Privacy policy
Last updated:
This policy explains what personal data Ube collects, why we collect it, who receives it and how you can control it. It covers this website, the Ube app at https://app.ube.digital and the API at https://api.ube.digital.
The short version
- We collect what we need to run your account: your email address from Google sign-in, your billing status from Stripe, and the content you or your agent add.
- To collect answers, we send your campaign questions to OpenAI, Google and Perplexity. To prepare questions, we send your product details to Anthropic.
- Our only cookies keep you signed in. We use no analytics or advertising cookies.
- We don't sell your personal data, and we don't use your content to train AI models.
- To see, correct, export or delete your data, email privacy@ube.digital.
Who we are
Ube is run by Copium Labs Ltd, a company registered in England and Wales under company number 15778277. Our registered office is 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.
Copium Labs Ltd is the controller of the personal data this policy describes. "We", "us" and "our" mean Copium Labs Ltd. For any privacy question, email privacy@ube.digital.
What we collect
- Account details. When you sign in with Google, we receive your email address and your Google account ID. We never see your Google password.
- Agent access. The name of each agent you approve, and when its token was created or revoked. We store API tokens, sign-in sessions and approval links only as SHA-256 hashes.
- Billing records. Your Stripe customer ID, subscription status and renewal date, your payments and top-ups, and your balance with each charge against it. Stripe collects your card details directly, and we never see your card number.
- Your content. The products you add (name, website, description, audience and facts), your campaigns and questions with their language and country settings, and the page changes you or your agent propose.
- AI answers. The answers AI engines give to your questions, the pages they cite, the engine and model used and the price charged. Answers can name businesses and people who appear on public web pages.
- Website checks. Pages we fetch from the websites you add, when we check those sites.
- Connected accounts. If you connect Cloudflare, Google Search Console or Bing Webmaster Tools, we store the account name the provider returns, the permissions you granted and the access tokens, which we encrypt. We also store what we read with those tokens, such as DNS records, verified sites, sitemap status, and index and search traffic data.
- Support emails. Your email address and what you write when you email us.
- Technical data. Your IP address and basic request details, which Cloudflare and Ube use to deliver pages, block attacks and limit repeated requests.
We don't ask for sensitive data, such as health information or political views. Please don't put it, or other people's personal data, in your product details or questions unless you're allowed to share it with us.
How we use it
UK and EU data protection law requires a lawful basis for each use of personal data. These are ours.
| What we do | Lawful basis |
|---|---|
| Create your account, sign you in, and issue tokens to the agents you approve | Contract: we need it to provide Ube to you |
| Prepare questions, collect and store answers, check your website, and propose and measure page changes | Contract |
| Act in the accounts you connect, within the permissions you approve: verify your site, add DNS records, submit sitemaps, and read index and traffic data | Contract |
| Take payments, keep your balance, and charge for each answer | Contract |
| Keep accounting and tax records | Legal obligation |
| Block abuse, fraud and attacks, and limit repeated requests | Legitimate interests: keeping Ube, our customers and our providers safe |
| Reply to your emails, and send service messages about your account, billing, security or changes to our terms | Contract, or legitimate interests if you aren't a customer |
| Comply with the law, enforce our terms, and establish or defend legal claims | Legal obligation, or legitimate interests |
We don't sell your personal data or use it for advertising, and we don't use your content to train AI models. We don't make decisions about you by automated means that have legal or similarly significant effects.
You need to share your email address through Google sign-in to use Ube. Without it, we can't create your account.
What we send to AI providers
Ube works by asking AI engines questions, so some of your content goes to the AI providers below.
- To collect answers, we send the exact text of each question, with its language and country settings, to OpenAI (ChatGPT with web search), Google (Gemini) and Perplexity. Ube rejects questions that name your product or website.
- To prepare questions, we send your product details and campaign settings to Anthropic (Claude).
- The answers come back to us and stay in your account as evidence.
Each provider handles this text under its own terms. Keep confidential information and other people's personal data out of your product details and questions.
Who receives your data
We use these providers to run Ube. Each receives only what its task needs.
- Google runs Google sign-in and Gemini. If you connect Google Search Console, we send it requests with your access token.
- Stripe handles payments, subscriptions, invoices and the billing portal, and collects your payment details directly from you. Stripe also uses payment data for its own purposes, such as preventing fraud, under its own privacy policy.
- Cloudflare carries all traffic to Ube through its network, so it sees IP addresses and requests. It also delivers email sent to our addresses. If you connect Cloudflare, we manage your DNS records through its API.
- OpenAI answers your questions through ChatGPT with web search.
- Perplexity answers your questions.
- Anthropic prepares campaign questions with Claude.
- Microsoft receives requests made with your access token if you connect Bing Webmaster Tools.
- Our email provider stores the emails you send us.
We also share personal data when the law requires it, and with professional advisers, such as accountants and lawyers, who must keep it confidential. If our business is sold or reorganized, the buyer or successor receives your data and must protect it as this policy describes.
International transfers
We're based in the United Kingdom. Several of our providers, including OpenAI, Anthropic, Perplexity, Google, Microsoft, Stripe and Cloudflare, process data in the United States and other countries.
When personal data leaves the UK or the European Economic Area, we rely on adequacy decisions, such as the EU-US Data Privacy Framework and its UK extension for certified providers. Otherwise, we rely on the standard contractual clauses, with the UK Addendum, in each provider's data processing terms. Email privacy@ube.digital to ask which safeguard covers a given provider.
The EU treats UK data protection as adequate, so data can move from the EU to us without extra safeguards.
How long we keep it
- Account, content and answers: while your account is open. If you ask us to delete your account, we delete this data within 30 days.
- Connected account tokens: until you disconnect the account. Disconnecting deletes the stored tokens.
- Sign-in sessions: up to 30 days. Signing out ends your session immediately.
- Agent approval links: 15 minutes. The token an approved agent receives lasts until you revoke it or your account is deleted.
- Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
- Support emails: as long as we need them to help you and to keep a record of what we agreed.
We may keep data longer when the law requires it or when we need it to resolve a dispute.
Your rights
Under UK and EU data protection law, you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data;
- limit how we use your data;
- send your data to you or another provider in a machine-readable format;
- stop using your data where we rely on legitimate interests.
Email privacy@ube.digital from the address on your account. It's free, and we reply within one month. We may ask you to confirm your identity first.
You can do much of this yourself. Your agent can read your products, campaigns and answers through the API, and you can revoke tokens, disconnect accounts and cancel your plan at any time.
If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk), or to the data protection authority where you live or work in the EU.
Rights for US residents
If you live in California or another US state with a consumer privacy law, you can ask what personal information we collect, use and disclose. You can also ask for a copy, a correction or deletion. Email privacy@ube.digital to make a request. An authorized agent can make a request for you, and we'll confirm it with you before acting on it. We won't treat you differently for using these rights. If we turn down a request, you can appeal by replying to our decision.
In the past 12 months, we collected these categories of personal information:
- Identifiers: email address, Google account ID and IP address.
- Commercial information: subscription, payments and balance.
- Internet activity: requests to Ube and actions in your account.
- Professional information: the business details you add.
We collect them from the sources and for the purposes described above. We keep them for the periods in How long we keep it, and disclose them for business purposes only to the providers in Who receives your data. We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you.
Cookies
We use no analytics, advertising or tracking cookies. Our marketing pages set no cookies of their own. The Ube app uses two first-party cookies, and both are needed to sign you in:
__Host-search_lab_sessionkeeps you signed in. It lasts up to 30 days, or until you sign out.__Host-search_lab_sign_inprotects Google sign-in from forged requests. It lasts 10 minutes and is removed once you're signed in.
Because these cookies are strictly necessary, the law doesn't require your consent for them. The app also saves your chosen display language in your browser's local storage. Cloudflare may set its own security cookies to filter out malicious traffic.
Children
Ube is a service for businesses and isn't meant for anyone under 18. We don't knowingly collect personal data from children. If you think a child has given us personal data, email privacy@ube.digital and we'll delete it.
Security
- Every page, the app and the API use HTTPS.
- API tokens, sessions and approval links are stored only as SHA-256 hashes.
- Tokens for connected accounts are encrypted with XChaCha20-Poly1305, using a key kept apart from the database.
- Each account's data is kept separate, and a token can reach only its own account.
- Each connection asks only for the permissions it needs, and lists them before you approve.
No system is perfectly secure. If a breach puts your personal data at risk, we'll tell you and the regulator as the law requires.
Changes to this policy
We'll update this page when our practices change and show the new date at the top. If a change significantly affects how we use your personal data, we'll email you before it takes effect.
Contact us
- Privacy questions and data requests: privacy@ube.digital
- Help with your account: support@ube.digital
- Anything else: hello@ube.digital
By post: Copium Labs Ltd, 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.
Read our Terms of service for the rules of using Ube.