Privacy Policy

1. Who We Are

Welcome to DataKubo (“we,” “our,” or “us”). We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, and disclose information about you when you use our services. DataKubo is a white-label IoT enablement platform operated by DataKubo S.L. Our registered address and contact details are available at info@datakubo.com.

2. Data We Collect

We collect data in two contexts:

From resellers (our direct customers):

• Account information: name, email address, company name
• Billing information: processed via Stripe (we do not store card details)
• Usage data: API calls, device counts, webhook activity
• White-label settings: logo, brand color, subdomain

From resellers' end users (on behalf of resellers):

• Name and email address
• IoT device data (e.g., water consumption readings, battery levels, timestamps)
• Device identifiers (Device EUI)

3. How We Use Your Data

• To provide and operate the DataKubo platform
• To process billing and manage subscriptions
• To send transactional emails (account setup, invoices)
• To monitor platform performance and security
• To improve our services using anonymized, aggregated analytics

We do not sell personal data. We do not use end-user data for advertising.

4. Data Ownership

Resellers own all data they and their customers generate on the platform. DataKubo stores this data on resellers' behalf. Resellers may export their data at any time and request deletion upon account closure. Data is deleted within 30 days of account closure.

5. Data Sharing

We share data only with trusted sub-processors required to operate the platform:

• Cloud database provider — database hosting and authentication
• Cloud hosting providers — frontend and backend infrastructure
• Stripe — payment processing
• Google Analytics — website traffic measurement (see Cookies below)
• PostHog (EU hosting) — product usage analytics for logged-in platform users
• Sentry — error monitoring for the platform

We never share reseller or end-user data with other resellers or third parties for commercial purposes.

6. Data Retention

IoT device data is retained for 3 years by default, after which it is automatically deleted. Account data is retained for the duration of the subscription plus 30 days after cancellation.

7. Security

We implement industry-standard security measures including TLS encryption in transit, bcrypt-hashed API keys, Row Level Security (RLS) on all database tables, and multi-tenant data isolation. No system is 100% secure; we will notify affected parties promptly in the event of a breach.

8. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Data portability (export in machine-readable format)

To exercise these rights, contact us at info@datakubo.com.

9. Cookies

We use the following cookies:

• Essential cookies — required for login and session management in the platform.
• Product analytics cookie (PostHog) — set only in the platform (login and app pages), never on our public website. The ph_*_posthog cookie holds a random visitor and session identifier, lasts up to 1 year, and lets us measure logins and feature usage. For logged-in users it is linked to your user ID, role and organisation ID — not your name or email. Data is stored in PostHog's EU region, and session recording is disabled.
• Analytics cookies (Google Analytics 4) — set on our public website (datakubo.com) only if you choose “Accept all” in the cookie banner, to measure traffic: pages visited, how visitors arrived, approximate location (country/city), device and browser type. Google Analytics uses the _ga and _ga_* cookies, which last up to 2 years. We do not send names, email addresses or any account data to Google Analytics, and we do not use it for advertising. If you choose “Reject”, Google Analytics sets no cookies and only receives cookieless measurements (such as a page view) without any identifier stored on your device. To change your choice, clear this site's data in your browser and the banner will appear again.

Our error monitoring (Sentry) sets no cookies; when an error occurs in the platform it records your user ID together with technical details of the error.

Google Analytics is provided by Google Ireland Limited, and data may be processed by Google LLC in the United States under the EU–US Data Privacy Framework. You can block these cookies in your browser settings or with the Google Analytics opt-out add-on. No advertising cookies are used.

10. Contact

For privacy-related questions, contact us at info@datakubo.com.