Privacy Policy
Last updated: September 7, 2026
1. What Data We Collect
We collect names, phone numbers, email addresses, user settings, child data provided by organizations, reports, photos, videos, messages, announcements, attendance, incidents, finance records, payment reminders, meals, schedules, support tickets, and technical security logs.
2. How We Use Data
Data is used to operate Sabee: showing reports and media, communication, notifications, attendance, finance tracking, analytics, support, security, abuse prevention, and fulfilling contractual obligations.
3. Data Storage
Sabee’s main application and primary database run on a VPS located in the Republic of Kazakhstan. Media storage, backups and external service processing are separate data flows; the location of the VPS does not mean that all service providers process data in Kazakhstan. Sabee applies role-based access, HTTPS and restricted production access. External processing is subject to the safeguards and legal requirements described in this Policy.
4. Third-Party Sharing
We do not sell personal data. Data may be processed by infrastructure, storage, email, push notification, uptime monitoring, and support providers solely to deliver the service, or disclosed where required by law.
5. Children's Data
The organization determines the purposes for using children’s data in its operations and is responsible for lawful provision of that data, required parent or legal-representative consents, correct child-parent links, and staff authorization. Sabee processes the data to provide the contracted service and has its own obligations under its agreements, this Policy and applicable law. The organization’s responsibilities do not exclude Sabee’s responsibilities for its own processing.
6. Organization Staff Access
Organization administrators manage staff permissions and must promptly remove access that is no longer authorized. Sabee maintains service access controls and is responsible for its own processing and security obligations under applicable law and its agreements. Each party must cooperate in investigating unauthorized access and responding to affected individuals.
7. Incidents, Messages, and Support
Incidents, messages, files, and support tickets may contain personal data. Users must not upload unnecessary, unlawful, or unrelated information.
8. Retention
Data is retained as needed to provide the service, perform contracts, resolve disputes, provide support, maintain security, and comply with law. Upon request from an authorized administrator, we may delete or anonymize data where legally and technically feasible, including backup limitations.
9. User Rights
You may request access, correction, deletion, or withdrawal of consent where applicable by contacting your organization or admin@sabee.kz. We may verify your identity and authority to act for a child. We assess requests under applicable law and explain any grounds requiring continued retention. A organization must disable AI processing if it no longer has the necessary grounds; an administrator’s enablement declaration does not override an individual’s rights.
10. Cookies
Our website uses technical cookies to ensure proper session functionality. We do not use cookies for advertising purposes.
11. AI data processing: Sabee AI and Director Brief
Sabee AI, Director Brief and AI spreadsheet imports support organization work. AI use is limited to specified service purposes and the user’s authorized access. Director Brief sends aggregate counts and numeric indicators to the AI provider; named supporting records remain in Sabee. Chat uses prompts, conversation context and selected tool results. Sabee replaces recognized names and record references with temporary references and filters common contact, identity and media fields before transmission. Spreadsheet imports filter common contact and identity columns and replace names recognized from column headings. Free text and unrecognized fields may still contain personal data; these measures do not guarantee anonymization. Do not include unnecessary personal information. Photos, videos and private conversations are not automatically submitted for AI analysis.
12. AI providers and data transfers
Sabee uses the OpenAI API for these features. Relevant processing may occur outside Kazakhstan and may constitute cross-border transfer. Local primary database storage does not remove the legal requirements governing that transfer. AI processing is disabled until the organization’s primary administrator separately acknowledges the current disclosure and records a reference to documented lawful grounds and required consents, including those of children’s legal representatives and cross-border consents where required. Sabee records the administrator, time, disclosure version and text, reference, and subsequent changes. This records the organization’s declaration, not consent from parents or staff. The organization must hold the underlying evidence. Accepting the Terms or this Policy does not replace a separately required consent. Sabee and the organization must comply with their respective applicable obligations.
13. AI data retention and user rights
A primary administrator can disable AI processing in CRM Settings. This blocks subsequent provider requests, including queued imports and later steps of ongoing tasks; it cannot recall data already transmitted. Re-enablement requires a new recorded declaration, and old queued imports must be submitted again. Sabee retains conversations, proposed actions and authorization history according to the general retention rules and applicable law. Sabee configures integrations to reduce provider retention where supported; provider retention may still apply for security, abuse prevention and legal compliance under its applicable terms. Disabling AI is not automatic deletion of existing records. Contact your organization or admin@sabee.kz to exercise data rights or request restrictions.
14. Contact
For privacy inquiries: admin@sabee.kz