Privacy Notice

Privacy Notice — Kubree

Version: 1.2 Effective date: May 2026 Last updated: June 2026

1. Data controller

Owen Raymundo Meneses Vega, an individual (persona física) based in Mexico, is the party responsible for processing the personal data collected through the Kubree service, available at kubree.ai.

To exercise your rights or resolve any questions about the processing of your data, you may contact us at:

• Privacy email: privacy@kubree.ai
• Support email: support@kubree.ai

2. Personal data we collect

Kubree collects the following categories of personal data:

2.1 Data you provide directly

• Identification: full name, email address, country of residence, occupation.
• Personal preferences: preferred language, areas of focus, and any additional context you choose to share with the agent.
• Conversation content: messages sent to the agent and the system's responses.
• Commitments and to-dos: tasks and reminders you register through the service.
• Feedback: comments and ratings you provide about the service.

2.2 Data we collect automatically

• Usage data: how often you use the service, number of messages sent, features used.
• Technical data: IP address, device type, operating system, browser type, time zone.
• Session data: authentication tokens, sign-in and sign-out records.

2.3 Third-party data (with your express authorization)

• Google Calendar: events, dates, times, and descriptions from your calendar, when you connect your Google account.
• Google Gmail: senders, subjects, and relevant email content, when you connect your Gmail account (feature available on Premium plans).

3. Purposes of processing

Your personal data is processed for the following purposes:

3.1 Primary purposes (necessary to provide the service)

• Create and manage your Kubree user account.
• Personalize the AI agent's experience according to your preferences and context.
• Maintain persistent memory of conversations and relevant data to improve service continuity.
• Manage the integration with third-party services you authorize (Google Calendar, Gmail).
• Process and manage the subscription plans you purchase.
• Send transactional communications (account confirmation, password recovery, service notifications).
• Detect and prevent service misuse, fraud, and activities that violate our policies.
• Comply with applicable legal obligations.

3.2 Secondary purposes (optional)

• Send you communications about new features, updates, and service improvements.
• Perform statistical usage analysis to improve the product.
• Contact you to request your participation in satisfaction surveys.

If you do not want your data processed for the secondary purposes, you may say so by emailing privacy@kubree.ai with your name and registered email address.

4. Legal basis for processing

The processing of your personal data is based on:

• Your express consent, given when you accept this Privacy Notice during registration.
• Performance of the contract for the provision of services between you and Kubree.
• Compliance with the legal obligations applicable to the data controller.
• The legitimate interests of the data controller, to the extent they do not override your rights and freedoms.

5. Sharing data with third parties

To provide the service, Kubree shares your data with the following third parties acting as data processors:

All listed providers operate under their own privacy policies and are subject to the data protection laws applicable in their jurisdictions. Kubree has entered into, or accepts, the corresponding data processing agreements with each provider.

We do not sell, rent, or share your personal data with third parties for those third parties' own commercial or advertising purposes.

6. International data transfers

Your personal data is stored and processed on servers located in the United States of America. These transfers are carried out under appropriate safeguards, including standard contractual clauses and compliance with applicable legal frameworks.

If you are a resident of the European Economic Area (EEA), the processing of your data complies with the General Data Protection Regulation (GDPR), including the legal bases for international transfers under Chapter V of the GDPR.

7. Data retention periods

8. ARCO rights and GDPR rights

8.1 Rights under the LFPDPPP (users in Mexico)

You have the right to:

• Access: know what personal data we hold about you and how we use it.
• Rectification: request correction of inaccurate or incomplete data.
• Cancellation: request deletion of your data when it is no longer necessary for the purposes of processing.
• Objection: object to the processing of your data for specific purposes.

To exercise these rights, email privacy@kubree.ai with:

1. Your full name and the email registered with Kubree.
2. The right you wish to exercise.
3. A clear description of your request.
4. A copy of an identity document (optional, but it may speed up the process).

We will respond within a maximum of 20 business days from receipt of your request.

8.2 Rights under the GDPR (users in the EEA)

In addition, if you are located in the European Economic Area, you have the right to:

• Data portability: receive your data in a structured, machine-readable format.
• Restriction of processing: request that we restrict the processing of your data in certain cases.
• Erasure ("right to be forgotten"): request deletion of your personal data.
• Lodge a complaint with a supervisory authority for data protection in your member state.

9. Account and data deletion

You may request complete deletion of your account and all associated data at any time:

1. From the Settings → Account → Delete account section within the app.
2. By emailing privacy@kubree.ai with the subject "Account deletion request."

Deletion is permanent and irreversible. Data will be deleted within a maximum of 30 calendar days of the request, except for data that must be retained due to legal obligations (see section 7).

10. Data security

Kubree implements technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS).
• Encryption of data at rest through Supabase's mechanisms.
• Access control via Row Level Security (RLS) in the database.
• Authentication using session tokens with expiration.
• Periodic security audits.
• Restricted access to production data, limited to authorized personnel only.

However, no system is completely secure. If we detect a security breach affecting your data, we will notify you within the timeframes set by applicable law.

11. Cookies and similar technologies

Kubree uses local storage technologies (localStorage, sessionStorage, session cookies) solely to:

• Keep your session active.
• Save your application preferences.
• Analyze product usage (PostHog).

We do not use third-party cookies for advertising purposes.

12. Minors

The Kubree service is intended exclusively for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you become aware that a minor has provided their data without authorization, please report it to privacy@kubree.ai so we can delete it.

13. Changes to this Privacy Notice

We reserve the right to update this Privacy Notice at any time. When we make material changes, we will notify you by email or through a prominent notice within the application at least 15 days before the changes take effect.

The current version will always be available at kubree.ai/privacidad.

14. Contact

For any inquiry, request, or concern related to the processing of your personal data:

• Privacy email: privacy@kubree.ai
• General support: support@kubree.ai

This Privacy Notice was drafted in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and aligned with the European Union's General Data Protection Regulation (GDPR). Version 1.2 — June 2026.