Privacy Policy

1. Who is responsible for your data

Kubo Loko, operated by Miguel Barras, based in Portugal, is the party you can contact about your personal data at geral@kuboloko.pt.

Kubo Loko has not yet completed formal business activity registration with the Portuguese tax authorities; full legal/tax identification will be added here once available.

2. Categories of personal data we process

Account data: your full name, email address, and authentication data, collected when you register.

Company and membership data: the company name, industry, and size you provide during onboarding, and your role within your company account.

Data your company enters about individuals it manages ("people" data): if you use the "People" feature, you may enter names, roles, email addresses, and active/inactive status for individuals connected to your business, such as employees. This is provided and controlled by your company, not by us — see section 5 for how responsibility for it is shared.

Other operational content: business processes, risk records, remediation actions, responsible-person assignments, and the resulting score history you create while using the Service.

Feedback data: if you use the in-app feedback form, we receive your message, your account email, your company name, and the time of submission.

Billing data: if you subscribe to a paid plan, Stripe collects your payment details directly — we never see or store your card number. We store the subscription identifiers, plan, and status Stripe reports back to us.

Technical data: standard request and session information generated by our infrastructure providers to keep you securely logged in and the Service running (see our Cookie Policy).

Product-usage data: a limited set of product events linked to your company account, described in section 7.

3. Why we process this data

To create and secure your account and authenticate you.

To provide the core functionality of the Service: mapping people, processes, risks, and generating your Black Box Score.

To process payments and manage your subscription.

To respond to feedback and support requests.

To keep the Service secure and diagnose technical problems.

To understand activation and product usage, improve onboarding and the product experience, and measure trial-to-paid behaviour, through the product-usage analytics described in section 7.

4. Legal basis for processing

Where the General Data Protection Regulation (GDPR) applies, we generally rely on performance of a contract (to provide the Service you signed up for) and legitimate interests (to keep the Service secure and improve it). Determining the precise legal basis for each processing activity, and documenting it formally, is a matter we are addressing as part of our ongoing legal review.

5. Who is the controller, who is the processor

For account data (your name, email, login) and for our own business records (such as feedback you send us), Kubo Loko generally acts as the data controller.

For data your company enters about its own employees or other third parties (for example, in the "People" feature), your company is generally the data controller and Kubo Loko acts as a data processor, processing that data only on your company's instructions and only to provide the Service. The precise allocation of these roles, and the obligations that follow from it, are set out in our Data Processing Agreement, available to business customers on request.

6. Automated processing and scoring

The Black Box Score and the risks it is based on are calculated by a rules-based engine using the information your company enters (people, processes, responsibilities, backup coverage, and documentation). This is descriptive analysis of the data you provide, intended to help you prioritise your own decisions — it does not make any automated decision that produces legal or similarly significant effects on any individual, and no individual is scored, ranked, or evaluated as a person by this feature.

7. Product-usage analytics

Separately from the aggregate traffic and performance measurement described in section 8 and in our Cookie Policy, we record a limited set of product-usage events for authenticated accounts, linked to your Business Black Box company account. Vercel Analytics measures aggregate visits and page performance; product-usage events record specific actions taken within a company account, such as starting a trial or starting a subscription.

We use these events to understand how accounts are activated and how the Service is used, to improve onboarding and the product experience, to measure how free trials become paid subscriptions, and to support the validation of the Service with early customers. We do not use them for advertising.

Each event consists of: an internal identifier of your company account; the name of the event (for example, that a trial started, that a first set of risks was generated, that a first action was created or completed, that a checkout was started, or that a subscription started); the date and time of the event; and a small number of limited properties, such as the plan and billing interval concerned, whether a payment was completed, the amount and currency Stripe reports for a subscription payment, whether a promotional price applied, and simple counts or scores (for example, the number of people, processes and risks recorded when the first set of risks was generated, and the resulting Black Box Score).

These events do not contain your email address, your name or anyone else's name, your company name, the titles or descriptions of your actions, processes or risks, any other text you enter, your IP address, browser or device information (user agent), payment card data, or authentication tokens. We do not store Stripe customer, invoice, subscription or checkout identifiers in these events. We retain only a technical hashed value (a one-way SHA-256 hash of the relevant Stripe reference), solely to prevent the same event from being recorded twice.

Events are recorded by our servers when the corresponding action takes place. They are never written directly from your browser, and no additional cookie, tracking script or identifier is placed in your browser for this purpose.

Product-usage events are stored in the same EU-hosted database as the rest of the Service data (see section 8). Access is restricted to authorised Kubo Loko personnel, for operational and analytics use only. They are protected by row-level security, so customer accounts cannot read or write them through the Service, and one company's events are never visible to another. We do not share them with anyone other than the service providers listed in section 8.

Product-usage events are linked to a company account, not to an individual user: we do not store a separate user identifier in them. When a company account is deleted, its product-usage events are deleted with it. To request deletion, see section 11.

We keep product-usage events only for as long as necessary for the purposes described in this section, and subject to applicable legal requirements. The retention period is still being defined as part of our ongoing legal review (see section 10), and this policy will be updated once it is finalised.

As described in section 4, this processing is based on the legal grounds applicable to providing, securing and improving the Service, subject to applicable data-protection law. You may object to this processing by contacting us at geral@kuboloko.pt.

8. Who we share data with

We share personal data only with the service providers we rely on to run the Service, and only to the extent needed for them to provide their service to us:

• Supabase — authentication, database, and application backend, hosted in the EU (eu-west-1).
• Stripe — payment processing for subscriptions.
• Resend — delivery of account emails (confirmation, password reset) and feedback notifications.
• Vercel — application hosting, and Vercel Analytics / Speed Insights for aggregate traffic and performance measurement.

9. International transfers

Our database is hosted in the EU (Supabase, eu-west-1). Stripe, Resend, and Vercel are US-headquartered providers; the exact processing region and transfer safeguards each of them applies to our account are still being confirmed as part of our ongoing provider review, and this section will be updated once that is complete. We do not sell personal data or share it with data brokers or advertisers.

10. How long we keep data

We currently retain account and company data for as long as your account exists. Cancelling a subscription changes your access level but does not automatically delete your data. We do not currently operate an automated data-deletion or purge system; a formal retention schedule is being defined as part of our legal review, and this policy will be updated once it is finalised.

11. Your rights

Depending on applicable law, you may have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion, restrict or object to certain processing, and request a copy of your data in a portable format.

We do not currently offer automated self-service deletion or data export from within the product. To exercise any of these rights, contact us at geral@kuboloko.pt and we will handle your request manually. If you are not satisfied with our response, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection supervisory authority.

12. Security

We use access controls (row-level security) so that each company's data is only visible to members of that company, and we do not store payment card details ourselves. No online service can guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy as the Service or our data practices change. Material changes will be communicated to active customers where practical.

14. Contact

Questions or requests regarding this Privacy Policy can be sent to geral@kuboloko.pt.