Thabbit — Terms of Service & Privacy Policy

1. Who We Are

Thabbit Technologies (ثبِّت للتقنيات), CR 198698-1, Kingdom of Bahrain ("Thabbit," "we," "us," "our") operates thabbit.io, a browser-based booking and appointment management platform (the "Platform"). Thabbit operates under a Sijilli virtual commercial registration and does not maintain a physical office.

The Platform is designed for a wide range of businesses to manage their own bookings — for example, salons and barbershops, spas and wellness centers, gyms and fitness studios, sports and recreation facilities, pet grooming businesses, and professional service providers such as law firms. This list is illustrative, not exhaustive — the Platform is general booking software, not software built around any one industry.

2. Who This Agreement Applies To

This Agreement applies to three groups:

"Business," "Business Owner," or "you" — any business that creates an account to manage bookings or appointments through the Platform, and the individual who registers on its behalf.

"Staff" — individuals a Business adds to its account to help manage bookings (for example, through the staff PIN system).

"Customer" or "you" — anyone who books an appointment with a Business through the Platform.

Sections 13–23 (Thabbit's data practices) apply to anyone whose personal data Thabbit processes — Business Owners, staff, and Customers alike. The remaining sections primarily govern the relationship between Thabbit and a Business, except where a section states otherwise (for example, Section 6 concerns a Business's own Customers, and Section 3 describes what all users, including Customers, can expect from the Platform).

By creating a Business account, accessing a Business dashboard, or completing a booking through the Platform, you agree to be bound by this Agreement.

3. What Thabbit Is — and Is Not

Thabbit is booking management software only.

Thabbit does not process, hold, or handle payments of any kind. Payment for services is a matter strictly between the Business and the Customer, made directly by whatever method the Business accepts (cash, BenefitPay, or otherwise).

Thabbit does not operate a marketplace or directory of businesses. A Customer books directly with a specific Business through that Business's own booking link or QR code — Thabbit does not list, recommend, or compare Businesses to Customers.

WhatsApp may be used by a Business to share its booking link or QR code. WhatsApp is a distribution channel only — no booking, payment, or account action takes place on WhatsApp itself.

Thabbit is not a party to, and accepts no responsibility for, the appointment, service, or payment arrangement between a Business and its Customer.

4. Business Eligibility & Account Responsibilities

The person registering a Business account confirms they are at least 18 years old, have the legal capacity to enter into a binding contract, and are authorized to act on behalf of that business.

The Business is responsible for the accuracy of information it lists — services, pricing, hours, and staff.

The Business is responsible for safeguarding its login credentials and any staff PINs issued through the dashboard, and must notify Thabbit promptly at thabbit.bh@gmail.com of any suspected unauthorized access.

One account is issued per Business unless otherwise agreed with Thabbit.

5. Trial, Subscription & Fees

New Businesses receive a one-month free trial, beginning on the date the Business's account is created.

Unless cancelled during the trial, the subscription fee — a flat BD 20 per month per Business, regardless of business type, with no fixed-term contract — becomes payable starting at the end of the trial (day 31 after account creation).

A Business may cancel at any time. Cancellation takes effect at the end of the current billing period; fees already paid are not refunded for the remainder of that period, except where required by law.

Billing is currently handled manually by Thabbit: payments are recorded by admin staff (cash, bank transfer, BenefitPay, or other agreed method), with accounts due by day 31 of each cycle.

Thabbit will provide at least 7 days' advance notice by email or dashboard before deactivating an account solely for non-payment. An account marked "Overdue" or "Suspended" for billing purposes does not, by itself, restrict the Business's ability to take bookings — only a separate "Deactivation" action removes booking access.

Thabbit may revise the subscription fee from time to time, with reasonable prior notice given before the new pricing takes effect for existing Businesses.

6. The Business's Responsibilities to Its Customers

This relationship is separate from, and not affected by, the Business's own subscription relationship with Thabbit described in Section 5.

The Business is solely responsible for the services it lists, the accuracy of information shown to Customers, and how it collects payment. Thabbit has no liability for disputes, no-shows, service quality, refunds, or payment arrangements between a Business and its Customer.

7. Data Protection Roles & Processing

For a Business's own account and staff data (login credentials, business profile, billing/contact information, and platform usage data), Thabbit is the data controller — Thabbit decides why and how this data is used, as described in Sections 13–19 below.

For a Business's Customer data (name, phone number, email, and booking details), the Business is the data controller and Thabbit is a data processor, processing that data only on the Business's documented instructions, given through the Business's use of the Platform.

Thabbit will process Customer personal data only: (a) to provide the booking, reminder, notification, and related features the Business uses; (b) to generate AI Feature suggestions (weekly insights, re-engagement, cancellation-fill) for the Business's own review, per Section 9 (AI Features); and (c) as otherwise instructed by the Business through the Platform's dashboard and settings, or as required by applicable law — in which case Thabbit will, where legally permitted, notify the Business before complying.

The Business is responsible for ensuring it has a lawful basis under Bahrain's PDPL and any other applicable law to collect, use, and instruct Thabbit to process its Customers' personal data, including for any marketing, promotional, re-engagement, or rebooking messages sent using the Platform (see Section 8, Marketing Communications). Thabbit provides the technology; the Business is responsible for how it uses it.

Where this Agreement describes Thabbit as responsible for a decision about personal data, that refers to Thabbit acting as controller; where a Business's Customer data is involved, the Business is the controller and Thabbit processes it on the Business's behalf.

8. Marketing Communications

Thabbit's marketing to Businesses. Thabbit may send Businesses occasional information about the Platform's features and updates. A Business may opt out of non-essential marketing communications from Thabbit at any time by contacting thabbit.bh@gmail.com, without affecting service-related notices (such as billing or security notices).

A Business's marketing to its Customers. A Business may use the Platform's SMS and email features to contact its own Customers — for example, booking confirmations, reminders, cancellation-fill offers, re-engagement messages, and promotions. The Business is solely responsible for ensuring it has whatever consent and lawful basis is required under Bahrain's PDPL, applicable electronic communications and consumer protection law, and any other applicable law before sending such messages, and for the content of any message it sends or approves. Thabbit provides the technology only and is not responsible for a Business's compliance with these requirements.

9. AI Features

Certain Platform features use artificial intelligence to generate suggested content for a Business Owner's own use — including weekly performance insights, re-engagement/win-back message drafts, and cancellation-fill suggestions ("AI Features").

AI Features are informational assistance only. They are generated automatically and may be inaccurate, incomplete, or unsuited to a particular Customer or situation.

A Business Owner must review any AI-generated content before relying on it or sending it to a Customer. Nothing generated by an AI Feature is sent to a Customer automatically.

Thabbit does not guarantee that using an AI Feature will increase bookings, revenue, or customer retention, or that any suggestion is accurate or appropriate for the Business's specific circumstances.

To the extent permitted by law, Thabbit is not liable for a Business's decision to act on AI-generated content without independent review.

10. Acceptable Use

You agree not to:

• use the Platform for any unlawful, fraudulent, or abusive purpose;
• attempt to circumvent Platform security features, including the staff PIN system or account access controls;
• use the Platform's SMS or email features to send unsolicited or unrelated messages;
• enter sensitive personal data (such as health, medical, or other special-category information recognized under Bahrain's PDPL) into Customer notes, booking details, or messages sent through the Platform, unless Thabbit has specifically enabled a feature for that purpose.

11. Intellectual Property

Thabbit owns the Platform, including its software, design, and branding. A Business retains ownership of its own business data (such as its customer list and service details) entered into the Platform, and grants Thabbit a license to host and process that data solely to provide the service. Thabbit does not sell, rent, or use a Business's Customer data to advertise or promote competing businesses, to build a consumer-facing marketplace or directory, or for any purpose other than providing the Platform to that Business and the limited aggregated/anonymized uses described below.

Thabbit may create and use aggregated or anonymized data derived from Platform usage — data processed so that it no longer identifies any Business or Customer — for purposes including improving the Platform, analytics, benchmarking, product development, and improving Thabbit's own AI Features. Thabbit will not use a Business's or Customer's identifiable data for these purposes without the Business's consent.

12. Confidentiality

Each party may receive information about the other that is confidential — for example, a Business's booking volumes, revenue-related figures, customer behavior patterns, staff performance, or business plans, and Thabbit's own software, pricing, and business information. Each party agrees to use the other's confidential information only as needed to perform its obligations under this Agreement, and not to disclose it to third parties except as needed to operate the Platform (including to Thabbit's subprocessors — see Section 16), as required by law, or with the other party's consent.

Thabbit will also ensure that its own personnel authorized to process a Business's Customer personal data are subject to a duty of confidentiality.

13. What We Collect

Business Owners: name, contact number, email, and business details (name, services, pricing, hours, city).

Staff: name, a PIN (stored as a one-way hash, never in plain text), and a phone number used only for internal SMS notifications — visible to the Business Owner only, never shown to Customers.

Customers: name, phone number, and email if provided, plus booking details (service selected, appointment time, assigned staff member).

Usage data: general technical and usage data needed to operate the Platform (e.g. device/browser type, pages visited).

We never collect payment card numbers, bank details, or any payment credentials. Thabbit does not process, store, or handle payments — Customers pay Businesses directly.

Businesses must not enter sensitive personal data (such as health, medical, or other special-category information recognized under Bahrain's PDPL) into Customer notes, booking details, or messages sent through the Platform — see Section 10 (Acceptable Use).

14. How We Collect It

Directly from you, when you sign up, complete a booking, or use dashboard features; and automatically, through your ordinary use of the Platform.

15. Why We Process It

To operate the booking Platform and fulfil our contract with the Business.

To send booking confirmations, one-hour appointment reminders, and staff notifications.

To help Business Owners manage their business, including AI-drafted message suggestions (weekly insights, re-engagement, cancellation-fill) that a Business Owner reviews and chooses whether to send — these are never sent to a Customer automatically. See Section 9 (AI Features) for the disclaimer that applies to these AI Features.

If a Business sends marketing, promotional, or re-engagement messages to its own Customers using the Platform, the Business — not Thabbit — is responsible for the lawful basis for doing so; see Section 8 (Marketing Communications) and Section 7 (Data Protection Roles & Processing).

16. Who We Share It With

Thabbit uses third-party subprocessors to provide the infrastructure, communications, and related services needed to operate the Platform. Each subprocessor is bound by data protection obligations no less protective than this Agreement, processes data only to help deliver the Platform's functionality, and may not use it for its own marketing. Thabbit will give the Business reasonable notice of any new subprocessor involving a material change in risk. We do not sell personal data to any third party.

17. International Data Transfers

Some of the providers Thabbit uses to operate the Platform may process or store personal data outside the Kingdom of Bahrain. Where this involves a Business's Customer data, Thabbit relies on a transfer mechanism recognized under Bahrain's PDPL.

18. How Long We Keep It

We keep personal data only for as long as needed for the purposes described in this Agreement:

Account and business data is retained for as long as a Business's account is active.

If a Business cancels or its account is closed, we retain the data for up to 90 days to allow recovery — during which the Business's self-serve data export (Settings → Data & Privacy on the dashboard — see Section 25) remains available — after which it is deleted or anonymized, unless we are legally required to retain it longer (for example, financial records for tax purposes).

Notification delivery logs (SMS/email) are kept for 12 months for troubleshooting and auditing.

19. How We Protect It

Access to sensitive fields — such as staff phone numbers and PINs — is restricted at the database level, so they are never exposed to Customers or the public.

PINs are stored as one-way hashes, not in plain text.

Data is transmitted over encrypted (HTTPS) connections.

20. Your Rights

You may:

• request a copy of the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• object to, or ask us to restrict, certain processing;
• lodge a complaint with Bahrain's Personal Data Protection Authority (PDPA) if you believe your data has been mishandled.

To exercise any of these rights, contact thabbit.bh@gmail.com. We aim to respond within 30 days.

Where a request concerns a Business's Customer data and Thabbit is acting as a processor rather than a controller (see Section 7), Thabbit will forward the request to the relevant Business and provide reasonable assistance, since the Business is generally the party responsible for deciding and acting on the appropriate response.

21. Minors

Booking an appointment through the Platform (for example, a parent booking an appointment for their child) may sometimes concern a minor, even though the Platform is not directed at minors and does not knowingly collect account data from them. Where a booking is made on behalf of a minor, the adult making the booking is responsible for that decision. Business Owner and staff accounts are not intended for use by minors.

22. Cookies & Tracking

Thabbit does not use Google Analytics, Meta/Facebook Pixel, Microsoft Clarity, or any other third-party advertising or analytics tracking tool on thabbit.io. The Platform does not set tracking cookies. Session sign-in for Business Owners, staff, and Admin/Sales users is kept in the browser's local storage, not in a cookie.

The "analytics" a Business Owner sees on their own dashboard (booking counts, repeat-customer rate, cohort retention, and similar figures) is Thabbit's own first-party product feature, computed from that Business's own booking data — it is not third-party visitor tracking and does not involve cookies.

Thabbit's public pages use the IBM Plex Sans and IBM Plex Sans Arabic typefaces, self-hosted from Thabbit's own infrastructure rather than loaded from any third-party font service. No font-related request is made to Google or any other third party when a page loads.

23. Data Breach Notification

If a data breach affects personal data for which Thabbit is the controller (a Business Owner's or staff member's account data), Thabbit will notify Bahrain's Personal Data Protection Authority and affected individuals as required under the PDPL.

Where a data breach affects a Business's Customer data, for which Thabbit is the processor, Thabbit will notify the Business without undue delay after becoming aware of the breach, and will provide the information reasonably necessary for the Business to meet its own notification obligations.

24. Service Availability

Thabbit aims to keep the Platform running reliably but does not guarantee uninterrupted or error-free access. Service can be affected by circumstances outside Thabbit's control, including internet or power outages, mobile network or SMS carrier delays, third-party infrastructure or service provider outages, email delivery and spam-filtering issues, and scheduled or emergency maintenance.

Thabbit is designed to send booking confirmations, appointment reminders, and staff notifications by SMS and email, but does not guarantee that any particular message will be delivered, delivered on time, or delivered at all — delivery depends on mobile network operators, carriers, and other third parties outside Thabbit's control.

Thabbit is not responsible for a Customer's failure to receive a reminder or notification due to an incorrect phone number or email address entered by the Customer or Business, a full inbox, spam filtering, or a network/carrier issue.

25. Suspension & Termination

Thabbit may suspend or deactivate a Business's account for breach of this Agreement, non-payment, or unlawful use.

A Business may close its account at any time by contacting thabbit.bh@gmail.com.

A Business can export its business and Customer data (customers, bookings, staff, services, and working hours) as a CSV file at any time, self-serve, from Settings → Data & Privacy on its dashboard — no request to Thabbit is needed. This export remains available through account closure and until the data is deleted or anonymized (see Section 18).

26. Disclaimers & Limitation of Liability

The Platform is provided "as is." To the maximum extent permitted by the laws of Bahrain, Thabbit's total liability to a Business arising from use of the Platform is limited to the subscription fees paid by that Business in the three months preceding the claim. This cap applies to Thabbit's relationship with the Business (a business-to-business relationship); it does not purport to limit any liability that cannot lawfully be excluded or capped, including where a Customer (rather than the Business) is affected.

27. Indemnification

The Business agrees to indemnify and hold Thabbit harmless against claims, losses, and reasonable costs arising from:

• the Business's violation of applicable privacy, data protection, or electronic communications law in its use of the Platform;
• marketing, promotional, or other messages the Business sends or approves for sending to its Customers through the Platform;
• inaccurate pricing, service descriptions, or other information the Business lists on its booking page;
• disputes between the Business and its Customers, including over services, refunds, or no-shows;
• misuse of the Platform by the Business's staff;
• content the Business uploads that infringes a third party's intellectual property rights or is otherwise unlawful; or
• the Business's failure to obtain any consent required from its Customers.

28. Governing Law & Disputes

This Agreement is governed by the laws of the Kingdom of Bahrain.

29. Changes to This Agreement

Thabbit may update this Agreement from time to time. Continued use of the Platform after changes take effect constitutes acceptance of the revised Agreement.

Thabbit records the version of this Agreement in effect when a Business accepts it, and the date of acceptance, as part of the Business's account. Where this Agreement is later updated, a Business's continued use of the Platform after the new version takes effect constitutes acceptance of that version, recorded in the same way.

Material changes will be communicated by email or an in-app/dashboard notice at least 14 days before they take effect.

The current version of this Agreement is always published at thabbit.io/terms and thabbit.io/privacy.

30. Sanctions Compliance

Thabbit will not knowingly provide the Platform to any person, entity, or jurisdiction subject to applicable sanctions restrictions (including Bahraini, United Nations, or other sanctions regimes that apply to Thabbit). Thabbit may refuse, restrict, or suspend access where a sanctions, fraud, legal, or security risk is identified.

31. Force Majeure

Neither party is liable for a failure or delay in performing its obligations under this Agreement where that failure or delay results from circumstances reasonably beyond its control (for example, internet or power outages, mobile network or SMS carrier delays, or an outage at a third-party provider or our hosting infrastructure).

32. Miscellaneous

Severability: if any provision of this Agreement is found invalid or unenforceable by a court of competent jurisdiction, the remaining provisions continue in full force and effect.

Entire agreement: this Agreement constitutes the entire agreement between you and Thabbit regarding use of the Platform, superseding any prior agreements on the same subject.

No waiver: Thabbit's failure to enforce any provision of this Agreement is not a waiver of its right to do so later.

Notices: Thabbit may notify you of updates or matters relating to your account by email or through the dashboard.

33. Contact

thabbit.bh@gmail.com