KUBI · LEGAL

Privacy Policy

Kubi is a personal AI assistant available through WhatsApp and the Kubi website. This policy explains how information is handled when you use Kubi or connect a Google account.

About Kubi and contact

Kubi (sole proprietor), based in Israel, is responsible for the personal information described in this policy. For privacy questions, access, correction, or deletion requests, email support@heykubi.ai.

Information we receive

  • Account and contact information: your phone number, email address, account identifiers, language preferences, and details you provide when joining or contacting support.
  • Conversations: messages, attachments, images, recorded voice notes, transcriptions, assistant replies, tasks, reminders, and preferences or memories saved to provide continuity.
  • Messages from other people: when someone who is not a Kubi user writes to or talks with your Kubi (for example, a person you asked Kubi to contact), Kubi keeps that conversation, including what they wrote, with your conversation records, and can retrieve and quote it when you ask. Who sees it: you, through your Kubi; the AI providers listed below, to produce replies; and authorized Kubi operators where needed for support, security, or legal obligations. How long: there is no automatic expiry. It is kept for as long as your Kubi account exists and is deleted when your account is deleted or when we act on a deletion request; the person who wrote it can also ask us at [email protected]. After deletion, copies can remain in nightly backups for up to 14 days on our server and up to 30 days in encrypted off-site storage, then are removed.
  • Connected services: information returned by services you authorize, within the permissions you grant. Authorization credentials and connection metadata are used to maintain those connections.
  • Website and operational information: IP address, browser information, approximate country, visit time, technical errors, security events, and usage records. The website uses service logs; the portal uses session storage or cookies where needed to keep you signed in.

Google account access

Connecting Google is optional. Google presents the requested permissions before you approve access. Depending on the features enabled and permissions granted:

  • Gmail (read, organize where the connection allows it, and send where the connection allows it): Kubi reads message content, headers and attachments to find messages, summarize mail, and answer your questions. Where the connection allows organizing, Kubi can, at your request, add or remove labels, archive or unarchive, mark messages as read or unread, and star or unstar them. It moves messages to the Gmail trash only after you approve, and it never deletes mail permanently. A connection without organizing does not change your mail. Where the connection allows sending, Kubi can send email from the connected mailbox (your own Gmail, or a business mailbox you connect for Kubi), in your name, and only after you approve each message. A connection without sending cannot send email.
  • Google Calendar: Kubi reads your events, and adds, changes and deletes events you ask for. A deleted event stays in your Google Calendar trash for 30 days, where you can restore it.
  • Google Drive (read-only, plus files Kubi creates): Kubi reads your Drive files to answer your questions, and saves new files you ask for. This Drive connection cannot change or delete your existing files.
  • Google Docs: when this connection is available and you enable it, Kubi can read document text, tabs and tables to answer questions or summarize a document you identify. At your request, it can create a document or add text to the end of a document you can edit.
  • Google Sheets: when enabled, Kubi can read the cell values in a spreadsheet range you identify to answer questions or analyze the data. At your request, it can create a spreadsheet or add rows to the end of a spreadsheet you can edit.
  • Google Slides: when enabled, Kubi can read a presentation’s structure and text to answer questions or summarize it. At your request, it can create a presentation or add slides to a presentation you can edit.

Full access. Some accounts are offered full access to Google apps. Full access asks Google for broader permissions, and the notice shown before Google's screen lists what each app will allow. With full access, and only for the apps you connect:

  • Gmail: in addition to the above, Kubi can, at your request, create, rename and recolor labels, apply labels to many messages at once, write and update drafts for you to review, and set up filters that sort new mail. It deletes a label, a draft or a filter, creates a filter that archives or deletes mail, changes more than 25 messages at once, turns on a vacation auto-reply, or sends a draft only after you approve. It never creates filters that forward mail, and never deletes mail permanently.
  • Google Drive: Kubi can read your whole Drive and, at your request, create folders, move, rename and copy files, and replace the content of a text file. It shares a file, removes someone's access, moves a file to the trash, or deletes a file permanently only after you approve each action, and the approval shows who gets access.
  • Google Docs, Sheets and Slides: Kubi can edit any document, spreadsheet or presentation you can edit, not only ones it created: change, add and remove text, formatting, tables, cells, tabs and slides. Changes to a shared file are seen by everyone it is shared with. It deletes a spreadsheet tab or a slide, or clears a large range of cells, only after you approve.
  • Google Calendar: Kubi can also list, create, rename and share your calendars. It deletes a calendar, shares a calendar, or removes someone's access to it only after you approve. Kubi does not invite guests to events.
  • Google Contacts: Kubi can find and read your contacts and, at your request, add, update and group them. It deletes a contact only after you approve.
  • Google Tasks: Kubi can read your task lists and, at your request, add, update, complete and move tasks and lists. It deletes a task or a list only after you approve.
  • Google Forms: Kubi can read your forms and their responses and, at your request, create and edit forms. It publishes a form only after you approve, and never changes or deletes responses.

Information about other people. Your contacts, the people in your calendar events, shared files, and the answers people give to your forms include other people's personal information. Kubi uses it only to carry out your requests, on your behalf, and handles it as described in this policy. You are responsible for having the right to share it with Kubi. People whose information you hold can contact us at the address above.

One permission list. Kubi asks Google for the same permissions on every account: the ones full access uses (Gmail read and organize, Gmail filters and vacation settings, the whole Drive, Docs, Sheets, Slides, Calendar, Contacts, Tasks and Forms), plus permission to send Gmail where sending is on. Google’s screen shows them for each app you connect. On a standard connection (without full access) Kubi offers only the standard features listed above and does not use the rest of what the permission allows: it does not organize mail unless organizing is on, does not delete your Drive files, and changes an existing Doc, Sheet or Slides file only by adding content at the end of one you asked it to use, and uses Docs, Sheets and Slides only for files identified for your task. Its standard Docs, Sheets and Slides tools add content without replacing existing content and do not delete files. Each service is connected separately; connecting Gmail or Drive does not automatically enable it.

Kubi reads Google when a request of yours needs it. It keeps no separate synchronized copy of your calendar, Drive, Docs, Sheets, Slides, contacts, tasks or forms. Content returned for a task may be included in conversation records, assistant replies and AI processing, as described below. For some accounts it keeps a private copy of your last 7 days of mail to answer quickly; the notice shown before Google's screen says whether yours does.

A permission being granted does not mean every possible action is available. Some information may be processed during scheduled tasks you enable, not only while you are actively chatting. How to see, disconnect and delete your Google connection.

Health-fund information (optional)

Connecting to your health fund is optional, and happens only after you explicitly agree in the chat, separately from the terms of use. For now it is available for Maccabi Healthcare Services only. When you agree, you send Kubi your ID number and the SMS code the fund sends you. Kubi signs in to your account on the fund's site, only reads (for example test results, prescriptions and what the doctor wrote) and changes nothing. The connection closes after one hour. Kubi reads only the account of the person who agreed, not another person's account.

Your ID number and the SMS code are sent to Kubi in the chat, so they are kept in your conversation records like any message. Kubi does not save them in its memory.

What is read is sensitive medical information. To answer you, this information is sent for processing by artificial intelligence, and only to providers that do not keep it and do not use it to train their models. The answers appear in your WhatsApp chat and stay there like any conversation, including in backups as described in the storage section.

An authorized person from the Kubi team may access a conversation only as this policy describes: for support, for security, or where the law requires. Like any conversation, these answers may also be checked by automated tools and by the team's AI agents, as described in this policy.

The connection closes by itself after one hour. To ask about your data, write to [email protected]. Answers Kubi has already sent stay in your chat, and copies in backups are deleted as described in the storage section.

We record your consent (when, which wording, which language) so we can show that it was given. Kubi is not a doctor and does not replace medical advice. For now this is available to users in Israel only.

Why we use information

We use information to provide your assistant, complete requested tasks, maintain conversation continuity, run reminders you enable, manage connected accounts, provide support, and protect and troubleshoot the service. Messages sent to the assistant and relevant results from connected services can be included in AI processing to produce your response.

Customer success and quality review: our customer success and quality team, which is made up of AI agents, can read your conversations with Kubi, including your messages, transcriptions of your voice notes and calls, and Kubi’s replies, to check that the service works for you, help you succeed with it, and find and fix problems. Our automated monitoring also flags conversations where something may have gone wrong (for example, an error or an answer that did not help) so the team can look at them. Content Kubi retrieved from Google (such as Gmail, Google Drive, Google Calendar or Google Docs) is hidden from this review where our systems can identify it. A member of the Kubi team accesses your conversations only as described in this policy: authorized operators, where needed for support, security, or legal obligations. Every read is recorded in an access log. Kubi does not use conversations read for this review to train models.

AI processing and service providers

Kubi uses infrastructure and service providers to deliver these features. These include Meta/WhatsApp for messaging, Cloudflare for website delivery and protection, Oracle Cloud for hosting, AI model providers (such as Anthropic, OpenAI and Google) reached directly or through the routing service OpenRouter, Voyage AI to turn text into search vectors so your Kubi can search its memory, and TypeSafe AI to check that a web page Kubi is about to act on is safe, and to review the messages you send Kubi on WhatsApp or Telegram together with Kubi's replies (up to 4,000 characters of each), after the reply has been delivered, so we can spot answers that went wrong. Google processes requests made to its APIs. Relevant text, files, or voice content may be sent to a provider when needed for the feature you use. Providers and processing locations may be outside Israel.

No training: we route only to AI providers that do not train on your data, and we do not use your data, including Google data, to train AI models. Some providers may keep prompts for a limited time for abuse and safety monitoring, and then delete them.

When you ask Kubi to send a message, create a shared item, or otherwise disclose content to someone, the intended recipient receives the content needed for that action. Authorized operators may access information where needed for support, security, or legal obligations. Google-data access by humans is limited as described below.

Google API Limited Use

Kubi’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and applicable Google Workspace user data policies.

Google user data is used only to provide or improve the user-facing features you request. It is not sold, used for advertising or credit decisions, or used to train general-purpose AI or machine-learning models. Transfers of Google user data are limited to what is necessary to provide or improve those features, permitted security purposes, applicable law, or other transfers expressly allowed by Google’s Limited Use rules. Human access to Google user data is limited to your affirmative agreement for specific content, security investigations, legal compliance, or internal operations on aggregated and anonymized data as permitted by those rules.

Storage, retention, and deletion

Conversations, task results, saved preferences, and operational records may persist to support your assistant and service operations. There is no single automatic deletion period for all records. Disconnecting a service stops its use through that connection. For Google, what is then deleted is described below.

If you write to Kubi on WhatsApp before you have accepted the Terms, Kubi asks you to accept them and holds your first message for up to 24 hours while you decide. While it is held, nothing is done with it: no AI processing, no memory, no attachment download. If you accept, Kubi answers it then, and still asks for any approval an action needs. If you decline, or do not accept within 24 hours, the held message’s content is deleted. Other messages you send before accepting are not kept for later and their content is deleted. A record that a message arrived, without its content, stays with our operational records; the hold’s own record (identifiers, whether it was answered, declined or expired, and when) is deleted after 7 days. Nightly backups taken while a message was held may still contain it for up to 14 days on our server and up to 30 days in encrypted off-site storage, then they are removed.

When you disconnect a Google app in Kubi (Connections, Disconnect), Kubi deletes, within 24 hours, the Google content it kept from that connection: the private copy of your recent mail where one is kept, the results of Google requests stored in your conversation records, and the conversation search index and quality-check samples made from those conversations. Not deleted: the replies Kubi already sent you, which stay in your chat, and notes your Kubi saved to its memory in its own words, which are not traced back to Google (ask your Kubi to forget them, or delete your Kubi). Nightly backups are kept on a rolling basis for up to 14 days on our server and up to 30 days in encrypted off-site storage, then removed. If you revoke access at Google instead, Kubi deletes the same content when it next finds the access gone; to have it deleted within 24 hours, also press Disconnect in Kubi.

You can disconnect Google in the Kubi connections portal and revoke Kubi’s access from your Google Account connections. To request deletion of your Kubi account, Google-derived data, conversations, or saved memories, email the address above and identify the account and data involved. We may verify account ownership before acting. We process these requests subject to applicable legal obligations; limited records may need to be retained for security, legal claims, or compliance. Backup copies may remain until replaced or removed through backup maintenance. We will explain any material retention limitation when responding. You do not need to send your password or authorization tokens.

Security and your choices

We use technical and organizational safeguards, including HTTPS, access controls, and protected credential handling. No service can guarantee absolute security. You choose which services to connect and can withdraw access. You may ask us to access, correct, or delete your information, subject to applicable law. Avoid sending passwords, payment-card security codes, or information you do not want processed by an AI service.

Sensitive information

If you share health or other sensitive information for assistance, it may be processed as part of the requested task; Kubi is not a medical provider or emergency service.

Optional website analytics

With your permission, our public website uses Google Analytics to measure visits, waitlist submissions and successful registrations, and clicks on our WhatsApp and phone links. Analytics cookies and Google requests begin only after you choose Accept. We do not send form names, email addresses, phone numbers, URL query strings, or conversation content to Google Analytics. Google receives technical data needed to process requests, such as browser and network information, and reports aggregate usage. Advertising personalization is disabled. You can decline or withdraw consent at any time using Analytics preferences on the homepage. Declining does not prevent use of the site or waitlist. Google may process analytics data outside your country; see Google’s privacy policy.

Changes and contact

We may update this policy as the service changes. Material changes will be communicated through the website or an appropriate service channel. The date below identifies the current version. Contact: support@heykubi.ai.