Privacy Policy
Last updated 26 September 2026
This policy explains what personal data CueBot collects, why, who it is shared with, how long it is kept, and the rights you have — under the EU/UK General Data Protection Regulation (GDPR) and the privacy laws of other regions where our users live. We collect as little as the service needs, we do not sell personal data, and we do not use advertising or analytics trackers.
1. Who is responsible
The controller of your personal data is Krugis OÜ, [registered office address], [EU member state of registration] ([commercial register and registration number]). Contact us about privacy at privacy@cuebot.live.
2. What we collect
- Account data: email address, a hashed password (never the password itself), time zone, theme preference, plan and account status. Guest accounts have no email until claimed.
- Watch data: what you ask CueBot to watch for, your answers to its questions, your plan edits, the alerts sent to you and your feedback on them.
- Channel data, if you connect one: Telegram chat ID, WhatsApp phone number, or a webhook URL you provide.
- Billing data, on paid plans: held by Stripe; we store only the customer and subscription identifiers, plan and billing country.
- Technical data: IP address and browser user-agent of each signed-in session, security and error logs, and email delivery status (delivered, bounced, marked as spam). We do not track email opens or link clicks.
Please do not enter sensitive data (health, political opinions, religion, etc.) or information about other private individuals into a watch description.
3. Why we use it, and our legal basis (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Creating your account, running your watches, sending alerts | Performance of our contract with you |
| Billing, invoicing and tax records | Contract; legal obligation |
| Security, abuse and fraud prevention, rate limiting, debugging | Legitimate interest in a safe, working service |
| Improving plan and match quality from your feedback on alerts | Legitimate interest; you can object at any time |
| Service and account emails (confirmation, security, billing) | Contract; legitimate interest |
We do not send marketing email without your consent, and we do not use your data to train third-party AI models. Where our processors’ terms allow, we opt out of their use of submitted data for training.
4. Automated processing
AI models decide how to plan your watch and whether an article matches it. These decisions determine which alerts you receive; they do not produce legal or similarly significant effects on you within the meaning of GDPR Art. 22. You can review and edit every plan, and tell us when an alert was wrong.
5. Who we share it with
We use the processors below, each bound by a data processing agreement. Where data leaves the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses with supplementary measures. You can ask us for a copy of the relevant safeguards.
| Processor | Purpose | Data | Location and safeguard |
|---|---|---|---|
| Z.ai (Zhipu AI) | AI models that plan watches, ask clarifying questions and judge matches | Watch descriptions, your answers, public article text | China — Standard Contractual Clauses |
| Resend | Sending account and alert emails | Email address, email content, delivery events | United States — SCCs / EU–US Data Privacy Framework |
| Stripe | Payments and subscription billing | Name, email, billing address, payment method (we never see full card numbers) | Ireland / United States — SCCs / Data Privacy Framework |
| Telegram | Alert delivery, only if you connect it | Telegram chat ID, alert content | United Arab Emirates / worldwide — SCCs |
| Infobip (WhatsApp, Meta) | Alert delivery, only if you connect it | Phone number, alert content | EU (Croatia); Meta worldwide — SCCs / Data Privacy Framework |
| Google Fonts | Serving the site’s typeface | IP address and browser details of each page load | United States — Data Privacy Framework |
| [hosting provider name and data-centre country] | Hosting the application and database | All data above | EU |
We also disclose data if the law requires it, to protect rights and safety, or to a successor if the business is sold — in which case this policy continues to apply. We never sell personal data.
Sign-in providers
If you sign in with Google, we receive your Google account ID and your verified email address from Google. We do not receive your Google password or any other Google data. Google acts as an independent controller for the sign-in itself, under its own privacy policy; we act as controller for the account we create or sign you into. You can sign in with email instead at any time, and you can set a password later so the account no longer depends on Google.
6. How long we keep it
- Account and watch data, alert history: for the life of your account.
- Account deletion: 30-day grace period (signing in cancels it), then permanent deletion. Unclaimed guest accounts: paused after 7 days, then deleted.
- Abandoned draft watches: archived after 7 days untouched.
- Session records (IP, user-agent): up to 30 days after the session expires.
- Watch run logs: 30 days. Match decisions: 180 days.
- Invoices and payment records: as long as tax law requires (typically up to 10 years).
- Backups: rotate out within 12 months.
7. Your rights
Under the GDPR (and UK GDPR) you have the right to:
- access your data and receive a copy — use Export in your settings;
- correct inaccurate data;
- erase your data — use Delete account in your settings;
- restrict or object to processing based on legitimate interest;
- data portability (the export is machine-readable JSON);
- withdraw consent at any time, where processing relies on it.
Email privacy@cuebot.live for anything the settings do not cover. We answer within one month. You can also complain to a supervisory authority — ours is [data protection authority of the member state], or the authority where you live or work.
8. Security
Traffic is encrypted in transit (TLS). Passwords are stored with a slow one-way hash. Access to production data is limited to the people who operate the service. Sessions use secure, HTTP-only cookies. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
9. Children
CueBot is not for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, tell us at privacy@cuebot.live and we will delete it.
10. Cookies
We use only cookies that are strictly necessary to keep you signed in. See the Cookie Notice.
11. Regional information
United States (California and other state privacy laws)
In the last 12 months we collected the categories described in section 2: identifiers (email, IP address), commercial information (plan and billing), internet activity (session and log data) and the content you provide. We use them for the business purposes in section 3. We do not sell or “share” personal information for cross-context behavioural advertising, and do not use sensitive personal information to infer characteristics. Residents of California, Colorado, Connecticut, Virginia and other states with privacy laws may request to know, access, correct, delete or port their data, and to appeal our decision, by emailing privacy@cuebot.live. We will not discriminate against you for exercising these rights. We honour Global Privacy Control signals, though there is nothing for them to switch off.
Asia-Pacific
Your data is processed in the EU and by the processors listed in section 5, including in China and the United States. By using CueBot you acknowledge these cross-border transfers, which we make under the safeguards described above.
- Japan (APPI): transfers to third parties abroad are made to recipients bound to protection equivalent to the APPI; you may request information about them.
- South Korea (PIPA): the processors, countries, data items and retention periods are those in sections 5 and 6; you may refuse the transfer, but the service cannot run without it.
- Singapore (PDPA), Australia (Privacy Act/APPs), India (DPDP Act 2023): you may access and correct your data, withdraw consent, and complain to us first at privacy@cuebot.live, and then to your national regulator.
- Other countries: where local law gives you further rights, we honour them — contact us.
12. Changes
We will post updates here and change the date above. For material changes we will also notify you by email or in the app before they take effect.