Privacy Policy

The controller of the data described in this policy is RETAIL ONLINE LLC, 2201 Menaul Blvd NE Ste A, Albuquerque, NM 87107, United States. For anything related to your personal data, write to privacy@kubocrm.com; for anything else, to info@kubocrm.com.

Kubo CRM is a tool that companies use to receive and manage their leads (people who may become their customers). That is why we play two different roles:

• Account data: the data of the people who use Kubo CRM (name, email address, password, activity and security data). We decide how this data is processed, so we are its controller, and this policy applies to it in full.
• Lead data: the contacts that each company stores in Kubo CRM or receives through the forms and integrations it connects. Each company decides what data it collects and what it does with it, so it is the controller; we process that data only on its behalf and on its instructions, as a processor. How we do so is set out in the Data Processing Agreement, which each company can read by signing in to Kubo CRM.

If you are a lead (for example, you filled in a form or answered an ad from a company that uses Kubo CRM), the company you contacted is responsible for your data: contact it first to exercise your rights. If you do not know which company it is, or it does not reply, write to us and we will forward your request (see Data Deletion Instructions).

• What data: your name, your email address and your password, the company you belong to and your role in it (owner, manager or sales rep), and the preferences you choose in the application. We never see your password: our authentication provider stores it only in a non-reversible form (a hash).
• Where it comes from: from you, when you create your company’s account, or from your company, when someone with permission to manage its team adds you. In that case we send you an email with a link to choose your password.
• What for: to give you access to Kubo CRM and to let your company organize its work: your role and permissions, the leads assigned to you, and your name next to what you do.
• Legal basis: the performance of the contract between your company and us (art. 6(1)(b) GDPR) and, if your company added you, our legitimate interest and your company’s in providing the access it requested for you (art. 6(1)(f) GDPR).
• Required data: your name and email address, and a password; without them we cannot create your account. When creating a company’s account we also ask for the company’s name and for you to accept the terms of service.
• Billing details: to subscribe to a paid plan, your company gives us its country and legal name and, if it is established in the EU, its VAT number; outside the EU, it may add its tax ID, and its owner declares that the company subscribes as a business or professional (we keep the date, who made the declaration and the version of the text). We check an EU VAT number against VIES, the European Commission’s public service, sending it only the country and the number, and we keep the date of the check and the name and address VIES returns. Your company may also give us a billing address, or ask us to record it. Whoever in your company can see its settings can see these details; they are kept while your account exists and deleted with it, apart from what the law requires us to keep in invoices.
• How long: while your account exists. If your company deactivates you, your account is kept, deactivated, until your company or you ask us to delete it. If you create a company’s account and never confirm it (nobody opens the link in the email or signs in), it is deleted automatically, with its company, 7 days after it was created; the proof of what was accepted is kept as explained below.

When you create your company’s account, and again when you choose your password from the link in the email, or when the owner of a company that already had one accepts the terms of service in the application, we keep, as proof of the contract: who accepted them (their email address), the company’s name, the version of the texts, the date and time, and the IP address and browser identifier from which they were accepted.

Legal basis: the performance of the contract with your company, and our legitimate interest in being able to prove what was accepted and in establishing, exercising or defending legal claims (art. 6(1)(b) and 6(1)(f) GDPR).

How long: while the company has an account, and 6 years after its account is deleted; then it is deleted automatically. It is kept even if the account of the person who accepted is deleted: it is the proof of what the company accepted.

To protect accounts and data, and so that each company can know who did what in its account, we process:

• The activity log. Each change to leads, notes, settings, the team and integrations, each sign-in and sign-out on the website, each export, each bulk action and each change to two-step verification is recorded with its date, the person (their email address and role), the IP address and the identifier of the browser or the app. The log contains no lead data, only each lead’s internal identifier. The company’s owner and the people it authorizes can see it. It cannot be edited or deleted entry by entry, so that nobody can erase what they did, and it is deleted together with the company’s account.
• Failed sign-in attempts on the website: the email address that was typed, the IP address and the browser, to detect anyone trying to guess passwords.
• The attempt counter. To stop anyone from trying passwords or flooding a form, we count requests by IP address (an IPv6 address, by the network it belongs to) and, when signing in or recovering a password on the website, by the email address typed. Each counter is deleted automatically once it expires, in less than 24 hours.
• Your session. On the website, a cookie keeps you signed in, and another records the time of your last activity so that the session closes after the period of inactivity your company sets (60 minutes by default). See Cookies and local storage.
• Two-step verification, if you turn it on or your company requires it: our authentication provider stores the secret of the authenticator app you link, we record when each method was verified, and the activity log records when it is turned on or off.
• Our authentication provider also keeps its own record of sign-ins, from the website and from the app, and of other account events, with the IP address, and applies its own limits on attempts.

Legal basis: our legitimate interest, and your company’s, in protecting accounts and data and in knowing who did what (art. 6(1)(f) GDPR). You can object by writing to privacy@kubocrm.com, although we may need to keep this data to protect the service or to establish, exercise or defend legal claims.

How long: the activity log, until the company’s account is deleted; failed sign-in attempts, which do not belong to any company, and the authentication provider’s records, for as long as they are needed to investigate unauthorized access; the attempt counter, less than 24 hours.

We only send the emails the service needs: the link to choose your password when you are added to a team, the confirmation of your email address, password recovery, and security notices (for example, if someone on your team removes your two-step verification). The application does not send advertising or newsletters. Legal basis: the performance of the contract with your company and our legitimate interest in keeping your account secure (art. 6(1)(b) and (f) GDPR).

The bell, on the website and in the mobile app, lets you know when a lead is assigned to you, by someone else or automatically when it comes in (not when you assign it to yourself), 10 minutes before a follow-up with a set time that is yours and, if your company turns it on, when an open lead goes without anyone working on it for the time your company chooses (to the person handling it or, if nobody who can receive it is, to whoever can see the team). For each notification we store who it is for, its type, the lead or follow-up it refers to (with the follow-up’s time, how many leads were assigned to you at once, or since when the lead has gone unattended), who assigned the lead if it was a person, when it arrived and when you read it, but no copy of the lead’s data: that is read from the lead when the notification is shown.

The time you read it is used to show which notifications are still unread, with the same list on the website and in the app, and to count the period after which it is deleted; a follow-up notification is also marked as read automatically when that follow-up is completed, cancelled or moved to another day or time, and an unattended-lead notification, when someone works on that lead or when it is no longer for you because the lead has passed to someone else. In your company, only you see your notifications and when you read them: not even your company’s owner.

Push notifications on your phone (Android app). If you turn them on in Más (More) in the mobile app, the phone asks for your permission and, if you give it, each new notification in the bell also reaches your phone as a push notification. Its text is generic (for example, “You have a new lead assigned” or “You have a follow-up at 12:00”) and carries no lead data, not even a name; only two internal identifiers travel with it, of the notification and of the lead, so that tapping it opens the right place. For this we store, for each of your phones, the identifier that Expo gives it for notifications, its platform and when the app last registered it. We do not send the notification if you have already read it, if the follow-up was moved or completed, or if you have turned the bell off. We also keep, for 2 days, the receipt that Expo gives us for each notification sent, to delete the identifiers of phones that no longer exist.

Legal basis: our legitimate interest, and your company’s, in letting each person know in time about the work assigned to them (art. 6(1)(f) GDPR). You can object by turning the bell off in Mi perfil (My profile) on the website, or in Más (More) in the mobile app: from then on, no new notifications are created for you. You can turn off only the notifications on your phone in the same place, or in the phone’s settings. You can also write to privacy@kubocrm.com.

How long: 30 days after you read them, or 90 days after they arrive if you never read them; and also when the lead, the follow-up or your account is deleted. A phone’s identifier is deleted right away when you sign out of the app on that phone with a connection or turn the notifications off, and when your account is deactivated or deleted. If your session ended on its own (it expired, or it was closed from another device) or you signed out without a connection, it stays until the next person who signs in to the app on that phone removes it, until Expo reports that the phone no longer exists or, at most, until 90 days pass without the app registering it again.

If you use the Kubo CRM mobile app:

• Your session is kept in your phone’s secure storage (the Keychain on iOS, the Keystore on Android). If you do not check “Keep me signed in”, it is deleted the next time the app starts.
• If you check it, the app also keeps on your phone a copy of what it has loaded (lists, leads and your notifications), so that it opens faster. That copy expires one day after it was last updated: the app then stops using it and deletes it the next time it opens. It is also deleted when you sign out or someone else signs in. Android does not include the app’s data in the phone’s backups.
• Each request identifies itself as the Kubo CRM app, with its version and platform (for example, Android), so that the activity log can show that a change was made from the app.
• The app asks your phone for permission to show notifications only when you turn them on in Más (More), never when it starts. Without that permission, or with them turned off, the app registers nothing (see Notifications in the application).
• When it starts, the app checks for updates on the servers of Expo, the platform we use to publish them. Expo receives the IP address and the technical data needed to serve the update, such as the app version, the platform and an installation identifier.
• When you tap call, WhatsApp or email on a lead, the app opens the corresponding app on your phone with that number or address.
• In Más (More) you can lock the app with your fingerprint or face (or, if your phone has none, with its PIN, pattern or password). The phone itself checks it and only tells the app “yes” or “no”: your fingerprint or face never leave the phone, and Kubo CRM receives nothing biometric. The app keeps on your phone only that you turned the lock on, which account it belongs to, when you chose it to ask (when opening the app, or after 1, 5 or 15 minutes away), the number of failed attempts in a row and when the app was last left; nothing of that is sent to us. The lock covers the screen but does not sign you out; after several failed attempts it may ask for your account password. Signing out from Más (More) deletes the setting from that phone.
• The app has no analytics, advertising or tracking, and does not access your camera, microphone, location or contacts.

Each company decides which integrations to use. What comes in through them is lead data, which we process on the company’s behalf (see the Data Processing Agreement).

• Forms and bookings from other services: the universal webhook, the WordPress plugin and the connections with Typeform, Tally, Jotform, Google Forms, Google Ads lead forms, Cal.com and Calendly send Kubo CRM what the person filled in or booked, and Kubo CRM turns it into a lead; the WordPress plugin and those connections discard payment fields and uploaded files.
• The Kubo CRM form for websites: the company that places it on its website is responsible for the data of the people who fill it in, and the form’s checkbox links to that company’s privacy policy. With each submission we store, as proof of consent, the address of that policy, the text of the checkbox and the time; and, if the website provides them, the page and its campaign parameters (UTM). The IP address of the person filling it in is only used by the attempt counter (see Security and activity log): it is not stored with the lead or in the activity log. The company can also add a check by Cloudflare (Turnstile) that a person, not a program, is sending the form; to do so, Cloudflare sees the IP address and signals from the browser.
• Incoming email: the company forwards to its own Kubo CRM address the emails that are leads. Cloudflare receives them (Email Routing), and a program of ours that runs on Cloudflare stores each one in its storage (R2), in the European Union, until Kubo CRM receives it, usually in less than a minute. Once delivered, it is deleted there; if it cannot be delivered (for example, because the company paused the address), it is deleted after 7 days, and at the latest after 8. Each email that becomes a lead keeps its sender, recipients, date, subject and text (only its first 1 MB, if it is longer), but not its HTML version or its attachments, of which only the names, types and sizes are kept. Automatic replies, bounces and emails from the company’s own team are discarded. Of every email received, including those that do not become a lead, we keep the sender, the subject and what was done with it, without the content, for 30 days, as part of the record described below; and of the confirmation that Gmail sends when the company sets up forwarding, also its link, its code, the address that requested it and its text (up to 1,500 characters), for 24 hours, so that the company can confirm the forwarding from Kubo CRM.
• Rules and the record of what comes in: the company can set rules that decide whether what comes in becomes a lead, and with what source, status, tags and person responsible. Of every submission its rules ignore, or that is not kept because its plan is full, we keep who sent it (their email address or, if there is none, their phone number or name), its subject, if it has one, and what was done with it, without the content, for 30 days, so that the company can check its rules.
• Importing from a file (CSV or Excel): the file is read on our server and is not stored anywhere. Each imported lead records the name of the file and the row it came from, and the activity log records a single entry with the file name and the totals, without the leads’ data.
• Notices in Slack, Microsoft Teams or Telegram: the company chooses the channel and what to be told about (a new lead, an assigned lead). Each notice carries the lead’s name (or, if it has none, its company), where it came from, its source, a link to the lead and the names of the people involved (who added it by hand and who is responsible for it, or the first part of their email address if they have no name); and, only if the company chooses so, the lead’s company, email address and phone number. Anyone with access to that channel can read them, and Slack, Microsoft or Telegram keep them under their own terms. The addresses of Slack and Teams channels are stored encrypted. Telegram notices are sent by a Kubo CRM bot that the company adds to its group; we store the group’s identifier and name.
• The outgoing webhook (on the Pro plan): the company chooses an address (for example, in Zapier, Make or n8n, or its own server), and Kubo CRM sends to it each new lead, except imported ones, and each change of status, with all of the lead’s data: its name, email address, phone number, company, job title, website, city, description and value, its status, source, integration and tags, the company’s own fields, the day of its next step and its dates, and the name and email address of the person responsible for it. Each delivery is signed so that the destination can check that it comes from Kubo CRM, and what is sent there is kept by that destination under its own terms. The address and the signing secret are stored encrypted, and we do not keep the destination’s response.
• Kubo Mail (our newsletter service): the company can connect one of its Kubo Mail lists. When someone who fills in one of its forms ticks the newsletter checkbox, Kubo CRM sends to that list their email address and name, with the page of the form and the text of the checkbox if we know them. Kubo Mail sends them an email to confirm the subscription, and they only receive newsletters if they confirm. Leads that are imported, that arrive by email or that are created by hand are never sent. The Kubo Mail key is stored encrypted, and what is sent there is kept by Kubo Mail on the company’s behalf, under its own terms.

Legal basis: for lead data, the instructions of the company, which is responsible for it; for the names of team members that appear in notices, and the name and email address of the person responsible that the outgoing webhook sends, our legitimate interest and the company’s in letting its team know about its leads and in connecting them to its own tools (art. 6(1)(f) GDPR).

We are preparing an integration with Meta Lead Ads, the lead forms of Facebook and Instagram ads. It is not available yet: this section explains how the data will be processed when it is, and we will update it at launch.

When a company connects its Facebook page to Kubo CRM:

• What we receive from Meta: the answers each person gives in the company’s lead form (for example, their name, email address, phone number and the answers to the company’s own questions), the consent checkboxes of that form, the date, and the names and identifiers of the form, the ad, the campaign and the page. From the person who connects the page, an administrator of the company’s page, we receive their Facebook user ID and name and the access they grant.
• What for: only to deliver each lead to the company that connected the page, as a lead in its Kubo CRM account, and to keep the connection working. We process the leads as that company’s processor (see the Data Processing Agreement); the data of the person who connects the page, as controller, to manage the connection, based on the contract with their company and our legitimate interest (art. 6(1)(b) and (f) GDPR).
• What we do not do: we do not use data from Meta for advertising or to build profiles, we do not sell it or share it with data brokers, and we do not combine it with other companies’ data. Only the company that connected the page can see its leads.
• Access tokens from Meta are stored encrypted and are used only to read the leads of the connected page.
• How long: the leads, until the company deletes them in Kubo CRM or deletes its account. The connection data (access tokens, Facebook user ID and name), until the page is disconnected or that person removes Kubo CRM from their Facebook settings.
• How to delete it: see Data Deletion Instructions.

If you write to info@kubocrm.com or privacy@kubocrm.com, we use your message and your email address to reply and, if you are exercising your rights, to handle your request. Legal basis: our legitimate interest in replying to you or, when you exercise your rights, our legal obligation to respond (art. 6(1)(f) and (c) GDPR). We keep these messages for as long as needed to handle them and no longer than one year. They reach us through Cloudflare, which forwards the emails sent to our addresses, and Google, which hosts our mailbox (Gmail). What we send from privacy@kubocrm.com, including our replies, goes out through Resend.

The application only uses cookies and local storage that it needs in order to work, or that remember a choice you make. It uses no analytics, advertising or social media cookies, which is why it does not ask for your consent. These legal pages set no cookies.

You can delete them at any time in your browser settings; without the session cookies you cannot sign in.

We use these providers to run the service:

Your company also sees your data: the people on your team see your name and what you do with the leads, and those it authorizes can see the activity log.

The services that your company connects to Kubo CRM, to send it leads or to receive its notices or its leads, are chosen by your company and process the data under their own terms: for example, websites and WordPress plugins, forms and booking tools (such as Typeform, Tally, Jotform, Google Forms, Google Ads, Cal.com or Calendly), the channels that receive its notices (Slack, Microsoft Teams or Telegram), the addresses to which its outgoing webhook sends its leads and its lists in Kubo Mail, which processes the data under its own terms.

We do not sell personal data, and we do not share it with anyone else unless the law requires us to.

We are a U.S. company, and our providers are U.S. companies or belong to U.S. groups, so your data may be accessed from or processed in the United States, even though the database is stored in Ireland. For each provider, transfers from the European Economic Area rely on the European Commission’s standard contractual clauses or, where the company is certified, on the EU-U.S. Data Privacy Framework, as is the case with Google. You can ask for a copy of the standard contractual clauses we rely on by writing to privacy@kubocrm.com; the list of certified companies is available at dataprivacyframework.gov.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we do not build profiles with your data.

You can ask to access, correct or delete your data, to object to or restrict its processing, or to receive it in a portable format, by writing to privacy@kubocrm.com. We will reply within one month, and we may ask you for information to confirm your identity.

For lead data, the company that holds it decides: we will forward your request to it and help it reply.

If you believe we are not handling your data properly, you can lodge a complaint with the data protection authority of your country (in Spain, the Spanish Data Protection Agency, aepd.es).

Each company’s data is kept separate from other companies’ data in the database itself; access requires a password and, if enabled, two-step verification; connections are encrypted (HTTPS); and our database provider encrypts the data at rest. More details in the Data Processing Agreement, which each company can read by signing in to Kubo CRM.

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will let you know by email before it applies.