Privacy Policy

1. Who is responsible

Ubiton AI Kft. is the controller of personal data processed to operate Bob. For privacy questions, requests or complaints, email sandor@ubiton.ai or write to our registered address.

2. Information Bob processes

• Account and profile: sign-in identifiers, name, email, age, preferences and profile details you provide. Optional details can include interests, body measurements and information about your circumstances.
• Coaching content: conversations, check-ins, goals, plans, tasks, reflections, custom trackers and feedback, together with AI responses and summaries.
• Personal memories: facts, preferences, patterns and tentative conclusions derived from your activity to maintain context and adapt your coaching. These may be incomplete or incorrect.
• Connected services: authorised calendar data, including event titles, descriptions, locations, times, attendees, reminders and connection credentials needed to maintain your integration.
• Technical and support information: device and browser details, IP addresses, request and operation identifiers, error and security records, notification tokens if enabled, and correspondence with us.
• Billing: customer and subscription identifiers, plan, purchase and verification records, payment status, paid-through dates and cancellation information. Stripe handles web checkout and Google Play handles Android purchases. Bob does not receive your full card number. Purchase tokens needed to verify Android subscriptions are stored encrypted.
• Waitlist: your name, email and signup consent. Signup details are sent through Resend to our team’s inbox; joining does not create an app account.

Information comes from you, services you connect and Bob’s processing of that information. Please avoid sharing other people’s private or health information without an appropriate basis to do so.

3. Purposes and legal grounds

• Providing Bob: account management, responding to messages, maintaining memories, personalised coaching, planning and integrations rely on performance of our contract where necessary to provide the features you request (GDPR Article 6(1)(b)). Necessary account information is required to provide those features.
• Security and support: preventing abuse, diagnosing failures and handling support rely on our legitimate interests in a safe, reliable service (Article 6(1)(f)), balanced against your rights. Support necessary to perform our contract also relies on Article 6(1)(b).
• Waitlist and optional communications: launch updates rely on your consent (Article 6(1)(a)). You can unsubscribe or contact us to withdraw it.
• Legal duties: information necessary to comply with applicable legal obligations is processed under Article 6(1)(c).

A contractual basis for ordinary service data does not remove the additional safeguards required for health or other special-category information described below.

4. Health and sensitive information

Coaching about physical or mental wellbeing can involve health information, including sensitive conclusions drawn from otherwise ordinary content. Other special-category information can include beliefs, sexual orientation or similar private characteristics.

Health-related coaching and memories require your separate, explicit consent to processing for those purposes under Articles 6(1)(a) and 9(2)(a). Accepting our terms, reading this policy or connecting a calendar does not itself provide that consent. Consent for coaching your account does not authorise unrelated research or shared-model training.

You can refuse or withdraw this consent by contacting us. Withdrawal stops future consent-based processing and may make the affected features unavailable. It does not invalidate earlier lawful processing. Where withdrawn consent was the only basis for holding the information, we erase it unless a specific legal exception applies.

Bob provides AI coaching, not medical diagnosis, treatment or an emergency response service. Health information is not monitored as a clinical record.

5. AI, memories and personalisation

Bob uses relevant conversations, preferences, activities and memories as context for AI responses. It can update summaries and hypotheses when new information changes what it previously understood. This adaptation is part of the service, rather than a separate marketing activity. Health-related adaptation remains subject to explicit consent.

Processing context for your account is different from training a general model for other users. This policy does not grant a blanket permission to use your private content for shared-model training. Any such additional purpose requires its own disclosed legal basis and, where required, separate consent before it begins.

Personalisation can involve profiling of your preferences and habits. Bob’s suggestions are advisory; Bob is not intended to make decisions producing legal or similarly significant effects on you. You can challenge inaccurate information and ask us to correct or erase associated memories and inferences.

6. Google and connected calendars

Google sign-in provides your account identifier and email. Authorising calendar access allows Bob to read and synchronise your calendars and, when you request calendar actions, create, change or delete events. Calendar information can also provide context for your planning and coaching.

Bob’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google-derived data is not used to train a general-purpose AI model or serve personalised advertising. Human access to that data is limited to permitted circumstances, such as your affirmative permission for specific data, necessary security investigations or legal requirements.

You can revoke access through your Google Account’s third-party connections settings and request deletion of information already held by Bob. Revoking access stops future access; it does not automatically erase existing copies. Google also handles data under its own privacy policy.

7. Providers and international transfers

Service providers receive the information necessary to perform their role. They include Google Cloud for hosting and message delivery, Neon for database storage, RunPod for model inference and Resend for waitlist email delivery. Relevant conversation context and memories may be sent to model infrastructure to generate responses. Google/FCM and Expo may process device tokens and notification content when the corresponding push service is used. Our email provider receives support correspondence and waitlist records.

Stripe and Google Play process payment and billing information under their respective terms and privacy notices, including their own fraud-prevention and legal obligations. We receive the records needed to link a purchase to your account, verify access, manage cancellations and handle billing support. Billing records are processed to perform the subscription contract and meet applicable accounting or legal obligations.

We require processors to protect personal data, act on our instructions and limit its use to the contracted service. We may also disclose necessary information where required by law, to protect legal rights or to professional advisers subject to confidentiality.

Processing is not restricted to Hungary or the EEA. Our infrastructure includes hosting in the United States, and provider operations can involve other countries. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and supplementary protections where necessary. Contact us for the countries and safeguards applicable to your data or a copy of the relevant safeguards. Acceptance of our terms is not consent to unrestricted international transfers.

8. Cookies and browser storage

Account features use necessary session and sign-in cookies or secure app storage. The waitlist stores a request ID, a fingerprint of your signup and submission status in browser storage so retries reuse the same request. That browser record does not contain your name or email in readable form. Clearing it removes local retry information, not an accepted signup in our inbox.

The landing page does not load analytics or advertising trackers. Fonts and marketing images are served with the website. Any future non-essential tracking requiring consent must be explained and enabled only after the necessary choice.

9. Retention and deletion

For step-by-step account deletion instructions and an email request option, see How to delete my Bob account and data.

Account content, conversations and memories are retained to provide ongoing context until you request deletion, close your account, or the information is no longer needed for the disclosed purpose. You can request deletion of specific information or your entire account at sandor@ubiton.ai. Deletion includes associated derived memories and projections where applicable; deleting an app from your device alone does not delete server records.

After deletion from active systems, residual backup copies are retained for no more than 60 days. They remain isolated from ordinary use and expire through the backup lifecycle. If recovery requires restoring a backup, deletion requests must be reapplied.

Minimal billing and transaction records may be retained for applicable accounting, tax and legal-claim periods after coaching content is deleted. Such retention does not permit continued use of your coaching history. Waitlist information is retained while needed for launch updates, until you withdraw or request removal. Support, consent and security records are retained only as necessary to resolve the matter, demonstrate compliance or handle legal claims, considering the applicable statutory periods. A specific legal retention obligation can require a limited record to be kept after a deletion request; we explain relevant exceptions and restrict further use. This is not a reason to retain your entire coaching history indefinitely.

10. Your rights and choices

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction of processing and a portable copy of information you provided. You can object to processing based on legitimate interests and withdraw consent at any time. You can always object to direct marketing.

Send requests to sandor@ubiton.ai. We may need reasonable verification to protect your account, and will normally respond within one month. If a permitted extension is necessary, we explain why within that first month. Requests are ordinarily free of charge.

You can complain to your local data protection authority or Hungary’s National Authority for Data Protection and Freedom of Information (NAIH), at 1055 Budapest, Falk Miksa utca 9–11. See NAIH’s contact and filing information. You do not need to contact us before approaching an authority.

11. Security and access

Safeguards include authenticated access, separation of user data, restricted service credentials and protection of data in transit. Access by authorised personnel is limited to an appropriate purpose, such as resolving a support request, investigating a security problem or meeting a legal duty. Additional restrictions apply to sensitive and Google-derived information. No online service can guarantee absolute security.

12. Age eligibility and updates

Bob accounts and the waitlist are intended for people aged 18 or older. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We update this policy when our practices or legal requirements change and show the date above. Material changes are brought to your attention through an appropriate notice. A policy update does not replace any fresh consent required for a new purpose.