Privacy Policy

This Privacy Policy explains what personal data Uboros collects when you use our platform, why we collect it, how we use it, and the choices and rights available to you. It is aligned with the EU General Data Protection Regulation ("GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

Uboros (the "Service") is operated by WorkHold Technologies OÜ, an Estonian private limited company (osaühing), registry code 17570836, registered at Ahtri tn 12, Kesklinna linnaosa, Tallinn 15551, Estonia.

1. Who controls your data

Uboros is the data controller for personal data we collect about you as a user of the Service (e.g. your email address, your account preferences, your billing history). For personal data that you process through the Service (e.g. data you ingest from your ad accounts or upload as creative inputs), Uboros acts as a data processor on your behalf — see our Data Processing Agreement.

2. What data we collect

2.1 Data you provide directly

• Account information — email address, display name (optional), password (stored as a salted hash; never in plain text).
• Workspace and project metadata — brand names, competitor lists, briefs, asset titles and tags.
• Connection credentials — API tokens and OAuth grants you authorise for connected platforms (Meta, TikTok, AdsPower, OpenAI, Anthropic, etc.). Tokens are stored encrypted at rest.
• Uploaded content — images, videos, brand documents, or other files you upload for use in creative briefs and renders.
• Billing details — name, billing address, VAT number, payment method. Payment-card details are processed and stored by Stripe; we never see or store full card numbers.
• Support communications — emails or chat messages you send us.

2.2 Data we generate as you use the Service

• Usage logs — request paths, timestamps, response codes, error traces (retained for operational debugging).
• Audit logs — who approved which brief, who deployed which asset, who changed which setting.
• Per-render cost records — token counts, model used, EUR cost, mark-up applied. Retained for billing and dispute resolution.
• Performance signals — ad-spend and result metrics ingested via your connected ad-platform accounts.

2.3 Data we receive from third parties

• From Stripe — billing status, subscription tier, payment outcomes.
• From ad platforms — ad-performance metrics returned by the ad-platform APIs you have authorised.
• From Apify — publicly available competitor-ad-library data, as a service operated on your behalf.
• From integration partners (e.g. RedTrack and other platforms you connect via our API / MCP server) — creative media URLs and aggregate ad-performance statistics that you have authorised that platform to share with us, used solely to power the annotation and creative-generation features you invoke through the integration. We process these inputs to fulfil the specific request only.

We do not use third-party advertising trackers (Google Analytics, Facebook Pixel, etc.) — no ad networks, no retargeting, no cross-site tracking. Visitor analytics on our marketing site remain first-party only (coarsened IP, coarsened user-agent, hashed session). Inside the signed-in Service, we use PostHog — a product-analytics processor, not an advertising tracker — to understand onboarding completion and feature usage; see the sub-processor table below and our Cookie Policy for what it stores.

3. How we use your data

• Provide the Service — operate the account, workspace, briefs, asset rendering, deployment, and performance reporting features you have signed up for.
• Bill correctly — calculate and collect subscription and generation-cost fees.
• Communicate — send transactional emails (account confirmations, password resets, billing receipts, service notifications). We do not use your address for unrelated marketing.
• Improve the product — analyse aggregate, de-identified usage to find rough edges and decide what to build next. Individual content — including creative media and performance data received through integrations — is never used to train shared models; it is processed only to fulfil the request you invoked.
• Protect the Service — detect abuse, prevent fraud, comply with platform partner policies (Meta, TikTok, Google).
• Meet legal obligations — respond to lawful requests from authorities; keep records required by tax and accounting law.

4. Legal bases for processing

Under GDPR Article 6, we process personal data on the following bases:

Where we rely on legitimate interests, you have the right to object — see Your rights under GDPR.

5. Who we share data with (sub-processors)

To run the Service we share data with carefully selected sub-processors. Each is bound by data-processing terms equivalent to or stricter than this policy.

We will update this list when we add or change sub-processors. Material changes will be announced in-product at least thirty (30) days before they take effect.

6. International transfers

Some of our sub-processors are based outside the European Economic Area, primarily in the United States. Where data is transferred to a country without a European Commission adequacy decision, we rely on the EU Standard Contractual Clauses (SCCs) and, where appropriate, supplementary technical measures (encryption in transit and at rest, access controls).

You can request a copy of the SCCs in place with a specific sub-processor by emailing hello@uboros.com.

7. How long we keep data

• Account data — for the lifetime of your account, plus thirty (30) days after termination during which you can export.
• Billing records — retained for the period required by Portuguese tax law (currently 10 years for accounting records).
• Operational logs — 30 days for request logs; 90 days for error logs.
• Audit logs — for the lifetime of your account; deleted on account termination.
• Competitor-library data — for the lifetime of your project; deleted when the project is deleted.
• Integration inputs — creative media URLs received via an integration (e.g. RedTrack) are transient: fetched at request time for annotation/generation and not retained beyond the resulting asset. Derived annotations and any generated assets follow your project lifetime. Visit-analytics records are retained 12 months, then cycled out.
• Backups — encrypted off-site backups retained for up to 30 days, then cycled out.

7.1 Integrator / API data handling

When you connect a third-party platform to Uboros via our API or MCP server, that platform acts on your authorisation. It sends us only what is needed for the feature you invoke — typically creative media URLs and aggregate performance statistics. We process these through the AI sub-processors listed in section 5 (Anthropic, OpenAI, Google, fal.ai) to produce annotations and creative, return the result to you, and do not use the inputs to train shared models. Access is tenant-scoped to your project and bound to a revocable access token you (or the operator) control.

8. Security

We protect your data with industry-standard technical and organisational measures, including:

• encrypted connections (TLS 1.3) for all traffic;
• encryption at rest for the application database and file storage;
• secrets management — API tokens stored encrypted, never logged or returned to the client;
• password storage as salted hashes (PBKDF2-SHA256);
• session cookies marked Secure, HttpOnly, and SameSite=Lax;
• CSRF protection for cookie-authenticated state-changing requests;
• role-based access inside each workspace, with project-level isolation;
• regular dependency updates and security review.

If you discover a security issue, please email security@uboros.com.

9. Your rights under GDPR

You have the following rights regarding personal data we hold about you. You can exercise them by emailing hello@uboros.com from the address on your account; we will respond within thirty (30) days.

• Access (Art. 15) — receive a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your data, subject to legal retention requirements.
• Restriction (Art. 18) — limit how we process your data while a question is being resolved.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain to a supervisory authority — in Estonia, the Estonian Data Protection Inspectorate / Andmekaitse Inspektsioon (AKI) (www.aki.ee); or to the authority in your country of residence.

10. Children

Uboros is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified at least thirty (30) days before they take effect, by email to the address on your account and by an in-product notice. Minor clarifications may be made with the updated date noted above.

12. Contact and complaints

Privacy questions, rights requests, or complaints can be sent to hello@uboros.com. If you are unsatisfied with our response, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (AKI) or your local data-protection supervisory authority.