PRIVACY POLICY

Welcome to Kuber. We prioritize your privacy and are dedicated to protecting it. This Privacy Policy explains what data we collect, how we use it, where we store it, how long we retain it, and the rights you have over your data. By using Kuber's website, mobile and desktop applications, and related services (collectively, the "Service"), you agree to this policy.

We use collected information to:

• Provide, personalize, and maintain the Service.
• Authenticate you and manage your account.
• Enable imports/exports and sync with services you authorize.
• Send account-related communications (security alerts, billing, transactional emails).
• Analyze and improve our services, conduct research and analytics.
• Detect and prevent fraud, abuse, and security incidents.
• Fulfil legal obligations and respond to lawful requests.

We do not sell or trade your personal data.

Where applicable (for users protected by laws that require a legal basis), we process personal data on one or more of these bases:

• Consent — when you consent (for optional features, analytics, marketing).
• Contractual necessity — to provide requested services and perform your contract with us (account creation, paid services, sync).
• Legal obligation — to comply with laws or respond to legal requests.
• Legitimate interests — improving services, security, fraud prevention — balanced against user privacy.

Industry-standard defaults

• Account basic info: retained while your account is active and for 90 days after deletion for recovery and dispute resolution.
• Planning & financial data: retained while your account is active. After account deletion, retained for up to 7 years if needed for legal, tax, or audit reasons; otherwise, removed according to the deletion timeline.
• Usage logs & raw diagnostics: raw logs retained for 90 days, then deleted or aggregated/pseudonymized for analytics.
• OAuth tokens & credentials: short-lived access tokens are ephemeral. Refresh tokens are encrypted and retained only while your account is active. Refresh tokens will be revoked and removed within 30 days after account deletion.
• Backups: encrypted backups may be retained for up to 1 year for non-financial data. Backups containing financial records may be retained up to 7 years if required for legal compliance.

• Access & update: You can access and update your personal information via account settings.
• Portability: On request, we will provide a machine-readable export (JSON or CSV) of your personal data and user-provided planning/financial data. To request a data export, contact hello@openkuber.com. We aim to fulfill portability requests within a reasonable timeframe consistent with applicable law.

Depending on your jurisdiction, you may have additional rights such as:

• Request correction of inaccurate personal data
• Request restriction of processing
• Object to processing for direct marketing or legitimate interests
• Lodge a complaint with a supervisory authority

To exercise any rights, contact hello@openkuber.com. We may ask for information to verify your identity before fulfilling requests.

Primary storage and processing occur in India (Google Cloud region asia-south1 — Mumbai).

We implement industry-standard technical and organizational measures to protect your data, including:

• TLS encryption for data in transit
• Encryption at rest for sensitive data and tokens
• Role-based access controls and logged access to production systems
• Secure token handling (server-side storage and usage where possible)
• Regular security reviews, vulnerability testing, and patching
• Key rotation and least-privilege access practices

No system can be 100% secure; however, we continuously improve our security posture.

Kuber uses cookies and similar technologies to operate and improve the Service:

• Strictly Necessary Cookies: required for core functionality (e.g., session management)
• Functional Cookies: remember your preferences and settings
• Performance Cookies: collect anonymous usage statistics to improve the Service
• Targeting Cookies: measure the effectiveness of advertising and tailor marketing content

You can manage cookie preferences through our Cookie Settings interface.

Kuber is not intended for children under 13. We do not knowingly collect information from children under 13. If we learn that we have collected personal data of a child under 13 without parental consent, we will delete it promptly. If you believe we have collected such data, contact hello@openkuber.com.

We may update this policy occasionally to reflect changes in our practices or legal requirements. We will post the updated policy with a new Effective date. Significant changes will be communicated by email where required. Continued use of the Service after changes indicates acceptance of the revised policy.

For any privacy questions, to exercise your rights (access, correction, deletion, portability, restrict processing), or to request a list of third-party processors, contact: