Privacy policy
Draft under legal review. The final text will be published after a lawyer has reviewed it.
Who we are and how to reach us
BesBes (بسبس) is an app and a website (besbes.app) for selling and adopting pets, a directory of vets and pet shops, lost-pet alerts and pet-care guides. BesBes is currently run by its two founders as individuals: [👤 founders' legal names], [👤 postal address], Arab Republic of Egypt. We are the "controller" of your data under the Personal Data Protection Law No. 151 of 2020 (the "Law"). When we form a company to run BesBes, it will take over this role and we will tell you in the app.
- Data protection officer: [👤 name] — privacy@besbes.app
- General support: support@besbes.app
This policy covers the BesBes app for Android and iPhone and the website besbes.app in Arabic and English.
The data we collect
We only collect what we need to run the service safely. Some data you give us; some comes from using the app.
| Category | What we collect | When | Required? |
|---|---|---|---|
| Account | Your e-mail address, the name and profile picture Google or Apple share with us, and the ID the sign-in service gives us | When you sign in | Yes, to have an account |
| Profile | Display name, governorate, optional bio, app language | When you add or change them | Display name only |
| Phone number | The number you verify with a WhatsApp code, and the contact number you put on a listing or alert | When you verify or post | For selling dogs and for listings that need contact |
| Listings and alerts | Photos, description, pet details (species, breed, age, colour, vaccination, pedigree), licence number, microchip number, document photos (vaccination card or licence), price, area | When you post | Depends on the listing |
| Reels | The videos you post (we convert them to a smaller format and keep a cover image and three still frames for the safety check), the caption, and the species, pet and listing you tag; your likes, comments and follows | When you post or use reels | No |
| Location | (1) your phone's approximate position (about 1 km) for "BesBes call" nearby alerts, if you turn them on; (2) a rounded position (about 100 m) sent with a search when you choose "nearest", not saved to your account; (3) the place a lost or found pet was last seen, which you set; (4) where you saw a pet when you tap "I saw this pet!" | Only with your permission or when you set it yourself | No |
| Activity | Favourites, saved searches, reports, blocks, reviews, business claims, and taps on the contact button (who tapped which listing, and when) | As you use the app | No |
| Invites | Your invite code; how many friends joined with it and verified their phone; the code you entered; a random ID for this app installation, which we keep only as a one-way hash, so one phone can't collect invite gifts for several accounts | When you open "Invite friends" or enter a code | No |
| Views | When a listing, a business page, a reel or a sponsored ad is shown to you: a code made from your account, or, if you aren't signed in, from your IP address and browser type, mixed with a secret key that changes every day, so each person is counted once a day (a sponsored ad: a few times at most, and then it isn't shown to you again that day). We don't store the IP address for this, and the codes and keys are deleted after 2 days | Automatically | — |
| Questions to "Ask BesBes" | Your messages to the AI assistant, the photos you attach to them (up to 3 a question; we check them automatically for unsuitable content), its answers, and your daily message count. If you speak a question, your phone turns your voice into text (on Android and iOS the phone's speech service, run by Google or Apple, may process the audio under their own terms); BesBes never receives or stores your voice, only the text you choose to send | When you use the assistant | No |
| Device | Push notification token, operating system, app version, language, when you last opened the app | When you sign in on a phone | Only for notifications |
| Payments | What you bought (such as a listing boost), the amount, the status, the payment provider's reference and, for a card, its brand and last 4 digits for your receipt. Card and wallet details go straight to Paymob or Apple: we never see a full card number and never keep a wallet number | When you buy, once paid features are available | No |
| Listings our team posts for you | If you ask us to post listings for you (founding sellers and shelters): a screenshot of your written permission, and which team member posted them. For a shelter, also the organisation's name, governorate, website and Instagram account | When you ask us | No |
| Advertisers | If your business buys ads from us: the business name, the name, phone number and e-mail of your contact person, and the campaign details. Kept by our team to run the campaign, never shown in the app | When you buy ads | — |
| Technical | Server logs (IP address, device or browser type, time, page requested) and crash reports (device model, system, app version, where the error happened) | Automatically | — |
| Analytics | Anonymous usage events (screens opened, buttons tapped, errors) | Only if you turn on "Help improve BesBes" | No, and off by default |
What we don't collect: your contacts, text messages, call log, background location, voice recordings, advertising ID, bank card details or national ID number (for now).
Sponsored ads: BesBes shows a few ads that our team sells directly to pet businesses (food, clinics, shops). Each is labelled «Sponsored» and has "Why am I seeing this ad?" and "Report this ad". An ad is chosen only by where it appears and what's on the screen (the species, the governorate and the language you're looking at), never by your data, your pets or what you've done in the app. Advertisers who buy from us get nothing about you: only how many times their ad was seen and tapped, in totals. These totals are kept whether or not you turn on "Help improve BesBes", because they hold no personal data; the anonymous analytics events about ads (seen, tapped) are sent only if you turn it on.
Google ads in unsold ad spaces: when no sponsored ad was sold for a space, the same space may show an ad from Google instead — Google AdMob in the app (on Home, in the guides and at the top of the services directory) and Google AdSense on the website's guide pages — labelled «Ad · by Google». Never in reels, listings, posting, payments, chats, "Ask BesBes", Lost & Found or your account screens. To show such an ad, Google receives your IP address, device or browser information and app or page information, and may use cookies or similar identifiers to show the ad, limit how often you see it, measure it and prevent fraud. We ask Google for non-personalized ads: they are chosen by context and rough location (from the IP address), not by a profile of you. The Android app doesn't give Google your advertising ID, and the iPhone app doesn't ask to track you. Where the law requires consent (for example in the European Economic Area and the UK), Google asks you first, and only if you agree there may ads be personalized. Google is responsible for these ads and for its own use of the data (policies.google.com/technologies/partner-sites).
The website keeps your language choice in your browser, and your sign-in session only if you sign in (for example, to delete your account). Apart from Google's ads on guide pages (above), we use no advertising cookies.
Why we use your data
| Purpose | Examples | Basis |
|---|---|---|
| Running your account and the service | Publishing your listings and alerts, showing your favourites, sending the notifications you asked for, connecting you with a seller on WhatsApp | Providing the service you asked for |
| Stats for sellers and businesses | How many people saw, contacted or saved a listing, and how many saw a business page or tapped its buttons (call, WhatsApp, directions, website, Book), as daily totals | Our legitimate interest in helping sellers and businesses see how they're doing |
| Safety and fraud prevention | Automatic and human review of listings, duplicate-photo checks, usage limits, handling reports, blocks and suspensions | Our legitimate interest in a safe platform, and our legal obligations |
| Following the law | Applying Law No. 29 of 2023 on dangerous animals and dogs and Ministerial Decree No. 218 of 2025 (banned and conditional breeds, licence numbers), answering the authorities, tax records | Legal obligation |
| "BesBes call" alerts | Telling people nearby about a lost or found pet | Your consent (switch it on and off in settings) |
| The AI assistant | Answering your pet-care questions | Your request |
| Improving the app | Learning which screens break or confuse people | Your consent only |
| Sponsored ads | Showing labelled ads that fit the screen they're on, showing the same ad to you only a few times a day, and telling advertisers how many times their ad was seen and tapped, as totals | Our legitimate interest in funding BesBes, without profiling you |
| Google ads in unsold ad spaces | Letting Google show a non-personalized ad where no sponsored ad was sold | Our legitimate interest in funding BesBes; where the law requires it (EEA, UK), your consent in Google's form |
We don't sell or rent your data or use it for targeted ads (Google may personalize its ads only if you agree in Google's own consent form, where one is shown). No automated decision affects you on its own: automatic checks help our reviewers, and a person makes the final call on sale listings.
Who sees your data and who we share it with
Everyone, including visitors: published listings with their photos, description, pet details and area, your display name, the date you joined and your verification badges; lost and found alerts with a location rounded to about 300 m (only the person who posted sees the exact spot); reviews with your display name; business pages, including any offer the business is running. Live reels with their video, caption, the pet and listing you tagged and the number of likes, also on the share page our website shows for a reel link; comments on reels with your display name; and your public profile: display name, picture, governorate, how many people you follow and follow you, and your live reels. If you share your invite link, whoever opens it sees your first name.
Signed-in users only: when a signed-in user taps "Contact" on your listing, they get a WhatsApp or call link to the contact number you chose for that listing. Visitors never see your number, and people you've blocked can't get it. Document photos (such as a vaccination card) are shown to signed-in users only.
Sellers and business owners: numbers only — how many people viewed, contacted or saved their listing or page each day, never who. A business on Business Pro also sees how many people tapped each of its buttons. When you tap "Book" on a business page, WhatsApp opens with your request (service, day and time) for you to send; the business only gets it if you send it, and we keep the tap, not what you picked.
The person who posted an alert: when you tap "I saw this pet!", we send them where and when you saw the pet and your note, without your name or number.
WhatsApp chats: once you open WhatsApp from BesBes, the conversation is covered by WhatsApp's policy, not ours.
The BesBes team: reviewers see only what they need to review listings and reports.
Service providers (they process data only for us and on our instructions):
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database and sign-in | Frankfurt, Germany |
| Google Cloud Run | App and website servers | European Union |
| Cloudflare (including R2) | Photo and video storage, website delivery and protection | Global network |
| Google and Apple | Signing in with your accounts there | United States and worldwide |
| Google Firebase Cloud Messaging and Apple Push Notification service | Delivering notifications to your phone | Worldwide |
| Meta (WhatsApp Business Platform) | Sending phone verification codes | Worldwide |
| OpenAI | Checking listing text, and reel captions and still frames, for prohibited content | United States |
| Google Cloud Vision | Checking listing photos and the photos you send to "Ask BesBes" for unsuitable content | Worldwide |
| Anthropic (Claude) | "Ask BesBes" answers, including the photos you attach to a question — Anthropic doesn't use API data to train its models by default and deletes it within 30 days, except for safety or legal reasons | United States |
| Google Maps | The map in the services directory (Google receives usage data under its own policy) | Worldwide |
| PostHog | Analytics, only if you agree | [👤 European Union] |
| Google AdMob and Google AdSense | Showing an ad in an ad space nobody bought (an independent controller for its ads, under Google's own privacy policy) | United States and worldwide |
| Sentry | Crash reports | [👤 EU or United States] |
| Paymob and Apple | Payments, once paid features are available | Egypt / worldwide |
Authorities: we disclose data when the law, a court order, the Public Prosecution or a competent authority requires it (for example the Veterinary Directorates on Law 29 of 2023 matters), or to protect a person or an animal from serious harm.
If BesBes changes hands: if a company is formed or the service moves, the data moves with it and this policy keeps applying until we tell you otherwise.
Transfers outside Egypt
Our servers and database are in the European Union (Germany), and some providers are in the United States and other countries. The Law and its Executive Regulations (Ministerial Decree No. 816 of 2025) require a licence or permit from the Personal Data Protection Center for cross-border transfers, to countries that offer adequate protection. [👤⚖️ status of our application to the Center — the lawyer sets this before publishing]. We only use providers who are contractually bound to protect data and who use encryption. By using BesBes you agree to these transfers for the purposes in this policy.
Your choices
- Analytics: off until you turn them on in Me → Privacy & data; turn them off at any time.
- Google ads: non-personalized by default. Where Google asked for your consent, change your answer at any time in Me → Privacy & data → Ad choices (app) or with Google's privacy link on the website. Google's "AdChoices" icon on each ad explains it and lets you report it.
- Notifications and "BesBes call": per phone, in Me → Notifications. When you turn off "BesBes call", we delete your approximate location at once.
- Location permission: optional. Without it, you pick your area by hand.
- Camera, photos and microphone: optional. The phone asks only when you first add a photo or tap the microphone in "Ask BesBes" (we explain why first), and you can turn them off in your phone's settings. Without them you type your questions. Only the photos you pick are uploaded. "Read answers aloud" uses your phone's own voice and sends nothing.
- Contact number: you choose it for each listing, and you can delete a listing at any time.
- Block and report: you can block any user and report any listing or review.
Your rights
Under the Law you have the right to:
- know what data we hold about you, see it and get a copy;
- withdraw your consent at any time (this doesn't affect what happened before);
- correct, edit, add to or update your data;
- have your data erased;
- limit processing to a specific scope;
- be told about any breach of your data;
- object to processing or its results when it conflicts with your fundamental rights and freedoms.
How to use them: most of these rights are built into the app (edit your profile and listings, download a copy of your data, delete your account). For anything else, write to privacy@besbes.app from the e-mail address of your account. We may ask you to prove who you are. We answer as soon as we can, within the time the Law sets, free of charge. If you're not happy with our answer, you can complain to the Personal Data Protection Center.
How long we keep data
| Data | How long |
|---|---|
| Your account, listings and alerts | As long as your account exists. Expired listings stay in your account so you can renew them |
| An account you deleted | Your live listings and lost-and-found alerts come down at once; your phones, inbox, "Ask BesBes" conversations, pet reminders and pet card links are deleted at once; everything else is erased for good after 30 days, including your photos, your pets' cards and your sign-in record |
| A listing or alert you deleted | Disappears at once; we keep a hidden copy for 90 days to handle reports, fraud and legal requests, then erase it and its photos |
| A reel you deleted, or one we removed | Disappears at once; we keep a hidden copy for 90 days to handle reports and legal requests, then erase it with its video and images |
| Photos and videos you uploaded but never posted | 30 days (uploads that never finished: 2 days) |
| "Ask BesBes" conversations | 30 days after the last message, with the photos sent in them (deleting a conversation deletes its photos at once); photos picked for a question but never sent: 1 day |
| Notifications in your inbox | 90 days |
| Phone records (push token) | 90 days after you last opened the app signed in |
| Approximate location for "BesBes call" | While the alerts are on; deleted if not refreshed for 30 days |
| Phone verification records | We store neither the code nor the number in them, only a one-way hash, deleted after 2 days |
| Contact-button taps | 12 months |
| Invites and free boosts | As long as your account exists; unused free boosts expire after 60 days |
| Daily view codes and their keys (who has already been counted today, and how many times you saw a sponsored ad) | 2 days |
| Daily totals of views, contact taps and saves | As long as the listing or business page exists (they hold no personal data) |
| Daily totals of a sponsored ad's impressions and taps | As long as the campaign's records (they hold no personal data) |
| An advertiser's contact details | While we work with the advertiser, then as long as tax law requires for the invoices |
| Reports and moderation decisions | 2 years, for cooperation with the authorities |
| The screenshot of your permission for listings we posted for you | Until the listings it covers are erased, or 30 days if it was never used. Only our team can open it |
| Our team's actions on your account (badges, listings posted for you) | 2 years, like moderation decisions |
| Your data export file | 7 days after it's ready |
| Payment records | As long as tax law requires [👤⚖️ set by the lawyer or accountant] |
| Server logs | Up to 30 days |
| Crash reports | Up to 90 days |
| Analytics events | Up to 12 months |
| Encrypted backups | Overwritten within 35 days |
We may keep specific data longer if the law or a court requires it, and only for as long as needed.
Download your data and delete your account
- Download a copy: in the app, Me → Privacy & data → Download a copy of your data. We prepare a JSON file (encrypted in storage), notify you when it's ready, and keep it available for 7 days. One copy every 24 hours.
- Delete your account: in the app, Me → Delete account; on the web at besbes.app/delete-account; or by writing to privacy@besbes.app from your account's e-mail address. If you sign in with Apple, you confirm with Apple once more and we ask Apple to end BesBes's access to your Apple ID; we don't keep the tokens Apple gives us for this.
- What stays after deletion: payment records the law requires — what was bought, when, the amount and the payment provider's references, with nothing else about you (not even your card's last digits) — reports you filed (without your name), and the page of any business you managed (it becomes a public, unclaimed page again).
Keeping your data safe
- All connections are encrypted (HTTPS), and data is encrypted in our database and storage.
- Data export files are encrypted with a key of their own, and download links are signed and expire within 15 minutes.
- Phone verification codes are never stored, and visitors never see your number.
- Our team's access is limited to what each role needs, and admin accounts use two-step verification.
- If a breach affects your data, we notify the Personal Data Protection Center within 72 hours and you within the time the Regulations set.
No system is perfectly secure; if you notice anything suspicious, write to privacy@besbes.app straight away.
Children
BesBes accounts are for people aged 18 and over, and everyone confirms this when they sign in. Anyone can browse listings and guides without an account, and then we collect nothing that identifies them. The service is not aimed at children. If we learn that a child has made an account, we delete it. If you're a parent and think your child gave us data, write to privacy@besbes.app.
Changes to this policy
We may update this policy when we add services or the law changes. The date and version are at the top of the page; we tell you in the app before any significant change and ask for your consent where the change needs it.
- 0.6 (10 Oct 2026): Google ads (AdMob in the app, AdSense on guide pages) that may fill an ad space nobody bought: non-personalized by default, consent where the law requires it, "Ad choices".
- 0.5 (10 Oct 2026): sponsored ads (how they are chosen, what we count, advertisers' contact details); photos you attach to questions to "Ask BesBes" (checked automatically, sent to the AI provider, deleted with the conversation); speaking your questions (your phone turns your voice into text; we never receive audio); the camera, photos and microphone permissions.
Language and governing law
This policy is governed by the laws of the Arab Republic of Egypt. It is available in Arabic and English; if they differ, the Arabic text prevails.