Effective 27 July 2026
Privacy Policy
We do not sell personal data, we do not show advertising, and we do not build advertising profiles. This policy explains what we collect, why, and who else sees it. It covers both this website at kiuboid.com and the application at app.kiuboid.com — one service across two addresses.
1. Information we collect
- Account information — your email address, your name if you give one, and how you sign in (a link sent by email, a password, or your Google account).
- Workspace and tour information — the tours, scenes, hotspots and folders you create, who is in a workspace, and what role they have.
- Media you upload — panoramas and images, and the sizes and formats we derive from them so a viewer loads quickly.
- Payment information — we receive a subscription status, a plan, and a customer reference from Lemon Squeezy. We never see or store your card details.
- Technical logs — request records including IP address, kept for security and debugging.
2. How we use it
To run the service: signing you in, storing and serving your tours, enforcing the limits of your plan, sending you the emails the product needs to send, and answering you when you write to support. We also use it to keep the service secure and to fix problems.
3. How it is shared
We share data with the providers below and with nobody else, except where we are legally required to. Each does one job for us and is bound to it.
| Provider | What they do | Applies to | Where |
|---|---|---|---|
| Lemon Squeezy | Payments, merchant of record, invoicing | App | United States |
| Cloudflare | CDN and TLS for both surfaces; R2 object storage for media and database backups; hosting for this marketing site | Both | Global |
| Resend | Transactional email — sign-in links and team invitations | App | United States |
| Optional “Sign in with Google” | App | United States | |
| Google Analytics | Website analytics, only if you accept analytics cookies | Marketing site | United States |
| [HOSTING_PROVIDER] | Application and database hosting | App | [REGION] |
4. Cookies
The application sets three cookies, all of which are needed for it to work at all. There is no way to use a signed-in service without them, so they are not optional and we do not ask.
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
| session | Keeps you signed in. HttpOnly, so JavaScript cannot read it. | The length of your session | Strictly necessary |
| csrf | Protects against cross-site request forgery | The length of your session | Strictly necessary |
| oauth | Holds sign-in state while you are at Google. HttpOnly. | About 10 minutes | Strictly necessary |
This marketing website sets these:
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
| _ga, _ga_* | Google Analytics — measures how this site is used | 2 years | Analytics — consent required |
| kb_consent | Remembers whether you accepted or declined analytics cookies | 6 months | Strictly necessary |
Google Analytics is loaded only if you accept it. If you decline, no Google script is loaded and no request is made to Google at all. You can change your mind at any time using the Cookie preferences link at the bottom of every page.
5. Your choices and control
You can edit your account details and delete your tours and media at any time from the app. Deleting your account removes your personal data and your content; write to support@kiuboid.com and we will confirm when it is done. Backups are overwritten on their normal cycle, so a deleted item can persist in a backup for a short period before it is gone for good.
6. Your rights
If you are in the EU or the UK, the GDPR gives you the right to access your data, correct it, delete it, take a copy of it elsewhere, object to some processing, and complain to your national data protection authority. If you are in California, the CCPA gives you the right to know what we collect and to have it deleted — and note that we do not sell personal information, so there is nothing to opt out of.
Exercise any of these by writing to support@kiuboid.com. A data processing agreement is available on request.
7. Data security
Traffic is encrypted in transit. Passwords are stored hashed, never in a readable form. Access to production data is limited to what is needed to operate the service.
8. Children
Kiuboid is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.
9. Changes, and how to reach us
We will update this policy as the service changes, and the effective date at the top will change with it. Questions or requests: support@kiuboid.com.