How Kuuba handles your visitors' information

From 14 October 2026, we have published, in one place, how Kuuba handles information on your website. This post covers what Kuuba keeps, how a visitor's details reach your team only with their permission, how every conversation tells visitors they are talking to an AI assistant, and what your firm controls.

Firms rightly ask about UK GDPR early. We do not make blanket compliance claims. Instead, here is how Kuuba is designed, so you can judge it against your own obligations and your own privacy notice.

Designed to collect less

Kuuba is built around data minimisation. A visitor can ask questions without giving any personal details at all. Details are only asked for when a question is being passed to your team, and even then the assistant asks for a name and one way to reply, nothing more.

Permission before anything is passed on

When nothing published covers a question, or the question is on a topic you leave to your team, Kuuba says so and asks the visitor whether they would like it passed on. Only if they agree does it take their name and one way to reply. A visitor's name and contact details reach your team only after they agree to be contacted.

Your team then receives one enquiry with the visitor's question, the conversation so far, how to reach them and their permission to reply.

Always clear that it is an AI assistant

Every conversation opens by telling the visitor they are talking to an AI assistant. This is the same on every plan, and branding does not change it. Kuuba never pretends to be a person.

What Kuuba keeps

• Your published entries, with who wrote them and when.
• Conversations, with each reply stored alongside the published version of the entry behind it.
• Enquiries, open until your team marks them handled, with the conversation kept.

Each firm's entries, conversations and enquiries are stored against that firm and kept separate from every other firm's.

How access is protected

• Every dashboard request is limited to the signed-in person's own firm.
• The dashboard needs an account, and sign-in sessions expire after 30 days.
• Passwords are stored as salted hashes, never as plain text.
• Publishing is kept to the people you allow to approve and publish.
• The key in your website snippet can only send visitor questions and enquiries. It does not open your dashboard or your records.

What your firm controls

You decide what the assistant says, because it replies only from entries you have published. You decide which topics are left to your team. And as the firm using Kuuba on your website, you decide what your own privacy notice tells visitors about enquiries.

What to ask us

Some details firms rightly ask about, such as where data is hosted, which processors are involved, encryption, retention and deletion, backups and a data processing agreement, are listed on our Security page with their current position. If you need more detail on any of them, ask us. We hold no certifications or independent assessments today, and we say so.

Create an account to see how it works on your own entries, or talk to us if your firm has questions about data handling.