Privacy Policy

This policy covers the websites and web services operated by Zondax on kunobi.com and its subdomains (*.kunobi.com), including ninja.kunobi.com and profile.kunobi.com, and on the legacy kunobi.ninja domain and its subdomains. These are the "Sites" in this policy. It covers visits, redirects, forms, account features and web services where provided on those Sites.

The desktop app and its connected services have their own policy. A service-specific notice may provide additional details about a particular feature. External websites and services operated by other organisations have their own policies.

Who is responsible

Zondax AG, Dammstrasse 16, 6300 Zug, Switzerland, is responsible for the website processing described here. Contact dataprotection@zondax.ch about personal data or hello@kunobi.com about the product.

Visiting the site

Our hosting and delivery providers process IP addresses, requested pages, request times, browser and operating-system information, and referrers where supplied, to deliver pages, redirect requests between domains, provide downloads and protect the Sites. Security measures may process request information to detect abuse. This functional processing does not depend on analytics consent.

The site stores essential preferences such as language, theme and your cookie choice. Authentication providers process sign-in data when you use account features. Following a link to a checkout or another provider subjects that interaction to the notices shown by that provider.

Accounts, teams and billing

Account features process your name, email address, identity-provider identifier and session information to sign you in and manage access. Team features also process membership, roles, invitations and subscription or licence assignments. Device and API access features process the registrations and permissions you configure.

When you buy a plan or manage billing, Stripe processes checkout and payment information on its hosted pages. Zondax processes the associated customer and team identifiers, subscription, invoice and transaction information to provide the plan and administer billing. Account and billing records may remain subject to legal retention requirements after an account is closed.

Shared content and web services

When you use a Site to publish or access shared content, the service processes the content and associated link, account, permission and request information needed to provide that feature. Public links may expose content to anyone who obtains the link. Other recipients may retain copies. Where an organisation controls personal data in that content, its own responsibilities and any applicable processing agreement also apply. Local desktop files and app sharing flows are described in the desktop policy.

Waitlist and messages

On kunobi.com, joining the waitlist sends your email address to our Cloudflare-hosted database. Cloudflare Email Sending is used to send a confirmation. The site also processes your selected language, submission timing and limited request information to deliver the message and prevent spam. Waitlist records include signup and confirmation status. If you have allowed marketing cookies, the signup is also reported to X, as described under Cookies and measurement.

We use the address to administer your request and contact you about Kunobi access. Contact us to leave the list or request deletion. Joining the waitlist is not permission for unrelated marketing. Where separate consent is required for marketing, we must obtain it before sending those messages.

Contact and sales forms process your name, email address, message and any other details you choose to submit. Where a form uses Cloudflare Turnstile, request and verification information is processed to prevent abuse. Some contact forms use Resend for delivery. If you write to us, we process your message and contact details to handle your request. We may also use voluntary feedback and bug reports to diagnose problems and improve our products. Avoid sending secrets or unrelated personal information.

Cookies and measurement

The implementation differs between Sites. On kunobi.com, Google Analytics loads after you allow analytics in the cookie settings. On ninja.kunobi.com and profile.kunobi.com, Google Tag Manager uses Consent Mode and can load before a cookie choice is made. That setup can send measurement requests without analytics cookies. Cookie and advertising-storage permissions are updated from your choices on the relevant Site.

Measurement can process page visits, referral, browser and device information and, where enabled, cookie identifiers. Kunobi Sites share a Google measurement property and cookie domain, so visits can be linked across those Sites where their settings permit it. Download and redirect endpoints may process request records without using the same browser measurement setup.

On kunobi.com and profile.kunobi.com, the X Pixel from X Corp. loads only after you allow marketing cookies. It tells X which pages you view and sets cookies, kept for up to 13 months, that identify your browser and, if you arrived from an ad on X, that ad's click identifier. If you then join the waitlist, create an account or complete a purchase, the Site also reports that conversion to X from our servers: the event, its time and page, the purchase amount where relevant, the click identifier, your IP address and browser user agent, and your email address in hashed form, which X can compare with the addresses of X accounts. X uses this to measure which of our ads lead to signups and purchases.

Use the cookie or privacy controls on the Site you are visiting to change your choices. On kunobi.com, withdrawing analytics consent stops loading Analytics on subsequent views and clears its Google Analytics cookies. On kunobi.com and profile.kunobi.com, withdrawing marketing consent stops loading the X Pixel, clears its cookies and stops conversion reports to X. Changes do not erase information already received. Essential storage and functional requests remain available. A Site's cookie notice provides details of its storage and controls.

Purposes and legal grounds

The Swiss Federal Act on Data Protection applies. Where the GDPR applies, the grounds are contractual necessity or steps you request before a contract, Article 6(1)(b), for requested account or access features; consent, Article 6(1)(a), for optional analytics and marketing that requires consent; legitimate interests, Article 6(1)(f), for site delivery, security, abuse prevention, handling enquiries and analysing voluntary feedback for product improvement, subject to the applicable balancing of interests; and legal obligations, Article 6(1)(c), where records must be retained by law.

Providers and transfers

Cloudflare supplies hosting, delivery, security, and the main website's waitlist storage and confirmation-email delivery. Clerk supplies sign-in services, Stripe supplies checkout and billing, Resend supplies delivery for contact forms that use it, Google supplies measurement services, and X Corp. supplies advertising measurement where you allow marketing cookies. Additional hosting and operational providers support account and web services as described on the service providers page. Providers may process personal data outside Switzerland or the EEA.

The service providers page identifies recipients, destination countries and the applicable adequacy decisions or other required transfer safeguards. We do not sell your personal data. Further disclosure may occur where legally required or necessary to establish, exercise or defend legal claims, subject to applicable law.

Retention and rights

We retain waitlist entries while needed to manage the list and your access request, and remove them on a valid deletion request unless a lawful retention reason applies. Support messages are kept while needed to resolve the request or meet a legal obligation. Request logs, security records, analytics and backups follow the periods or criteria specified on the service providers page. Records needed for legal obligations or claims may have to be retained after the original request ends.

Subject to the conditions of applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Send requests to dataprotection@zondax.ch. We respond within the legally required period. You may complain to the Swiss Federal Data Protection and Information Commissioner or, where applicable, the supervisory authority where you live or work in the EEA.

Changes

This policy is version 1.2. kunobi.com/privacy/web identifies the current published version. Published versions remain at their own addresses. Material changes will be explained, and consent obtained where required.