KuboRunUpdated: 28 September 2026.
Controller and scope
The controller’s legal identity is pending before commercial launch. This policy covers marketing and the application. For personal data you host about your customers, you act as controller and an appropriate processing agreement must be concluded.
Information and purposes
We process registration, access, account membership, support, hosted projects and content, resource usage, balances, payments and invoices. The marketing contact form prepares an email on your device; it does not automatically send it. Do not include passwords or secrets.
Legal bases
Service delivery and requested pre-contractual steps rely on contract; mandatory billing retention relies on legal obligations. Service security and abuse prevention rely on legitimate interests subject to assessment. Optional analytics and campaign attribution require consent and are not required to purchase the service.
Analytics and campaigns
With permission we measure limited events, including app visits and preparing an enquiry. First payment is verified from a positive settled server payment, including approved transfers. GA4 receives events; Google Ads receives the conversion only with campaign permission. We do not send names, email addresses, form content, project identifiers or secrets. Providers receive connection information including IP addresses: this is not anonymous analytics. Google Signals, remarketing and enhanced conversions are disabled.
Retention
Resource closure has a 30-day recovery window; identity erasure is separate and also cancellable for 30 days. Restricted fiscal custody starts at six years from the last accounting entry or paid order. Unresolved balances, restrictions and claims can block expiry and require review. Managed backups use 35 days; external backups/logs require their own configuration. First-party events are retained for 90 days and consent decisions for 180 days. Browser consent expires after 180 days. Google retention is separate; production setup must limit GA4 user/event data to two months.
Recipients and international transfers
Hosting, email (Cloudflare reception and delivery from our infrastructure), authentication, payment and, if enabled and consented, Google Analytics 4 and Google Ads providers may process data. The final provider/location inventory is pending. Contracts, subprocessors and safeguards for transfers outside the EEA must be documented before activation; no provider is assumed automatically covered.
Rights
You may request access, correction, erasure, restriction, objection and portability where applicable. Withdraw optional consent in Privacy preferences; withdrawal does not affect earlier lawful processing. You may complain to the Spanish Data Protection Agency (aepd.es). The controller’s contact channel must be completed before final publication.
Security and recovery
Access controls and secret encryption protect the service. Account deletion does not automatically remove fiscal obligations or debt. Recovery requires continuity proof and preserves the balance; it does not restore deleted files. Histories linked to accounts are not anonymous.
Bot protection
When enabled, we use Cloudflare Turnstile to protect access to KuboRun from bots. See the Turnstile Privacy Addendum from Cloudflare.