Kubova.
← Kubova

Privacy Policy

Effective October 18, 2026. This is the canonical English version.

1. Who is responsible

This policy explains how Kubova (“we”, “us”) handles personal data when you use the Kubova website, web application, REST API, and MCP server (the “Service”). For questions or to exercise your rights, contact us via the contact page.

2. What we collect

  • Account data: your email address and authentication identifiers when you sign up or log in.
  • Project data: the cargo, equipment, pallet, and calculation inputs and results you create (your packing projects and saved packs).
  • Subscription data: plan, status, and billing identifiers. We do NOT receive or store your full card number — payment details are entered with our third-party payment provider.
  • Usage data: API and MCP request logs, feature usage, and basic technical data (IP, browser, timestamps) used for security, rate limiting, and reliability.
  • Assistant messages: when you use the in-app assistant, the messages, files and form contents you send it are processed to produce its answer. The conversation is not stored on our servers — it stays in your browser tab until you close it. We record only usage counts (number of messages and processing volume) to apply plan limits.
  • Cookies and similar technologies: a session cookie to keep you signed in. On kubova.com we also use the advertising measurement pixel of Meta Platforms, which sets its own cookies. When you type contact details into a form on our site (such as your email address, name or phone number), the pixel hashes them (one-way encodes them) in your browser and sends them to Meta Platforms, so we can measure the effectiveness of our ads.

3. How we use it

To provide and secure the Service; authenticate you; compute and store your packing projects; meter API/MCP usage and enforce limits; process subscriptions; respond to support requests; improve reliability and performance; and measure the effectiveness of our advertising. We do not sell your personal data.

We process data to perform our contract with you (providing the Service), for our legitimate interests (security, abuse prevention, product improvement), to comply with legal obligations, and—where required, including for advertising cookies—with your consent.

5. Processors and subprocessors

We share data only with vetted service providers that process it on our behalf under contract, in the following categories:

  • Cloud authentication and database providers — to store your account, projects, and subscription records.
  • A third-party payment provider acting as merchant of record — to process billing and card payments. We do not receive or store full card numbers.
  • Email delivery providers — to send transactional and notification email.
  • Cloud application-hosting providers — to serve the web app, API, and MCP server.
  • Server-side compute providers — to run packing calculations and render PDF reports.
  • An AI model hosting provider — to run the in-app assistant on the messages and files you send it. The provider does not retain this content after the answer is produced and does not use it to train AI models.
  • Meta Platforms — to measure the effectiveness of our ads through the pixel and cookies described in section 2.

A current list of our named subprocessors is available on request via the contact page.

6. International transfers

Our providers may process data in regions outside your own. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

7. Retention

We keep account and project data for as long as your account is active. When you delete your account, we delete or anonymize your personal data and associated projects, except where we must retain limited records to meet legal, tax, or security obligations.

8. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a portable copy of your personal data, and may object to or restrict certain processing. You can delete your account from your dashboard, which removes your projects and membership records. You can block or delete advertising cookies in your browser settings at any time. In regions where the law requires it, the measurement pixel loads only after you accept it, and you can give or withdraw that consent at any time through “Cookie settings” at the bottom of every page. To exercise other rights, contact us via the contact page. You may also lodge a complaint with your local data-protection authority.

9. Security

We use industry-standard measures including encryption in transit, row-level access controls, and scoped API keys. No system is perfectly secure; keep your password and API keys confidential.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy; material changes will be posted here with a new effective date.