pages you open in Kashif, and the dates and times of your actions. We use these to run the service and keep it secure. We also record first-party usage events tied to your account (for example, a dashboard page viewed, a finding opened, or an AI tool called) on our own servers, and keep them for up to 180 days. They carry a short code for what happened, never the text of your website. We use no third-party trackers for this.
• Your password, if you set one. We store only a one-way scrambled form of it (a hash). We do not store or log the password itself, and we cannot see or recover it. You can choose a new one with an email link.
• Sign-in records. When you sign in, and whether you used an email link or a password, with your IP address.
• Your businesses. The name and website of each business in your account, and whether it is active, paused because of your plan, or removed.
• AI tool keys. If you make an API key, we store the name you give it, which tool it is for, the last four characters, when it was made, last used and expires, and a one-way fingerprint (a SHA-256 hash) of the key. We never store the key itself. We also count how many requests each key makes per day, and record first-party usage events for AI tool use (for example, which tool was called), with no website text in them.
• Connected apps. If you allow an app such as Claude or ChatGPT to connect, we store which app it is (from a short list we keep), when you allowed it, when it was last used and when it ends, and one-way fingerprints (SHA-256 hashes) of its passes. We never store the passes themselves. We count requests per day, as for keys.

Payments. If you subscribe to Pro, your payment is handled by Stripe. Stripe collects and stores your card details. Chatwiser Inc. never sees or stores your full card number. We receive limited billing information from Stripe, such as your subscription status, so we can manage your subscription.

Google Search Console, if you connect it. If you choose to connect Google Search Console, you sign in to Google and allow Kashif to read your Search Console data. The access is read-only: Kashif cannot change anything in your Search Console.

• What we read, and why. We read the list of Search Console properties your Google account can see, only to find the one that covers the website you added. Then we read that one property's search results data: clicks, impressions, average position, your top searches, and the pages that gained or lost clicks, for the last 28 days and the 28 days before. We show it to you on your Kashif dashboard, next to your audit, and in one line of your re-check email. We read it once a day.
• What we store. An encrypted key for your Google connection, up to five brand words you type, and the newest set of numbers for your site. Each day's fetch replaces the one before, so we keep no history of it. The search words and page paths are your data, and you are the only one who sees them in Kashif.
• Disconnecting. You can disconnect at any time from the Google Search page. We then delete our copy of your numbers and ask Google to remove Kashif's access. If the connection stops working and you do not reconnect, we delete what is left after 30 days. You can also remove Kashif yourself at myaccount.google.com/permissions.
• Backups. Our nightly backups keep copies of this data on our server for up to 14 days, and a separate Oracle Cloud storage bucket holds daily copies for up to about two months and monthly copies for up to a year.
• What we do not do. We do not sell this data, we do not use it for ads, and no person at Kashif reads it.

Kashif's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How and why we use your data

• To create your account and sign you in.
• To run the audits you request and show you the results.
• To run recurring re-audits on a domain after you have verified it (see below).
• To give you the 14-day free trial of paid features, if one is on offer. The trial needs no card and does not go through Stripe. Nothing is billed unless you choose to subscribe.
• To manage your paid subscription, including plan changes, through Stripe if you subscribe.
• To tell you by email when someone tries to sign up with an address that already has an account. That email only points to the sign-in page. It has no link that signs anyone in.
• To write the findings of your audits, with the help of AI model providers (see "Who we share it with").
• To let AI tools that you connect with a key, and apps that you allow to connect, read your results, as described in the Terms. We email you when an app is connected.
• To send you transactional email, such as sign-in help, audit results, and account or billing notices.
• To keep the service secure, prevent abuse, and fix problems.
• To meet our legal and accounting obligations.

We do not use your data to build advertising profiles, and we do not sell it.

Domain verification

Recurring re-audits only run after you prove you control the domain. You do this by adding a DNS TXT record we give you. We read that record to confirm you control the domain before we schedule any recurring audit.

Legal bases

Where the law requires a legal basis to process personal data, we rely on:

• Performance of a contract. We need your email, submitted URLs, and audit results to give you the service and manage your subscription.
• Legitimate interests. We use log data to keep Kashif secure, prevent abuse, and improve how it works.
• Legal obligation. We keep certain records, such as billing records, to meet tax and accounting rules.
• Consent. Where we ask for your consent for a specific purpose, you can withdraw it at any time.

We serve customers in Saudi Arabia, the United Arab Emirates, and Jordan, and we also work to meet the data protection laws of those countries. These include Saudi Arabia's Personal Data Protection Law (PDPL), overseen by the Saudi Data and AI Authority (SDAIA), and the personal data protection laws of the United Arab Emirates and Jordan.

Who we share it with

We do not sell your personal data. We share it only with the service providers we need to run Kashif, and only for that purpose. These sub-processors are:

• Stripe — payment processing. Stripe handles your card details and subscription billing.
• Oracle Cloud Infrastructure (Oracle) — hosts Kashif and stores its data, including nightly backups, in Oracle's data centre in Jeddah, Saudi Arabia.
• Our email delivery service (SMTP) — sends the transactional email described above.

AI model providers. To write your findings, we send the content of the website you ask us to check (text and, for some checks, screenshots), and the photos you upload for menu reading, to AI model providers. Today we use Anthropic (Claude). We may also use OpenAI, DeepSeek or Moonshot AI (Kimi). We do not send them your payment details. They get only what is needed to give the written findings back to us.

AI tools and apps you connect. If you make an API key or allow an app such as Claude or ChatGPT to connect, you choose to send your Kashif results to that tool or app. It is run by another company, it is not our sub-processor, and we do not control what it does with the data. Its own privacy policy applies. You can stop it at any time by revoking the key or disconnecting the app. A connection also ends ninety days after you allowed it, or after thirty days without use. We do not send Google Search Console data or Google business-profile results to AI tools.

We may also disclose data if the law requires it, or to protect our rights, our users, or the public. If Chatwiser Inc. is involved in a merger or sale, data may be transferred as part of that, and this policy will continue to apply.

International data transfer

Chatwiser Inc. is a US company. Your account and audit data are stored in Saudi Arabia, in Oracle's data centre in Jeddah, together with their nightly backups. Payment data is held by Stripe in the United States. Email goes out through our mail provider. The text we send to AI model providers is processed where they operate: Anthropic in the United States, and OpenAI, DeepSeek or Moonshot AI if we use them. Data protection laws in those places may differ from the laws where you live. We put data-processing terms in place with our service providers that require them to protect your data and to use it only for the services they provide to us.

Data retention

We keep your data for as long as your account is open and you use Kashif. If you close your account or ask us to delete your data, we delete your account email, submitted URLs, and audit results within 30 days, unless we must keep some of it to meet a legal obligation. We keep sign-in records, activity logs and first-party usage events for up to 180 days, and then remove them. Our nightly backups keep copies of our database on our server for up to 14 days. We also keep backup copies in a separate Oracle Cloud storage bucket: daily copies for up to about two months and a monthly copy for up to a year, plus one copy we take by hand, kept until the next one replaces it. So data we have removed can sit in a backup for as long as the copy is kept. We keep billing records for as long as tax and accounting rules require, which is usually several years.

If you remove a business, we stop checking it and hide it, but we keep its past results until you ask us to erase them by emailing hello@kashifaudit.com. Expired and revoked API keys and ended app connections are removed from our records ninety days after they end. Their per-day request counts are removed with them.

Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your data.
• Export a copy of the data you gave us.
• Object to processing we base on our legitimate interests.
• Restrict how we process your data while we look into a request.
• Withdraw consent at any time, where we rely on your consent. This does not affect processing we did before you withdrew it.
• Complain to a data protection authority.

To exercise any of these, email us at hello@kashifaudit.com. We will respond within a reasonable time. You can also update your account email from within Kashif, and you can manage or cancel your subscription in the Stripe billing portal. If you believe we have not handled your data properly, you can complain to a data protection authority — for example, the Saudi Data and AI Authority (SDAIA) in Saudi Arabia, or the relevant authority in the United Arab Emirates or Jordan.

Cookies and sessions

Kashif uses cookies to keep you signed in, to remember your session, and to remember which of your businesses you were looking at last. While you approve an app connection, it also uses a short-lived cookie that lasts up to ten minutes. These are needed for the service to work. We do not use advertising cookies or third-party tracking cookies. If you block the cookies Kashif needs, you may not be able to sign in.

Security

We protect your data with reasonable technical and organizational measures. Traffic to Kashif is encrypted with HTTPS. If you set a password, we store only a one-way scrambled form of it (a hash). We never write the password itself to our records or logs, and we cannot see or recover it. We limit how often a password can be tried, and after many wrong tries we turn the password off until you choose a new one with an email link. API keys and app passes are stored the same way as passwords: only a one-way fingerprint (a SHA-256 hash), so we cannot read one back. Access to the systems that hold your data is limited to people who need it. Stripe handles card data on its own secure systems, so we never store card numbers. No service can promise perfect security, but we work to keep your data safe and to fix problems quickly. If a breach affects your personal data, we will act quickly to contain it, and, where the law requires it or the risk to you is significant, we will tell you and the relevant data protection authority without undue delay.

Children

Kashif is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email hello@kashifaudit.com and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make an important change, we will update the date at the top of the page and, where appropriate, tell you by email. If you keep using Kashif after a change, that means you accept the updated policy.

Contact

For any question about this policy or your data, email hello@kashifaudit.com. You can learn more about the company at https://bottletech.net.

العربية