For business accounts, Swiid Technologies decides how data is used. For a business’s customers who chat with Kubo, that business decides — we process on its behalf.
Privacy policy
Your data, handled with care.
What Kubo collects, why, who can see it, how long we keep it, and the rights you have over it — in plain language, in full.
We don’t sell personal information, share it for advertising, use ad or analytics trackers, or train AI models on customer conversations.
Customer chats are stored with common identifiers redacted and deleted after 30 days by default. Health-related conversations aren’t stored at all.
Ask to see, correct, export or delete your information at hello@swiidtech.com. Verified deletions are completed within 30 days.
The summary is a guide only. The full text below is what applies.
Who we are and what this covers
This privacy policy explains how Swiid Technologies (“Swiid Technologies,” “we,” “us” or “our”) collects, uses, shares and protects personal information in Kubo, our AI employee platform. Kubo is a product of, and is operated by, Swiid Technologies. This policy covers:
- the Kubo website, including the public demo, the Live Assist simulation and documentation (the “site”);
- the Kubo dashboard used by businesses and their team members (the “dashboard”); and
- the Kubo customer assistant that businesses install on their own websites and applications (the “widget”), together the “Services.”
“Personal information” (also called “personal data”) means information that identifies, relates to, or could reasonably be linked to an individual.
What this policy does not cover. It doesn’t cover other Swiid Technologies products or websites, which have their own policies, or third-party websites we link to. It also doesn’t replace the privacy notice of a business that uses Kubo: if you are chatting with Kubo on a business’s website, that business’s own privacy notice explains how it uses your information.
Swiid Technologies is based in New Castle, Delaware, USA.
Our role: controller and processor
Kubo serves two groups of people, and our legal role is different for each:
| Who you are | Our role | Who decides how your data is used |
|---|---|---|
| A business customer or team member | Controller (and “business” under U.S. state privacy laws) | Swiid Technologies, under this policy and our terms |
| A visitor to the Kubo site or public demo | Controller | Swiid Technologies, under this policy |
| A customer chatting with Kubo on a business’s website | Processor (and “service provider” under U.S. state privacy laws) | The business that installed Kubo. We process your information only on its instructions and to provide and secure the Services. |
If you are a customer of a business that uses Kubo and want to exercise privacy rights, contact that business first. If you contact us instead, we will forward your request to the business where we can identify it and will help it respond. We may also act on our own to protect the security of the Services.
Information we collect
From businesses and team members
- Account information. Your name, email address and password. We never store your password itself — only a salted, one-way scrypt hash of it.
- Business profile. Business name, industry, website, contact email, preferred language, description, operating policies and the goals you choose during onboarding.
- Workspace content. Knowledge entries, products (names, descriptions, prices, stock, thresholds and verified variants), manually recorded sale or order events, Brand Studio settings, approved website origins, saved report snapshots and alert acknowledgments (which team member acknowledged an alert, and when).
- Owner assistant questions. Questions you ask Kubo in the dashboard are used to answer you from your own workspace records.
- Security and audit records. When a signed-in request is authorized we record who made it, the organization, the method and path, and the time. We do not record request bodies, chat content, cookies or passwords in these records.
Knowledge entries, catalog fields, your greeting and your business policies are public by design: Kubo uses them to answer your customers. Please don’t put private, confidential or personal information in them. Kubo rejects recognizable credentials, but it cannot detect every kind of sensitive information.
From customers who chat with Kubo on a business’s website
- Conversation messages. Your messages and Kubo’s replies, so the business can review its customer conversations. Before saving, Kubo automatically redacts common identifiers such as email addresses, long numbers and password-like text. This is best-effort minimization, not complete anonymization.
- A random conversation code. A code that groups the messages of one conversation. It is kept only in the open chat window, is not a cookie, and isn’t linked to your name or email. Where we use it to count requests, we store only a one-way hash of it.
- Optional feedback. If you choose to leave a rating or comment and agree to share it, we store the rating, your comment, the product it’s about (if you pick one) and the time. Feedback is always optional and can be skipped.
- Optional structured requests. Only if you tick the box allowing it, Kubo records a fixed topic from your question (for example, “Color: black” for a product) instead of your original words, so the business can see what customers ask for.
Healthcare businesses. When a business is set up as healthcare, Kubo provides administrative help only. Message content is not stored (only that a conversation happened), structured requests are switched off, and feedback is ratings-only. Please never share medical details with Kubo.
From visitors to the Kubo site
- Public demo questions. Questions you type into the public demo are answered from a fictional sample shop and are not saved to any business workspace.
- Live Assist simulation. Any image you pick stays in your own browser for a local preview. It is never uploaded.
- Correspondence. If you email us, we receive your email address, your message, attachments and the usual email metadata.
Collected automatically
- Server and security logs. When your browser requests a page, the hosting environment records technical information such as IP address, browser type, the page requested, time and response status, to deliver the Services and protect them from attacks.
- Abuse protection. To stop spam and overload we count requests in short time windows. These counters store a one-way hash, not your IP address or email address, and reset automatically.
- Usage counts. We count the number of assistant messages per business per day to enforce a cost safeguard.
We do not use analytics trackers, advertising pixels, social media plugins, session recording or device fingerprinting. Fonts are served from our own domain, so loading Kubo doesn’t send information to a font service.
Please don’t send us sensitive information — health, financial account, government ID, biometric or precise location information, or information about children — through Kubo or by email. We don’t need it, and if we receive it unexpectedly we will delete it.
How we use information
We use personal information only for the purposes below. Where laws such as the GDPR apply, the table shows the legal basis we rely on for the information we control.
| Purpose | Information used | Legal basis (EEA, UK, Switzerland) |
|---|---|---|
| Create and run your account and workspace | Account information, business profile, workspace content | Performance of a contract |
| Answer customers on a business’s behalf | Customer messages, the business’s public knowledge and catalog | Processed on the business’s instructions (the business determines its own legal basis) |
| Answer owner questions from workspace records | Owner questions, workspace content | Performance of a contract |
| Show businesses their conversations, feedback and Business Pulse insights | Redacted conversations, consented feedback, opt-in structured requests | Processed on the business’s instructions |
| Secure the Services, prevent spam, fraud and abuse, and enforce usage safeguards | Logs, hashed request counters, usage counts, audit records | Our legitimate interest in keeping the Services and their users safe; legal obligations |
| Reply to your messages and support requests | Correspondence | Legitimate interest; steps you ask us to take before a contract |
| Comply with law and establish or defend legal claims | Any of the above, as needed | Legal obligation; legitimate interest |
When we rely on legitimate interests, we have weighed them against your rights and use the least information needed. You can object at any time (see Your rights).
We never use one business’s data to serve another business, build cross-business profiles of customers, sell personal information, send marketing emails because you contacted us, or use customer conversations to train AI models.
Kubo and artificial intelligence
Kubo is an automated assistant, not a person. Today his answers come from grounded rules over approved records — the business’s public knowledge and catalog for customers, and its own workspace records for owners. No external generative AI model is connected, so your messages are not sent to an AI provider.
- If we connect a model in future, we will update this policy before it is enabled, name the provider, describe what is sent, and only use providers whose terms prohibit training on the data we send.
- Separate assistants. The customer assistant can only read public business information. It cannot read revenue, reports, feedback lists or other customers’ conversations.
- No automated decisions about you. Kubo doesn’t make decisions with legal or similarly significant effects, and nothing he says creates an agreement, order, booking or commitment.
- Live Assist. Guided workflows follow fixed steps and require your explicit confirmation before anything consequential. The public simulation performs no upload, payment or paid generation.
- Accuracy. Kubo can be wrong or out of date. For anything important, contact the business directly.
International transfers
Swiid Technologies is based in the United States, and businesses use Kubo in many countries, including Nigeria and the United States. Your information may be processed outside the country where you live. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we use a lawful transfer mechanism such as the European Commission’s Standard Contractual Clauses with the UK Addendum, together with additional safeguards where appropriate. You can ask us for details.
How long we keep information
We keep personal information only as long as needed for the purposes above, then delete it.
| Information | How long |
|---|---|
| Customer conversations, feedback comments and structured requests | 30 days by default. Each business can set between 1 and 365 days. Older records are deleted when the workspace or widget is next used. |
| Healthcare conversation content | Not stored |
| Account information and workspace content | While the account is open, then deleted on request or account closure |
| Sign-in sessions | 12 hours, or until you log out |
| Hashed abuse-protection counters | Minutes to an hour, then reset |
| Audit records | As long as needed for security, then deleted |
| Correspondence | Up to 24 months after our last exchange, unless needed longer for legal reasons |
| Records of privacy requests | At least 24 months, as some laws require |
We are honest about one limit: retention is currently enforced when a workspace or widget is used, not by a separate scheduled job. A durable cleanup job is planned before launch.
Deleting your information
Customers chatting with Kubo can delete their own saved conversation, and any structured requests from it, at any time with “Clear saved conversation” in the chat. Ratings submitted separately are kept unless you ask the business to remove them.
Business accounts: email hello@swiidtech.com to close your account. Within 30 days of verifying your request we delete your account, workspace content and the customer records stored for your business from our active systems, and confirm when it’s done.
The only exceptions are information we must keep by law or to defend a specific legal claim, a short record of your request, and routine backups, where deleted records remain only until they are overwritten. We don’t restore backups to recover deleted information.
How we protect information
- Every business’s data is separated on the server; a business can only ever read its own records.
- Passwords are salted and hashed; session codes are stored only as hashes and expire after 12 hours.
- The public customer assistant can only read public business information.
- Strict validation of every request, rate limits, daily usage safeguards and a strict content security policy.
- The widget runs isolated in its own frame, only on websites the business approves, and sends no cookies.
- Secret keys are kept on the server and never sent to browsers.
No system is perfectly secure, and we don’t claim to be impenetrable or certified. Kubo has not yet completed an independent security review, which is required before public launch. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires. Report security problems to hello@swiidtech.com (see responsible disclosure).
Your rights
Depending on where you live, you may have some or all of these rights. We honor them for everyone where we can:
- Access: to know what we hold about you and get a copy.
- Correction: to fix inaccurate or incomplete information.
- Deletion: to have your information erased.
- Portability: to receive your information in a machine-readable format.
- Restriction and objection: to limit how we use your information or object to uses based on legitimate interests.
- Withdraw consent: at any time, without affecting what happened before.
- Opt out of sale, sharing, targeted advertising and profiling (we don’t do any of these).
- Non-discrimination: we won’t treat you differently for using your rights.
- Complain to a data protection authority.
If a business installed Kubo and you are its customer, the business handles your request; see Our role.
Regional information
EEA, UK and Switzerland
We respond to requests within one month, extendable by two months for complex requests. You can complain to your local supervisory authority, though we’d appreciate the chance to help first. Where required, we will appoint an EU or UK representative and list them here.
United States
For residents of states with consumer privacy laws (including California, Colorado, Connecticut, Delaware, Virginia, Texas and others), we collect identifiers (name, email, IP address in security logs), personal records, internet activity (conversations and requests) and professional information you choose to share. We don’t collect sensitive personal information, don’t sell or share personal information, and don’t profile. We confirm requests within 10 business days and respond within 45 days. If we decline, you can appeal by emailing hello@swiidtech.com with “Privacy appeal” in the subject, and then contact your state attorney general. Authorized agents may make requests with proof of permission.
Nigeria and other countries
People in Nigeria have rights under the Nigeria Data Protection Act 2023, and many other countries give similar rights, including Canada, Brazil, South Africa, Kenya, India, Australia, Japan and Singapore. Wherever you live, you can use the rights in this policy by contacting us, and you can complain to your local data protection authority.
How to make a request
- Email hello@swiidtech.com with the subject “Privacy request” and tell us what you’d like us to do.
- Include the email address of your account, or for a widget conversation, the business, the date and what it was about.
- We’ll verify your request, usually by replying to the email address on the account, and ask only for what we need.
Requests are free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline, and we’ll explain why.
Children
Kubo’s dashboard is for businesses and adults. We don’t knowingly collect personal information from children under 13 (or under 16 in the EEA and UK, or the age set by local law). Businesses must not direct Kubo at children without the protections the law requires. If you believe a child has given us personal information, email hello@swiidtech.com and we will delete it.
Changes to this policy
We’ll post any new version here and change the “Last updated” date. If a change materially affects how we use information we already hold — for example, connecting an AI provider — we’ll give more prominent notice beforehand and, where required, ask for consent.
Contact us
Questions, requests or complaints about privacy: email hello@swiidtech.com. Kubo is operated by Swiid Technologies, New Castle, Delaware, USA.
See also our terms of service and accessibility statement.