Kyubi Privacy Policy

1. Introduction

Kyubi Norway ("Kyubi", "we", "us", "our") provides AI-powered tools and related services (the "Kyubi Products"). Kyubi Norway is the data controller for personal data processed in connection with the Kyubi Products.

We process personal data in accordance with:

• The EU General Data Protection Regulation (GDPR)
• The Norwegian Personal Data Act (Personopplysningsloven)

This Privacy Policy explains what personal data we process, why we process it, the legal basis for processing, how long we retain it, and your rights.

2. What Information Do We Process?

2.1 Information You Provide

• Account information (name, email address, organization, login credentials)
• Profile information you choose to provide
• Content submitted to the Kyubi Products, including AI prompts, uploaded files, and generated outputs
• Communications with us (support requests, feedback, survey responses)

2.2 Usage Information

• Log data (IP address, time and date of access, browser type)
• Interactions with features
• Performance and diagnostic data
• Device type and operating system

We do not engage in cross-context behavioral tracking or third-party advertising profiling.

2.3 Special Category Data

You may choose to include sensitive information (such as health data, political opinions, religious beliefs, or other special categories under Article 9 GDPR) in AI prompts or uploaded content.

We process such data only:

• At your explicit request when you submit it, and
• Based on your explicit consent under Article 9(2)(a) GDPR.

You may withdraw your consent at any time by deleting the relevant content or contacting us.

3. Legal Basis for Processing

3.1 Performance of Contract (Article 6(1)(b) GDPR)

Processing necessary to:

• Create and manage accounts
• Provide AI functionality
• Deliver requested services
• Provide customer support

3.2 Legitimate Interests (Article 6(1)(f) GDPR)

Processing necessary to:

• Improve product performance
• Ensure platform security
• Prevent fraud or misuse
• Conduct internal analytics

We balance our legitimate interests against your rights and implement safeguards to minimize impact.

3.3 Consent (Article 6(1)(a) GDPR)

We rely on consent for:

• Processing special category data
• Optional product research or surveys
• Non-essential cookies (if applicable)

You may withdraw consent at any time.

3.4 Legal Obligations (Article 6(1)(c) GDPR)

Where necessary to comply with Norwegian or EEA legal requirements.

4. How We Use Personal Data

We use personal data to:

• Provide and operate the Kyubi Products
• Improve AI systems and product functionality
• Maintain platform security
• Respond to support requests
• Comply with legal obligations

We do not sell personal data.

5. Automated Processing and AI Systems

Kyubi Products use AI systems to generate outputs based on user prompts.

These systems:

• Operate automatically
• Generate outputs based on statistical and machine learning models
• Do not make legally binding decisions about users
• Do not produce decisions with legal or similarly significant effects under Article 22 GDPR

If automated processing significantly affects you, you may contact us to request human review.

6. Sharing of Personal Data

6.1 Service Providers

We use trusted third-party providers for:

• Cloud hosting
• Infrastructure
• Security monitoring
• Customer support tools
• Payment processing

These providers act as data processors under written data processing agreements.

6.2 Legal Requirements

We may disclose data where required by law or regulatory authorities. We do not share personal data with advertisers for behavioral advertising.

7. International Data Transfers

Kyubi Norway AS may transfer personal data outside Norway and the EEA where necessary for service provision.

When transferring personal data to countries not deemed adequate by the European Commission, we use:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfer Impact Assessments
• Supplementary technical and organizational safeguards where required

You may request a copy of applicable safeguards by contacting us.

8. Data Retention

We retain personal data only as long as necessary for the purposes described:

• Account data: retained while your account is active
• User content: retained until deleted by you or account closure
• Support communications: retained for up to 3 years
• Log data: retained for up to 12 months unless required for security investigations
• Financial records: retained as required by Norwegian accounting law

Upon account deletion, personal data is deleted or anonymized unless retention is legally required.

9. Your Rights

Under GDPR and the Norwegian Personal Data Act, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data
• Restrict processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent at any time
• Object to direct marketing (if applicable)

You may exercise your rights by contacting: privacy@kyubi.dev

We respond within one month as required by GDPR.

You also have the right to lodge a complaint with the Norwegian supervisory authority:

10. Children's Data

Kyubi Products are not intended for children under 13 years of age. If we become aware that we have collected personal data from a child without appropriate consent, we will delete it.

11. Contact Information