Privacy policy

1. Who is responsible for your data

FELICITOUS SALOON - UNIPESSOAL LDA, operator of Koobia, is the data controller. Registered office: Rua Conselheiro Costa Braga, 4450-102 Matosinhos, Portugal. Tax number: 518 936 481. For privacy questions or rights requests, email ola@koobia.studio.

This policy applies to the Koobia website, application and services. Specific notices may apply when you use a feature or make a payment.

2. Data we process

We may process account and profile data; authentication and security logs, including IP address and browser agent; work files, manuscript text, titles, languages, metadata and versions; editorial outputs and instructions, including assessments, suggestions, translations, covers, notes and preferences; and order and billing data needed to provide the service.

If you sign in with Google, we receive the identity information Google provides for authentication, such as your account identifier, name and email. Stripe processes payments; Koobia receives transaction and payment-status information, not your full card details.

3. Purposes and legal bases

We use data to manage your account, store your work and provide requested features such as editorial analysis, focused review, material generation, translation and quality checks. The legal basis is the performance of a contract or pre-contractual steps you request (GDPR Article 6(1)(b)).

Technical and activity logs help protect accounts, prevent abuse, diagnose faults and secure the service, based on legitimate interests (Article 6(1)(f)). Accounting and transaction records are retained where required by law (Article 6(1)(c)). Where consent is required, we ask before processing and you may withdraw it.

4. Editorial tools and artificial intelligence

Editorial assessments, suggestions and checks are produced by automated workflows guided by specialist personas. Human editorial reading is not included. AI can make mistakes; its suggestions support your work and do not replace your decisions about it.

When you start a feature, we send the relevant technical provider the data needed to perform it. Depending on the operation, this may include all or part of a manuscript, instructions, language and work metadata. Providers include OpenAI and DeepSeek, depending on the feature and availability. Do not submit unnecessary sensitive personal data about third parties.

5. Who receives data

We share only what is necessary with service providers supporting hosting and file storage, databases and infrastructure; OpenAI and DeepSeek for editorial features; Google if you choose Google sign-in; Stripe for checkout and payments; and Brevo for transactional email.

Providers process data according to their roles and applicable agreements. We do not sell manuscripts or personal data and do not use manuscripts for advertising. We may disclose data where required by law or needed to protect rights, users or service security.

6. International transfers

Some providers may process data outside the European Economic Area. Such transfers must rely on a GDPR Chapter V mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable. You may request information about the mechanism used for a specific transfer by contacting us.

7. Retention and deletion

We keep data while your account and services are active and for as long as needed for the purposes described. You may request deletion of your account, works and related content by contacting us. Active content will be deleted without undue delay unless a legal obligation or legitimate need requires retention.

Backups may remain in expiry cycles for up to 90 days. Accounting, tax and transaction records may be kept for the legally required period, up to 10 years where required. Security and session logs are retained only as needed for security and operations.

8. Your rights

Under the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting prior processing. Legal exceptions may apply, and we may need to verify your identity.

To exercise your rights, email ola@koobia.studio. You may also lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

9. Security

We apply technical and organisational controls intended to protect accounts and restrict access to content. Work access takes place through the authenticated application; files are not presented as public pages. No transmission or storage system can be guaranteed completely secure, and we do not claim certifications or specific encryption measures unless verified for the relevant environment.

10. Cookies and local storage

The application uses cookies strictly necessary for authenticated sessions and protection against forged requests (CSRF). Your language preference may be stored in browser local storage. We have not identified advertising or behavioural analytics cookies on the public website. If non-essential cookies are added, this policy will be updated and consent requested where required by law.

11. Automated decisions and changes

Our tools may produce automated assessments and recommendations about your work. They are presented as editorial support and are not legal decisions or decisions producing legal effects about you. We may update this policy to reflect changes to the product, law or providers; the current version shows its update date.