Kuuba Privacy Notice

In short: Kuuba Ltd runs Kuuba, an AI assistant that UK service firms add to their websites. You can contact us about privacy at any time.

1.1Kuuba Ltd ("Kuuba", "we", "us", "our") is a company registered in England and Wales with company number 17555395. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER: to be confirmed].

1.2Kuuba is a website assistant for UK service firms such as solicitors and accountants. It answers visitor questions using only the knowledge a firm chooses to publish, shows the exact source sentence it relied on, and passes the conversation to the firm's team with an enquiry summary when it is not sure of the answer.

1.3You can contact us about privacy at Kuuba Ltd, privacy@kuuba.ai, or by post at our registered office. We are not required to appoint a Data Protection Officer, but our privacy contact handles all privacy questions, requests and complaints.

In short: Whether we are responsible for your information depends on how you deal with Kuuba. The table below tells you which part of this notice applies to you.

2.1Data protection law gives different responsibilities to a "controller" (who decides why and how personal information is used) and a "processor" (who handles it on the controller's behalf and only on its instructions).

In short: A one-page view of what we collect, why, and for how long. The detail is in sections 4 to 11.

In short: We collect information you give us, information created when you use Kuuba, and a small amount from trusted third parties such as Google (if you sign in with Google) and Stripe (for payments).

Information you give us

• Account information: your name, work email address, the firm you work for, your role, and your account settings.
• Sign-in information: Kuuba does not use or store passwords. You sign in with a one-time code sent to your email, or with Google. If you turn on two-factor authentication (2FA), we store the secret needed to check your authenticator app codes.
• Billing information: the billing contact, billing address, VAT number (if any) and the plan you choose. Card, Link and Bacs Direct Debit details are collected and held by Stripe, not by us. We see limited details such as the card brand, the last four digits and the expiry date, or the fact that a Direct Debit mandate is active.
• Customer content: the documents (PDF and Word) your firm uploads, the website pages it asks Kuuba to read, and the assistant settings it chooses. This content may include personal information, for example staff names on a "meet the team" page. Your firm decides what to publish.
• Messages and enquiries: what you tell us through our contact form, by email or in support conversations, including your name, email address, firm and the content of your message.

Information created when you use Kuuba

• Usage information: which features you use, your plan, token usage and top-up history, and account activity such as sign-ins.
• Security and audit information: an audit log of important account actions (for example who changed a setting and when), and security events such as failed sign-in attempts. We store IP addresses as keyed hashes rather than in readable form. Our system logs are designed to remove personal information before it is written.
• Session cookies: when you sign in to the Kuuba app we set secure cookies to keep you signed in (see section 7).

Information from third parties

• Google: if you choose "Sign in with Google", Google tells us your name, email address and a Google account identifier. We do not receive your Google password.
• Stripe: Stripe tells us whether a payment succeeded or failed, the payment method type and limited details about it, and subscription status.
• Your colleagues: an account administrator at your firm may invite you by giving us your name and work email address.

In short: We only use your information where the law allows it. For most purposes we rely on our contract with your firm or on our legitimate interests in running a secure, useful business service.

5.1Our customer is usually a firm, not the individual account holder. Where you are the contracting party yourself (for example as a sole practitioner) we rely on contract. Where your firm is the contracting party, we rely on our legitimate interests, and those of your firm, in providing the service it has paid for.

5.2Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that balancing test, and you can object (see section 13).

5.3Special category data. We do not ask account holders for special category data (such as health information). Please do not include it in messages to us unless it is needed.

In short: We send business marketing emails only in ways the law allows, and every email has a one-click unsubscribe.

6.1Email marketing is governed by the Privacy and Electronic Communications Regulations 2003 (PECR) as well as the UK GDPR.

• Companies and LLPs ("corporate subscribers"): we may send marketing to work email addresses at these organisations based on our legitimate interests, and you can opt out at any time.
• Sole traders and partnerships ("individual subscribers"): we will only send marketing if you have consented, or if you are an existing customer or gave us your details while asking about Kuuba and we offered you a chance to opt out at that time and in every message (the "soft opt-in").

6.2We will never sell or rent your contact details. To stop marketing, click "unsubscribe" in any email or write to [privacy@ CONTACT EMAIL: to be confirmed]. We keep a short suppression record so that we do not contact you again. Service messages (such as payment reminders and security alerts) are not marketing and will continue while you have an account.

In short: The Kuuba chat widget on firms' websites does not set cookies on visitors. Our app uses only strictly necessary cookies to keep you signed in. We will ask before using any optional cookies on our own website.

7.1PECR requires consent before storing or reading information on your device unless it is strictly necessary for a service you have asked for (or falls within another exemption).

7.2You can control cookies through your browser settings. Blocking strictly necessary cookies will stop you signing in to the app.

In short: Kuuba uses AI models from Anthropic and Voyage AI to find and phrase answers drawn only from a firm's own published content. It is not used to make decisions about people.

8.1How an answer is produced. When a firm sets up Kuuba, the documents it uploads and the web pages it asks us to read are stored on our UK servers. Voyage AI turns that content into numerical representations ("embeddings") so that Kuuba can find the most relevant passages. When a visitor asks a question, the question and the relevant passages are sent to Anthropic's Claude model, which writes an answer based only on those passages. Kuuba shows the exact source sentence it relied on. If the assistant is not confident, it offers to pass the enquiry to the firm's team with a short summary.

8.2No training. We do not use account holders' information, firms' content or visitors' chats to train AI models. Anthropic's commercial terms state that it may not train models on content submitted through its API. [CONFIRM BEFORE PUBLICATION: Voyage AI trains on API content unless the customer opts out, so Kuuba must have opted out in the Voyage AI dashboard before this sentence is accurate.]

8.3Where AI processing happens. Questions and passages sent to our AI providers may be processed outside the UK, including in the United States. Section 10 explains the safeguards.

8.4Limits. AI can make mistakes. Kuuba is designed to answer only from the firm's content and to cite it, but answers are not legal, financial or other professional advice from Kuuba.

In short: We share information only with service providers who help us run Kuuba, under contracts that protect it, and where the law requires.

9.1Stripe acts as an independent controller for some payment information (for example to meet its own anti-money laundering and fraud obligations), so Stripe's privacy policy also applies. Google acts as an independent controller for your Google account.

9.2We may also share information: with professional advisers (such as lawyers and accountants) under duties of confidentiality; with the police, regulators or courts where the law requires; and with a buyer or investor if Kuuba's business is sold or restructured, in which case we will tell you.

In short: Our main database is in London. Some providers process data in the US. We only use providers covered by a lawful transfer safeguard.

10.1Where personal information is sent outside the UK, we make sure one of the following applies: (a) the destination is covered by UK "adequacy regulations" (for example the EEA, or a US organisation certified to the UK Extension to the EU-US Data Privacy Framework, also called the UK-US data bridge); or (b) we or our provider use the ICO's International Data Transfer Agreement (IDTA) or the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

10.2Our backups are stored in the UK or the EEA. The EEA is covered by UK adequacy regulations. You can ask for more information about these safeguards at [privacy@ CONTACT EMAIL: to be confirmed].

In short: We keep information only as long as we need it. The periods below are our standard periods; the law sometimes requires us to keep things longer.

In short: We use security measures designed for a service that handles professional firms' data.

• Our database and stored documents are hosted on servers in London, UK, and backups are encrypted and stored off-site in the UK or EU.
• We do not use or store passwords. Sign-in uses one-time email codes or Google, with optional 2FA using an authenticator app.
• Sessions are kept in secure cookies.
• Our logs are designed to remove personal information, and we store IP addresses as keyed hashes.
• An audit log records important account actions.
• Information is encrypted in transit between your browser and our servers. [CONFIRM: encryption at rest for the main database and document store.]
• Access to production systems is limited to people who need it.

12.1No system is perfectly secure. If a personal data breach is likely to result in a risk to you, we will tell the ICO within 72 hours of becoming aware of it, and we will tell you without undue delay if the risk is high.

In short: You have rights over your personal information. Most are free to use and we will normally reply within one month.

13.1How to use your rights. Email [privacy@ CONTACT EMAIL: to be confirmed] or write to our registered office. We may need to confirm your identity. We will respond within one month, which we can extend by up to two further months for complex requests, and we will tell you if we do. Under the Data (Use and Access) Act 2025, the time limit does not start until we have any information we reasonably need to confirm who you are, and we will carry out reasonable and proportionate searches.

13.2If you are a visitor who used an assistant on a firm's website, please contact the firm first, because it is the controller. If you contact us, we will pass your request to the firm and help it respond.

14.1We do not make decisions about account holders or website visitors based solely on automated processing that have legal or similarly significant effects. The Kuuba assistant answers questions and may suggest passing an enquiry to the firm's team. Any decision about a visitor's matter is made by the firm's people.

15.1Kuuba is a business service. Accounts are only for people aged 18 or over acting for a business, and our website is not aimed at children. If you think a child has given us information, contact us and we will delete it. Firms are responsible for how their own websites deal with younger visitors.

In short: Please talk to us first. If you are not happy with our answer, you can complain to the ICO.

16.1Complain to us first. Send your complaint to [privacy@ CONTACT EMAIL: to be confirmed] or use [COMPLAINTS FORM URL, OPTIONAL: to be confirmed]. We will acknowledge it within 30 days, look into it without undue delay, keep you updated and tell you the outcome. This is our process under the Data (Use and Access) Act 2025.

16.2The ICO. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO will usually expect you to have raised the complaint with us first.

In short: The firm whose website you visited is responsible for your chat. Kuuba provides the technology and follows the firm's instructions. Read the firm's privacy notice to find out how it uses your information.

17.1Who is responsible. The firm that runs the website is the controller of your chat messages and any contact details you give in a handoff. Kuuba is its processor. We use this information only to provide the assistant to the firm, under a data processing agreement, and not for our own purposes.

17.2What is collected. Your questions and the assistant's answers; if you ask to be put in touch, the contact details you choose to give (such as your name, email address or phone number) and an enquiry summary; and a keyed hash of your IP address and basic technical information used for security and abuse prevention.

17.3AI notice. The assistant is an AI system and the firm is required to keep a notice telling you this visible in the chat. Answers come from the firm's own published content and are not personal legal, financial or other professional advice.

17.4Cookies. The chat widget does not set cookies on your device.

17.5AI providers. Your questions are sent to Anthropic (and [may be sent to Voyage AI, CONFIRM]) to generate answers and may be processed outside the UK under the safeguards in section 10. They are not used to train AI models.

17.6Please do not share sensitive information in the chat, such as health details or details of criminal matters, unless the firm has said it is appropriate to do so. If you need advice, ask to be put in touch with the firm.

17.7Your rights. To access, correct or delete your chat information, contact the firm. Its privacy notice is normally linked from its website. If you contact us, we will forward your request to the firm and help it respond.

18.1We may update this notice from time to time. The version number and effective date at the top show when it last changed. If we make a significant change, we will tell account holders by email or in the app before it takes effect.

Does Kuuba sell my data?

No. We do not sell or rent personal information.

Does Kuuba train AI on my firm's documents or on visitor chats?

No. We do not use them to train AI models, and we choose AI providers whose terms allow us to keep it that way (see section 8).

Where is my data stored?

Our database, uploaded documents and copies of website pages are stored on servers in London. Encrypted backups are stored off-site in the UK or EU. Some processing by our AI and email providers happens outside the UK (see section 10).

Do you store my password?

No. Kuuba does not use passwords. You sign in with a one-time email code or with Google, and you can add an authenticator app for extra security.

I chatted with an assistant on a firm's website. Who do I contact?

The firm. It decides how your chat is used. You can also contact us and we will pass your request on.

Does the chat widget track me with cookies?

No. The widget does not set cookies on visitors' devices.

Is the assistant giving me legal advice?

No. It repeats information the firm has published and shows the source. For advice about your situation, ask to be put in touch with the firm's team.

How do I delete my account?

An account administrator can cancel the subscription through the Stripe Customer Portal and ask us to close the account at [support@ CONTACT EMAIL: to be confirmed]. We then delete or anonymise information in line with section 11.

How do I stop marketing emails?

Click "unsubscribe" in any marketing email or email [privacy@ CONTACT EMAIL: to be confirmed].