1. Who we are and what this covers
Labibo is a travel assistant made by Terhali AI Limited, a company registered in Masdar City, Abu Dhabi, United Arab Emirates. This policy explains what we collect when you use Labibo on iPhone, Android or the web at labibo.ai, what we do with it, and the choices you have. It also covers the terhali.ai website.
We collect only what the service needs to work. We do not sell personal data and we show no advertising.
2. The terhali.ai website
The terhali.ai website is informational. It has no sign-up, contact or newsletter forms and sets no cookies. It loads fonts from Google Fonts, so Google may see your IP address when your browser fetches a font. Our hosting provider keeps standard server logs (IP address and time of request) for security and performance under its own privacy policy.
3. Using Labibo without an account
You can search and chat without signing in. To make that work, Labibo creates a random identifier on your device the first time it runs and stores it in the device’s secure storage, or in your browser’s local storage on the web. It is not a hardware identifier and it is not shared with advertisers. We use it to keep your conversations together, to apply the daily message limit for signed-out use, and, if you book something before signing in, to attach that booking to your account when you do. Deleting the app’s data or deleting your account discards it.
4. Your account
When you sign in with Google or Apple, the provider sends us your name, email address and profile picture. Apple may send a private relay address, or no email at all; Labibo works either way. We never see your Google or Apple password.
In Settings you can add details that prefill bookings: preferred language and currency, country and nationality, mobile number, date of birth, gender and title, and, for flights, passport number, expiry date and issuing country. You add these yourself and can change or remove them at any time. Nationality also sets the market that hotel prices are quoted for.
5. Travellers you save
You can save the details of people you travel with (the same fields as above) so a booking can be filled in quickly. They are stored with your account, shown only to you, and sent to a supplier only when you include that traveller in a booking. When you enter another person’s details, including a child travelling with you, you are responsible for having their permission.
6. Chatting with the assistant
Your messages and the assistant’s replies are stored with your account, or with your device identifier while you are signed out, so you can return to a conversation. You can rename or delete any conversation, and deleting your account deletes them all.
To write a reply, we send the conversation, together with the hotel and flight results it needs, to DeepSeek, a third-party AI model provider, through its API. The app asks for your permission before the first message is sent, and you can chat only after agreeing. You can withdraw that permission whenever you like, under Settings, and the chat asks again before the next message. DeepSeek processes the conversation on servers outside the UAE (see section 15) under API terms that limit its use to generating the reply and require it to protect the data. We do not send your name, email address, payment details or passport details to the model. Please do not type card numbers or other sensitive details into the chat.
7. Searching and booking hotels and flights
Hotel searches and bookings run through a hotel wholesaler that connects us to hotels worldwide. When you book, we send the guests’ names, your contact email and phone number, any special requests you typed, and the stay details to the wholesaler, which passes them to the hotel.
Flight searches and bookings run through a flight booking partner that connects us to airlines. When you book, we send each passenger’s name, date of birth, gender, nationality and passport details, plus your contact details, to that partner, which passes them to the airline. Airlines may have to share passenger data with border authorities under the laws of the countries you fly to or through.
We keep a record of each booking (what was booked, for whom, the dates, the price, the supplier reference and the status) so we can show it to you, send confirmations, handle changes and refunds, and meet our accounting duties.
8. eSIM data plans
You can buy an eSIM data plan for a trip. The plan and the eSIM itself come from our eSIM provider.
We do not send the provider your name, email address or payment details. An order is the plan you chose and a reference number, and nothing more, so the provider does not learn from us who you are.
What comes back is the eSIM and, afterwards, facts about it: the activation code and QR code, the ICCID (the eSIM’s own serial number), the EID (an identifier for the phone it was installed on), when it was installed, when it expires and how many megabytes have been used. We keep these so you can install the eSIM, see what is left on it, extend it, hand it back and get help with it. The usage figure is a total and nothing else: we do not see which sites or apps you used it for.
An eSIM connects to mobile networks, so the provider and the networks it uses know where it is being used, in the way your usual mobile operator does. That is theirs and not ours: we do not receive it, and Labibo still never reads your device’s location.
If you share an eSIM, the link you send installs it on the other person’s phone and it is then theirs to use. The order stays on your account, and so does the usage figure shown against it.
9. Payments and invoices
Payments are processed by Stripe. Your card details go directly from Stripe’s payment form on your screen to Stripe; they never reach our servers and we cannot see your full card number. Stripe may use your details for fraud prevention under its own privacy policy.
We keep the payment reference Stripe gives us, the amount, currency and status of each payment, and, if you ask for a business invoice, the company name and VAT number you enter.
10. Emails and notifications
We send emails only about things you did: booking confirmations, cancellations, refunds, failed payments, itinerary changes, flight tickets, eSIM purchases and cancellations, and account deletion. The eSIM email carries the activation code, so treat it like a ticket and forward it only to someone you mean to give the eSIM to. They are sent through our email delivery provider, and the booking documents attached to them are generated by us. We do not send marketing emails or newsletters.
If you allow notifications, Labibo can remind you the evening before a check-in. These reminders are scheduled on your device by the app itself; we do not collect a push token and we do not send notifications from our servers.
11. Analytics and crash reports
With your consent, Labibo collects usage analytics (screens viewed, taps, performance) and crash reports through an analytics provider so we can find and fix problems. This data is processed in the European Union (Frankfurt, Germany). Your user ID, name and email are attached to the session so we can look into an issue you report; chat content, payment details and traveller details are not collected.
You are asked on first launch and can change your choice at any time in Settings → Privacy. Saying no, or withdrawing consent later, stops collection.
12. Your country and location
Labibo never asks for or reads your device’s location. To pick sensible defaults, such as your currency, language and the hotel market, we estimate your country from your IP address on our own servers, using a local database. Your IP address is not sent to any geolocation service.
13. The web version
labibo.ai stores your device identifier, signed-out session, language and analytics choice in your browser’s local storage, and keeps you signed in with a secure cookie that holds only your session token. We set no advertising or tracking cookies.
14. Server logs and security
Our servers record technical information about each request: IP address, time, the endpoint called and a request identifier. We use it for security, rate limiting and debugging, and keep it for a limited period. Data travels encrypted between your device and our servers. Where we log requests to travel suppliers to diagnose problems, guest names and other personal fields are removed first.
15. Who processes your data, and where
We rely on these kinds of companies to run Labibo, each processing your data only to provide its part of the service and under its own data-protection commitments:
- Cloud hosting and network providers. Our servers and database run in the Middle East (Doha region); the network provider that delivers the service operates worldwide.
- Google and Apple, for sign-in.
- DeepSeek, the AI model provider that generates the assistant’s replies (section 6), with your permission. It processes conversations in China.
- A hotel wholesaler and the hotels you book (European Union); a flight booking partner and the airlines you fly (United Kingdom) (section 7).
- An eSIM provider, which sells the data plans and issues the eSIMs (section 8), registered in Hong Kong.
- Stripe, for payments (section 9).
- An email delivery provider, for transactional email (section 10), in the United States.
- An analytics provider, for analytics and crash reports, only with your consent (section 11), in the European Union.
- Meta (WhatsApp), only if you choose to contact support on WhatsApp.
Some of these companies are outside the UAE. Where your data leaves the country in which it was collected, it does so to provide the service you asked for, under contracts that require the recipient to protect it. The current list of our service providers is available on request from [email protected].
16. How long we keep data
Your account, profile, saved travellers and conversations are kept until you delete them or your account. Booking, eSIM and payment records are kept for as long as accounting and tax law require; once a stay or flight is over and the account has been deleted, the traveller details on those records are removed and only the financial record remains. Server logs and analytics are kept for a limited period and then deleted.
17. Deleting your account
You can delete your account at any time from Settings → Delete account. It takes effect immediately: your profile, saved travellers, conversations, sign-in links and sessions are erased, and we ask Apple to revoke Sign in with Apple for the account. Booking and payment records are kept as described in section 16, with the personal details removed once the trip is over. Deletion cannot be undone. You can also ask us to delete your account by email.
18. Your rights
Depending on where you live, including under the UAE Personal Data Protection Law and the EU GDPR, you can ask to access the personal data we hold about you, to correct it, to delete it, to receive a copy of it, or to object to or restrict its use, and you can withdraw your consent to analytics, or to sending messages to the AI provider, at any time under Settings. Write to [email protected] and we will respond within the time the law allows. You can also complain to your data-protection authority.
19. Children
Labibo is for adults. We do not knowingly let anyone under 18 create an account. An adult may enter a child’s details as a passenger or guest on a booking, and those details are handled as described above.
20. Changes to this policy
When Labibo changes, this policy changes with it. The date at the top shows the last revision. If a change adds a new type of data or a new kind of provider, we tell you in the app before it takes effect. The policy is available in the languages Labibo offers; where a translation differs from the English text, the English text prevails.
21. Contact
Terhali AI Limited, Masdar City, Abu Dhabi, United Arab Emirates. For privacy questions or requests, write to [email protected].