Privacy Policy — Kumula

DRAFT — have a lawyer check before publishing. Replace every [BRACKET].

Last updated: [DATE]

1. Who we are

HUBtech s. r. o., company ID 56 882 815, registered at Werferova 3782/6, 040 11 Košice, Slovakia ("we"). Contact for privacy: hello@getkumula.com.

2. What the service does

We let you connect your marketing accounts once and then read your data in your own AI client (Claude or ChatGPT) through a connector, in Google Sheets, in a data preview in our web app and by export. For Meta Ads we also let you change campaigns from your AI client, after you confirm each change in the chat and within limits you set.

3. Sources

The service covers ten sources: Google Analytics 4, Google Search Console, Google Ads, Google Business Profile, Google Merchant Center, Meta Ads, Instagram Insights, Facebook Page Insights, Facebook Lead Ads and Plausible.

Some sources are "coming later". They are described here so this policy does not change when they launch. We request each permission only when you connect the matching source. Status at the date above:

4. Data we process

• Account data: your name, email, company, workspace and team members, billing details held by Stripe.
• Connection data: OAuth tokens and keys for your connected accounts, encrypted at rest.
• Platform data you ask for: metrics, campaigns, ad sets, ads, keywords, search terms, page and profile statistics, reviews, comments, as returned by the platforms. This data may include personal data of third parties (for example reviewers or commenters).
• Lead details (Facebook Lead Ads): names, emails, phone numbers and free-text answers of people who filled in your lead forms. See section 7.
• Usage data: tool calls, logs of actions, security events.

5. When data is downloaded and how long we keep it

• We download platform data when you ask: a question in your AI client, a data preview, a saved-query URL, a Sheets run or a weekly email. We download only the days and reports the request needs, and we keep what we downloaded so later questions are fast and can compare periods.
• The single exception is Facebook Lead Ads: new leads are downloaded hourly for each connected form so no lead is lost to Meta's own 90-day window.
• Lead contact fields (names, emails, phones, free text) are deleted after 90 days. Lead counts and cost per lead are kept as metrics.
• Look-back depends on your plan: [Free 90 days, trial 13 months, Basic 2 years, Standard 10 years or the platform maximum — confirm before publishing].
• When you revoke access to a source or delete your workspace, we delete the related data within 30 days.
• Backups are kept at most 30 days.

6. Transfer to your AI client (Google API Services User Data Policy)

Platform data is passed to your AI client (for example Claude by Anthropic or ChatGPT by OpenAI) only when you explicitly ask for it through your own client. Only your own client receives it, on your request. Anthropic and OpenAI are your own recipients, chosen by you; they are not our sub-processors. Copies that exist in your AI client, your spreadsheets and your exports are yours to delete; our deletion covers only what we store.

Google user data and Limited Use. Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you asked for, shown in the service. We do not sell it, use it for advertising, or use it to train generalized AI models. No human at our company reads it except for support with your consent, which is logged.

[LAWYER / R2: the wording on passing Google data to the customer's own AI client depends on Google's written answer; update after it arrives.]

7. Lead details

For leads, you are the controller and we process on your instruction. Lead fields are encrypted under your workspace's own key. Showing lead fields in your AI client, preview, CSV export or Sheets requires a workspace switch "Lead details in Claude" turned on by the organization owner (off by default, logged, with an acknowledgement). Ordinary answers carry no lead fields. You are responsible for your lead form's privacy notice and for any impact assessment. A person who asks to be removed from lead data is erased within 7 days (section 11).

8. Meta campaign management

When enabled by your organization owner, we change your Meta campaigns on your instruction as a processor. You confirm each change in your AI client. Changes stay within limits you set (daily budgets, change per action, actions per day, allowed ad accounts); limits are enforced on our side. New campaigns are created paused; changes are logged and can be reverted. You are the advertiser. You own the ad content and are responsible for its compliance with Meta's policies.

9. Where data is stored, and our sub-processors

Data is stored in the EU. We use:

[LAWYER: add any others used at launch, e.g. error monitoring or analytics; Plausible on our landing page if used.]

Our own internal workspaces (our own products' marketing data) are the company's own data and are described separately; they are excluded from the statement that no human reads customer data.

10. Security

Tokens and keys are encrypted at rest with per-workspace keys. Lead fields are encrypted at column level. A security incident is reported to affected customers within 72 hours.

11. Your rights

You may ask for access, correction, deletion, restriction, portability, or object to processing, and may complain to your supervisory authority ([Úrad na ochranu osobných údajov SR / ÚOOÚ ČR — choose]). Email hello@getkumula.com. We handle erasure requests by email within 7 days. If your data is in a customer's workspace, we may forward the request to the customer, who is the controller.

12. Cookies and analytics

[Describe the landing page analytics (Plausible, if used) and any cookies.]

13. Changes

We will post changes here and notify customers of material changes by email.