Privacy Policy

This Privacy Policy explains how kubbi.ai (“kubbi”, “we”, “us”) collects, uses, and shares information when you use kubbi.ai, the kubbi API, SDKs, MCP integrations, dashboard, and related services (collectively, the “Services”).

1. Information we collect

Account and contact information. Name, email address, company name, login credentials, and similar registration information.

Billing information. Subscription plan, usage records, invoices, and payment status. Payment processing is handled by Stripe. We do not store full payment card numbers.

Technical and usage information. IP address, device and browser information, request logs, timestamps, API usage, error logs, and similar diagnostics. We use Google Analytics to understand website traffic and usage patterns.

Communications. Information you send us when you contact support or otherwise communicate with us.

Customer Data. Payloads, files, content metadata, claim tokens, claim URLs, read counts, expiry settings, and related service data that you or your users send through kubbi.

2. How we use information

We use information to provide, maintain, and secure the Services; authenticate users and manage accounts, API keys, and billing; operate the claim, retrieval, deletion, and expiry lifecycle; monitor performance, debug issues, and prevent abuse; communicate with you about service updates and support; and comply with legal obligations.

3. How we share information

We share information with the following service providers who help operate the Services:

• Stripe for payment processing
• Vercel and Railway for hosting and infrastructure
• Neon for database services
• Resend for transactional email
• Google Analytics for website analytics

We may also share information when required by law, to investigate fraud or abuse, or in connection with a merger, acquisition, or sale of assets. We do not sell personal information. We do not disclose Customer Data to other customers.

4. Customer Data and roles

When you send data through kubbi, you are the controller of that data and kubbi acts as a processor on your behalf. You are responsible for ensuring you have the rights and lawful basis to send data through kubbi, for providing any required notices and obtaining any required consents, and for handling data securely after it is claimed.

Claim URLs are bearer credentials. Anyone with the URL may be able to inspect metadata or claim the payload. Treat them like secrets.

kubbi is not designed or certified for regulated data categories (such as HIPAA-protected health information, PCI cardholder data, or data of children subject to COPPA) unless a separate written agreement is in place.

5. Retention

kubbi is designed around temporary data handoffs. Payloads are removed when they are burned, deleted, or expire. kubbi overwrites encrypted payloads at end-of-life, though deletion may not be instantaneous and transient copies in infrastructure components may persist briefly.

We retain account data, billing records, support communications, and operational logs for longer periods where reasonably necessary to provide the Services, maintain security, meet legal obligations, or resolve disputes. If you close your account, we may retain certain information as required or permitted by law.

6. Cookies and analytics

We use a session cookie to keep you signed in. This cookie is essential for authentication, is encrypted, and expires after 24 hours.

We also use Google Analytics, which sets cookies to understand website traffic and usage. You can control cookies through your browser settings or through our cookie consent banner. If you disable cookies, parts of the Services may not function properly.

7. Security

We use reasonable technical and organizational safeguards to protect information. Payloads are encrypted at rest using AES-256-GCM with unique initialization vectors. The service supports temporary retention, configurable expiry, retrieval limits, burn-after-read, and producer-controlled deletion. Claim tokens and API keys are hashed before storage.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International transfers

kubbi infrastructure is hosted in the United States via Vercel and Railway. Payloads, metadata, and account data may be processed and stored in US-based data centers. If you are located outside the United States, your information will be transferred to and processed in the United States. By using the Services, you consent to this transfer. We do not currently offer region-specific data residency options.

Where required by applicable data protection law, we rely on your consent to this transfer or on the necessity of the transfer to perform our contract with you. If you have questions about international transfers, contact support [at] kubbi.ai.

9. Your rights

Depending on where you are located, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, to withdraw consent, or to opt out of marketing communications. To exercise any privacy rights, contact support [at] kubbi.ai. We may need to verify your identity before fulfilling requests.

For California residents: We do not sell or share personal information for cross-context behavioral advertising. You may request to know what personal information we collect and how it is used, request deletion, and exercise these rights without discrimination.

For EEA and UK residents: We process personal information on the basis of contractual necessity (to provide the Services), legitimate interests (to secure and improve the Services), and compliance with legal obligations. You have the right to lodge a complaint with your local supervisory authority.

10. Children’s privacy

The Services are not directed to children, and we do not knowingly collect personal information from children under 13 (or the applicable age of consent). If you believe a child has provided personal information to us, contact support [at] kubbi.ai.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the effective date. If changes are material, we will provide additional notice where required by law.

12. Contact

For privacy or general inquiries: support [at] kubbi.ai

kubbi is a service of Jento Group LLC, a California limited liability company.