Privacy Policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Kobe UG (haftungsbeschränkt)
Pauline-Staegemann-Straße 2
10249 Berlin
Germany

Represented by the Managing Director:
Nils Koepchen

Email: nils@getkobe.ai

2. Overview of Data Processing

We process personal data only to the extent necessary to operate our website, provide the Kobe Mac application and its features, analyze our services, and market our offering.

We do not sell personal data and only share it with service providers where necessary to provide our services and as described in this Privacy Policy.

Kobe is designed as a local Mac application. Data from connected tools and the work context generated from that data are generally stored locally on your device.

Kobe does not persistently store your work data on its own servers.

For certain AI-powered features, Kobe uses models from Google’s Gemini model family through the paid Gemini API. Where necessary to perform a function requested by you, selected excerpts or processed context may be transmitted to Google Gemini.

Gemini API logging is enabled for our production project. Requests, responses, and related metadata processed through supported Gemini API calls may therefore be stored within our Google Cloud project for up to 55 days.

Kobe does not use your work data to train or fine-tune its own AI models.

According to Google’s terms and documentation for paid Gemini API services, prompts and responses submitted through paid services are not used to improve Google products by default. We do not voluntarily share Gemini logs or datasets with Google for model or product improvement.

On our website, we use PostHog for analytics and error diagnostics. With your consent, we may additionally use persistent analytics, session recordings, and Google Ads conversion tracking.

We use Loops to send product and marketing emails.

3. Website Hosting via Google Cloud

Our website is hosted using Google Cloud, including Firebase App Hosting.

Our website infrastructure is located in the Google Cloud region europe-west4 in the Netherlands.

When you access our website, technically necessary connection data may be processed. This may include:

• IP address
• browser type and browser version
• operating system
• referrer URL
• requested URL
• date and time of access
• technical connection and error data

This processing is necessary to deliver the website and to ensure the security and stability of our services.

All connections are encrypted using TLS.

The website may be delivered via Google’s content delivery infrastructure. As a result, a request may be routed through a technically appropriate network location.

Retention

Technical server and security logs are processed in accordance with the applicable retention policies of the Google Cloud services we use.

Legal basis

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the reliable, secure, and efficient operation of our website.

We have entered into the required data processing agreements with Google. Where personal data is processed outside the European Economic Area, such processing takes place on the basis of the applicable safeguards under Chapter V of the GDPR.

4. Website Analytics with PostHog

We use PostHog for website analytics, session recordings, and error diagnostics.

We use PostHog’s EU Cloud hosted in Frankfurt am Main, Germany.

PostHog operates in different modes on our website depending on whether you have consented to the Statistics category.

Without Statistics Consent

Before you make a decision in the consent banner, and if you reject Statistics, we use PostHog only in a cookieless mode.

In this mode, no PostHog cookies are set and no persistent visitor identifier is stored in your browser.

Your IP address may be processed temporarily on the server side to generate a checksum and is not stored as a persistent identifier. A regularly changing random value is included in this checksum so that long-term recognition is prevented.

Related page views may temporarily be associated with the same session on the server side.

In this mode:

• no persistent user profiles are created
• no persistent visitor ID is transmitted to PostHog
• no session recordings are created
• no persistent analytics cookies are set

With Statistics Consent

If you consent to the Statistics category, we may additionally use PostHog cookies and browser storage.

The following data may then be processed:

• page views
• clicks
• scrolling behavior
• time spent on the website
• technical browser and device information
• referrer information
• web performance metrics
• technical errors
• pseudonymous visitor identifiers
• session recordings

Where session recordings are enabled, input fields are masked according to our configuration.

Download Measurement

We may use PostHog to measure whether the “Download for Mac” button has been clicked.

Without Statistics consent, this measurement takes place only in the cookieless mode.

With Statistics consent, the download event may be linked to a pseudonymous visitor identifier and other analytics information.

Retention

Session recordings are automatically deleted after 30 days.

We retain analytics event data for as long as it is necessary to analyze and improve our services. We delete such data once this purpose no longer applies, and no later than when the relevant analytics project is discontinued.

Legal basis

For cookieless analytics:
Art. 6(1)(f) GDPR. Our legitimate interest is the analysis and improvement of our website and services.

To the extent that no information is stored on or accessed from your device, no consent under Section 25(1) TDDDG is required.

For cookies, persistent identifiers, and session recordings:
Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw your consent at any time through the cookie settings.

We have entered into a data processing agreement with PostHog in accordance with Art. 28 GDPR.

5. Consent Management with Cookiebot

We use Cookiebot by Usercentrics A/S, Denmark, to manage your privacy and cookie preferences.

Our consent banner distinguishes in particular between:

• Necessary
• Statistics
• Marketing

When you interact with the consent banner, Cookiebot stores your decision in a technically necessary consent cookie.

Cookiebot may process in particular:

• a shortened or anonymized IP address
• date and time of your decision
• consent status
• website URL
• a consent ID

Retention

The consent record is generally stored for 12 months.

Legal basis

Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as well as Art. 6(1)(f) GDPR for the technically necessary management of your privacy preferences.

You can change or withdraw your choices at any time through the cookie settings.

6. Google Ads and Google Consent Mode v2

Google Ads is not currently active on our website. We do not load Google Ads, Google Tag Manager, gtag.js, Conversion Linker, or Google Consent Mode requests. The following information describes how Google Ads would operate if we enable it in the future.

For Google Ads, we use Google Consent Mode v2 in the Basic implementation. This means that Google Ads and conversion tags are completely blocked and are not loaded before you have given your Marketing consent.

Accordingly, before your consent, no cookieless Google Ads pings or other conversion data are transmitted to Google through these tags.

Only after you consent to the Marketing category will the required Google Ads tags be activated.

The consent states relevant to Google Consent Mode v2 include in particular:

• ad_storage
• ad_user_data
• ad_personalization

These are set according to your consent choice.

Download Conversion Tracking

If you have consented to Marketing and subsequently click “Download for Mac”, we may transmit this click to Google Ads as a conversion.

This allows us to understand which advertising campaigns lead to downloads or download intent.

The following information may be processed:

• IP address
• browser and device information
• requested URL
• referrer
• time of the conversion
• campaign information
• Google Click Identifiers such as GCLID
• pseudonymous cookie or browser identifiers
• information that the download button was clicked

We do not transmit Kobe work data or content from the Kobe Mac application as part of this conversion event.

If you reject Marketing, the download functionality remains fully available. Google Ads conversion tracking will not be activated.

Legal basis

Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

7. Campaign and UTM Attribution

If you access our website through an advertising or campaign link, the URL may contain marketing parameters.

These may include:

• UTM Source
• UTM Medium
• UTM Campaign
• UTM Content
• UTM Term
• referrer
• advertising click identifiers

These parameters may be technically processed during the current browser session.

Persistent storage for marketing attribution only takes place after you have consented to the Marketing category.

Following your consent, we may store such information for up to 30 days in order to attribute campaigns and subsequent conversions.

Legal basis

For persistent attribution:
Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

8. Product and Marketing Emails via Loops

We use Loops, operated by Astrodon, Inc., USA, to send product and marketing emails.

If you actively subscribe to such emails, we may process in particular:

• email address
• language
• opt-in status
• date and time of subscription
• date and time of confirmation
• referral or campaign information, where applicable

Double Opt-In

We use a Double Opt-In process for product and marketing emails.

After signing up, you will first receive a confirmation email.

Your email address will only be activated for product and marketing communications after you click the confirmation link contained in that email.

If you do not confirm your subscription, you will not receive marketing emails.

You can withdraw your consent at any time by using the unsubscribe link contained in our emails or by contacting us directly.

Transactional Emails

Transactional or technically necessary messages are separate from marketing communications.

Such messages may be sent where they are necessary to provide a Kobe feature requested by you.

Retention

Marketing-related data is generally stored until you withdraw your consent or request deletion.

After withdrawal, we may retain information about the withdrawal or a suppression entry where necessary to ensure that you do not receive further marketing emails.

Legal basis

For product and marketing emails:
Art. 6(1)(a) GDPR.

For necessary transactional messages:
Art. 6(1)(b) GDPR.

We have entered into the required data processing agreements with Loops and Astrodon, Inc.

9. Referral Program

Kobe may offer a referral program that allows users to invite other people to Kobe.

For this purpose, the inviting user receives an individual referral link containing a pseudonymous unique identifier.

For example:
https://getkobe.ai/?ref=abc123

The referral identifier itself does not contain a plain-text email address or name.

Processing When a Referral Link Is Used

When you access such a link, we may process in particular:

• referral ID
• time of access
• destination page
• referrer
• technical connection information
• a pseudonymous visitor identifier, where applicable

Referral Attribution

Referral attribution is valid for a maximum of 30 days.

If the referral ID is to be stored persistently in your browser, this 30-day storage on the website only takes place after you have provided the relevant Marketing consent.

Without Marketing consent, we do not store a persistent 30-day referral identifier in your browser.

Where a referral is explicitly activated within the Kobe application or is associated with a user account or a specific invitation, the required referral identifier may be processed separately as part of providing the referral functionality.

Purpose

We process referral information for:

• attribution of invitations
• operation of the referral program
• granting referral benefits or rewards, where applicable
• fraud and abuse prevention
• analysis of the effectiveness of the referral program

Retention

Website referral attribution is limited to a maximum of 30 days.

Other referral data is stored only for as long as necessary to operate the referral program or prevent fraud and abuse.

Legal basis

For persistent browser-based marketing attribution:
Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

For referral functionality actively used by the user and any agreed referral benefits:
Art. 6(1)(b) GDPR.

For fraud and abuse prevention:
Art. 6(1)(f) GDPR.

10. Cookies and Local Browser Storage

We use technically necessary technologies and, following your consent, Statistics and Marketing technologies.

Necessary

CookieConsent

Purpose: Stores your consent preferences.
Retention: 12 months.

Additional technical consent or opt-out entries may be required to ensure that your rejection of analytics or marketing services is respected.

Statistics – Only After Consent

ph_*

Purpose: PostHog session and visitor information.
Retention: Depending on the PostHog configuration, up to 12 months.

kobe.visitor_id

Purpose: Pseudonymous visitor identifier used to associate analytics events.
Retention: Persistently stored only after Statistics consent.

Without Statistics consent, we do not use a persistent PostHog visitor identifier.

Marketing – Only After Consent

_gcl_* and comparable Google Ads storage technologies

Purpose: Google Ads conversion attribution.

kobe.utm

Purpose: Storage of marketing attribution information.
Retention: Maximum 30 days.

kobe.referral_id

Purpose: Browser-based attribution of a referral link.
Retention: Maximum 30 days.

Persistent Statistics and Marketing entries are only set after you have provided the relevant consent.

You can change or withdraw your choices at any time through the cookie settings.

11. Local Processing and Storage

Kobe is a local Mac application.

When you use Kobe, your work context and data from the tools you provide or connect are generally stored locally on your Mac.

Depending on the functions you use, this may include:

• profile information
• professional information
• project information
• messages and communication content
• metadata from work applications
• projects derived from your work history
• skills and expertise
• analyses and assessments generated by Kobe
• prompts and requests entered by you

The specific information processed depends on the data sources you provide to Kobe and the functions you use.

Kobe does not persistently store your work data on its own servers.

Locally stored data generally remains on your Mac until you remove it using available Kobe functionality, delete the local Kobe data, or uninstall the application.

Legal basis

Art. 6(1)(b) GDPR.

12. Connected Data Sources

Kobe currently supports data from, in particular:

• Slack
• LinkedIn

A connection or data import only takes place when you initiate it.

Kobe processes only information made available through the relevant connection or the data access you provide.

Where supported by the relevant integration, you can disconnect connected services again.

The respective third-party services may also process data under their own responsibility and in accordance with their own privacy policies.

13. Work Data Relating to Other People

Work data you provide may also contain information relating to other people, such as colleagues, customers, or other professional contacts.

Kobe processes such information only to the extent that it forms part of the work context you provide and is required for the Kobe functions you use.

You are responsible for using Kobe only with data and data sources that you are legally permitted to access and process for this purpose.

14. AI Processing with Google Gemini

For certain analysis and generation features, Kobe uses models from Google’s Gemini model family through the paid Gemini API.

Not all processing therefore takes place exclusively on your Mac.

When you use a corresponding AI feature, selected excerpts or processed context required to perform the relevant request may be transmitted to Google’s Gemini infrastructure.

Depending on the functionality, this may include:

• your prompt
• selected excerpts from your work context
• derived project information
• skills or expertise
• other contextual information required for the analysis
• technical metadata relating to the request

Where possible, we limit the information transmitted to Gemini to the context required for the relevant function.

The transmitted information may contain personal data.

We therefore do not claim that all information transmitted to Gemini is anonymous or fully synthetic.

Kobe does not use your work data to train or fine-tune its own AI models.

15. Use of Gemini Data by Google

We use the paid Gemini API.

According to Google’s documentation for paid Gemini API services, content submitted through paid services is not used to improve Google products by default.

This also applies to prompts and responses contained in Gemini API logs for billing-enabled projects, unless the project owner actively chooses to share such data with Google for product improvement or model training.

We do not transmit your work data to Google for the purpose of training or improving Google’s AI models.

We do not voluntarily share prompts, responses, Gemini logs, or Gemini datasets with Google for model or product improvement.

16. Gemini API Logging

Gemini API logging is enabled for our production Google Cloud project.

As part of this logging, Google may store data generated by supported Gemini API calls within our Google Cloud project.

These logs may include:

• prompts and requests transmitted to Gemini
• selected excerpts or processed work context included in those requests
• responses generated by Gemini
• request and response metadata
• technical information associated with the API request

Because requests sent to Gemini may contain personal data or information derived from your work context, Gemini API logs may also contain personal data.

The logs are private to our Google Cloud project and are separate from logs that Google may process solely for abuse monitoring or security purposes.

Retention

Our Gemini API logs are retained for a maximum of 55 days.

After this retention period, Google automatically marks the logs for deletion in accordance with the Gemini API logging configuration.

We do not create datasets from these logs for the purpose of retaining them beyond this period.

We do not voluntarily share logged prompts, responses, or datasets with Google for model training, product improvement, or development.

According to Google’s documentation for billing-enabled Gemini API projects, prompts and responses contained in these logs are not used for Google product improvement or development by default.

If we change the logging retention period or materially change how Gemini API logs are used, we will update this Privacy Policy accordingly.

17. Legal Basis for Gemini Processing

Where transmission to Gemini is necessary to provide a Kobe feature requested by you, the legal basis is:
Art. 6(1)(b) GDPR.

The associated logging supports the operation, debugging, reliability, and improvement of the AI functionality we provide.

To the extent that such logging is not strictly necessary for the performance of the service, we rely on Art. 6(1)(f) GDPR. Our legitimate interests include maintaining service reliability, investigating errors, monitoring the quality of our AI functionality, and preventing abuse.

Where technical processing is necessary for security, fraud or abuse prevention, or service stability, Art. 6(1)(f) GDPR may additionally apply.

18. International Data Transfers

Some of the service providers we use may process personal data outside the European Economic Area.

Where the European Commission has adopted an adequacy decision for the relevant country, transfers may be based on that adequacy decision.

Otherwise, we use appropriate safeguards within the meaning of Art. 46 GDPR, including Standard Contractual Clauses approved by the European Commission where applicable.

This may apply in particular to international service providers or their subprocessors used for hosting, AI processing, email delivery, advertising, and related technical services.

19. No Solely Automated Decisions Producing Legal or Similarly Significant Effects

Kobe uses automated processes to analyze your professional context and derive, for example:

• skills
• expertise
• projects
• assessments
• recommendations
• potential career or freelancing opportunities

These results are provided as assistance and recommendations.

Kobe does not make solely automated decisions about you that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.

20. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, and unauthorized disclosure.

These measures include in particular:

• local storage of essential work data
• TLS-encrypted network connections
• access restrictions
• limiting context transmitted to external AI services to information required for the relevant function
• consent-based activation of Statistics and Marketing technologies

21. No Sale of Personal Data

We do not sell personal data.

We only disclose personal data where this is:

• necessary to provide our services
• described in this Privacy Policy
• required by law
• initiated or permitted by you

22. Your Rights

Under the GDPR, you have in particular the following rights:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to withdraw consent pursuant to Art. 7(3) GDPR

Where we process personal data on the basis of legitimate interests, you may object to such processing on grounds relating to your particular situation.

You can withdraw your consent to Statistics, Marketing, and product or marketing emails at any time with effect for the future.

To exercise your rights, simply contact:

nils@getkobe.ai

Exercising your statutory data protection rights is generally free of charge.

23. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection law, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority.

The supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

You may also contact a supervisory authority at your habitual place of residence or place of work.

24. Changes to This Privacy Policy

We may update this Privacy Policy if our products, data processing activities, or legal requirements change.

The current version will always be available on our website.

Last updated: September 2026