Privacy policy

Tbayin ("we", "us") runs tbayin.com, a service that helps organizations show their real-world impact with evidence. This policy explains what we collect, why, who we share it with and the choices you have. It applies to everyone who uses tbayin.com, in every country.

1. Who is responsible

Tbayin is responsible for the personal data described here. Contact us at admin@tbayin.com for any privacy question or request. Our registered company details will be added to this page.

2. What we collect

• Account details. Your name, email address and password. We store passwords only in hashed form, never in readable text.
• Organization details. Names in English and Arabic, legal name, country, type of organization and website domain.
• Free snapshots. The domain you enter. To keep snapshots private and limit abuse, we keep a scrambled (hashed) form of your session and IP address, never the raw IP address. Snapshots are deleted after 7 days unless you claim the organization.
• Public website content. When you request a snapshot or verify a domain, we read that website's public pages, respecting its robots.txt rules. We store the text of pages that may describe activities.
• Verification data. The result of DNS and website checks; for the emailed code, the address it was sent to and a hashed copy of the code; for work-account sign-in with Microsoft or Google, only the email domain and the organization (tenant) identifier, not your password or mailbox; and any documents you upload for our team to review.
• Files and exports you upload. For example an Instagram data export. From these we read only your posts, reels and stories. We do not read messages, contacts, login details or other personal files in the export.
• Your decisions and reports. Activities you confirm, edit or reject, partner confirmation requests (including the partner's email address), impact pages and PDF reports.
• Technical data. Server logs needed to run and secure the service, such as time, page and error messages.

3. Why we use it

• To provide the service you ask for: snapshots, verification, your impact record, impact pages and reports.
• To confirm that you represent the organization, so nobody can claim or publish an organization they do not manage.
• To send service emails, such as verification codes, notices that a domain is verified and partner confirmation requests. We do not send marketing emails without your permission.
• To keep the service secure, prevent abuse and fix problems.
• To meet legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and trustworthy service, your consent where we ask for it, and legal obligations.

4. What becomes public

Nothing about your organization is public until you verify your domain and choose to publish your impact page. You can make it private again at any time. Free snapshots are always private to the person who requested them. We do not show people's names or photos in snapshots.

5. Who we share it with

We do not sell personal data. We share it only with service providers who help us run Tbayin, under contracts that protect it:

• Akamai (Linode), which hosts our servers.
• Zoho, which delivers our emails.
• Cloudflare, which provides our domain name system (DNS).
• Microsoft or Google, only when you choose to verify with your work account.
• GLEIF, the global register of Legal Entity Identifiers, receives the organization name you search for; RDAP registries receive the domain name you check.

We may also disclose information when the law requires it or to protect the rights and safety of users and the public. If you ask a partner to confirm an activity, that partner sees the activity and your organization's name.

6. International transfers

Tbayin serves organizations worldwide, so your data may be processed in countries other than your own. When we transfer data, we use safeguards required by applicable law, such as contractual protections with our providers.

7. How long we keep it

• Free snapshots: 7 days.
• Emailed verification codes: 30 minutes.
• Account, organization and impact data: while your account is active, then deleted or anonymized within 30 days of a deletion request, unless the law requires us to keep it longer.
• Documents uploaded for verification: until our team has reviewed them and for as long as needed to show how the organization was verified.
• Our audit log, which records important actions such as verifications and publishing, is kept to protect the integrity of impact records. It contains account identifiers, not document contents.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to withdraw consent. Email admin@tbayin.com and we will answer within 30 days. You can also complain to the data protection authority in your country.

9. Cookies

We use only the cookies needed for the site to work: a session cookie that keeps you signed in and a security cookie that protects forms. We do not use advertising or tracking cookies.

10. Security

We use encrypted connections (HTTPS), hashed passwords and codes, private storage for uploaded files, and access limited to the Tbayin team. No system is perfectly secure, so we cannot guarantee absolute security, but we will tell you without undue delay if a breach affects your data.

11. Children

Tbayin is a service for organizations and is not directed to children under 16. We do not knowingly collect their personal data.

12. Changes

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account holders by email.