Privacy Policy

Last updated: 2 August 2026

1. Introduction and data controller

This policy explains what data we process, for what purposes, with which providers and for how long, in accordance with the General Data Protection Regulation (GDPR).

The Koaee service is published by Ubnbee LLC, a limited liability company incorporated under the laws of the State of Delaware (United States).

1.1 Two distinct roles, not to be confused

Depending on the processing activity involved, Ubnbee LLC does not act in the same capacity, and your point of contact is not the same:

• We are the data controller for the data of our own visitors and customers: browsing on koaee.ai, public demonstrations, account creation, billing, and exchanges with our support team. We are the ones who decide why and how this data is processed, and it is to us that you should address your requests.
• We are a data processor for the data processed by an assistant deployed at a customer's site — the conversations of its own visitors. The customer decides the purpose and the means; we act solely on its documented instructions, under a data processing agreement concluded with it. If you are a visitor to the site of a Koaee customer, it is to that customer that you should address your requests for access, rectification or erasure: we forward them without answering them ourselves.

This distinction is not a formality: it determines who answers for what to you and to the authorities. This policy describes the processing activities for which we are the controller. Those where we act as processor are governed by the agreement concluded with the customer concerned, and described in that customer's privacy policy.

2. Data Collected

2.1 Data collected automatically

• IP address
• Browser type and version
• Operating system
• Pages visited and duration of visit
• Date and time of access
• Referring URL

2.2 Data provided voluntarily

• Your written messages to the assistant
• Your voice, only if you use the microphone (see §9: the recording is deleted as soon as processing ends)
• Language preference
• Contact details you leave us voluntarily (contact request, quote)
• Account and billing information, if you subscribe to a plan

3. Cookies

The only cookies used are functional:

• Language preference (koaee_lang) — remembers the language you have chosen. Exempt from consent.
• Session cookie — only in the client area, after login, to keep you authenticated. It disappears when the browser is closed.

If we were ever to introduce analytics, it would be preceded by a consent banner, and this page would be updated beforehand.

4. Subprocessors

We cannot provide the service alone. Here is the full list of providers who process data on our behalf, and what each one receives:

• IONOS SE (Germany, servers in France) — hosting. Receives all of the service's data.
• Mistral AI SAS (France) — language model. Receives the content of your written conversations, to generate the response. Also receives the text of responses read aloud in French and English (voice synthesis).
• OpenAI (United States) — voice transcription, only if you use the microphone. Receives your audio recording.
• Google LLC (United States) — voice synthesis in languages other than French and English. Receives the text of responses read aloud.
• Stripe Payments Europe Ltd (Ireland) and Stripe, Inc. (United States) — payment. Receives your billing details; we never see your card number.
• Heinlein Support GmbH / mailbox.org (Germany) — email. Receives the emails exchanged with us.
• DeepL SE (Germany) — translation of our professional clients' content. Receives no visitor data.

Each is bound by a data processing agreement (DPA). This list is kept up to date: if we change provider, this page changes with it.

5. Resources loaded by your browser

Some pages load fonts, icons or images from third-party servers. By the mere fact of displaying the page, these third parties receive your IP address and your browser type:

• Google Fonts (Google LLC, United States) — typefaces
• cdnjs (Cloudflare, Inc., United States) — icon library
• jsDelivr — layout library
• Unsplash (United States) — some illustrations on our demonstration pages

These resources set no cookies and are not used for any tracking on our part. We are working to host them ourselves in order to remove these connections.

6. Purpose of Processing

We use your data to:

• Answer your questions through the conversational assistant
• Transcribe your voice, if you choose to speak rather than type
• Process your contact request or your order
• Ensure the security of the service and prevent abuse (rate limiting, anti-bot)
• Meet our legal and accounting obligations

7. Legal Basis for Processing

We process your data on the following legal bases:

• Performance of a contract: to provide the service you request (answering, transcribing your voice, processing an order)
• Legitimate interest: for the security of the service and the prevention of abuse
• Consent: for the use of the microphone, which you trigger yourself and can stop at any time
• Legal obligations: for billing and accounting

8. Data Sharing

Your data is shared only with the processors listed in §4, and only to the extent necessary to deliver the service. There is no other recipient.

We never sell your personal data and we never disclose it to any third party for advertising purposes. Each processor is bound by a processing agreement that prohibits them from using your data for their own purposes.

We may be required to disclose data at the request of a competent judicial authority.

9. Retention Period

• Audio recordings: deleted at the end of the request
• Written conversations: not retained in our application databases beyond the current session
• Technical logs (timestamp, IP address, response code): 12 months maximum
• Functional cookies: 13 months maximum for the language preference, session duration for the login cookie
• Account and billing data: until the account is deleted, then retention of accounting records for the applicable legal period

10. Your Rights

In accordance with the GDPR, you have the following rights:

To exercise these rights, write to us at the address given in §14. We respond within one month. No justification will be required beyond what is necessary to verify your identity.

11. Security

We implement appropriate technical and organizational security measures to protect your data against any unauthorized access, alteration, disclosure or destruction:

• SSL/TLS encryption for all communications
• Secure authentication
• Regular backups
• Strict data access control
• Continuous security monitoring

12. International Transfers

The hosting and processing of your written conversations take place within the European Union (IONOS in France, Mistral AI in France).

Three types of processing involve providers based in the United States:

• voice transcription (OpenAI), if you use the microphone;
• voice synthesis (Google), to read responses aloud;
• payment (Stripe), for professional clients.

These transfers rely on the European Commission's standard contractual clauses and, where applicable, on the providers' certification under the EU-US Data Privacy Framework. If you prefer that no data leave the European Union, do not use the voice feature: the written conversation remains entirely processed in Europe.

13. Changes

We may update this privacy policy from time to time. The date of the last update is shown at the top of this page. We encourage you to review this page regularly to stay informed of our practices.

14. Contact and Complaints