Privacy policy

The short version

What you capture is yours. We store it so Ubikron works, and for nothing else.
We don't sell data, show ads or use what you capture for anything but running Ubikron for you.
You can switch recording off with one click, and delete what you captured yourself, permanently.
On a private server, none of it reaches us.
This website uses no cookies of ours.

Who we are

Vortimo (Pty) Ltd, registration number 2018/630618/07, Herbert Baker Street, Pretoria, South Africa. Our information officer is Roelof Temmingh. For anything in this policy, email support@ubikron.com.

What you capture with the extension

While recording is on, the extension sends the pages you visit to your Ubikron server: the address, title, text, a screenshot and the time. It also sends what you create: saved copies of pages, clippings, notes, tags, graphs, reports, enrichment results and AI chats.

Recording switches off with one click, and the widget always shows whether it's on.
Gmail, Google Docs and other obvious sites aren't recorded by default, and you can add your own.
You can delete anything you captured, or your whole account and its data, in Ubikron. Deleting is permanent.

On our public server, this is stored in the United States, on Akamai. We use it only to run Ubikron for you. We can technically access it, but we don't, except to fix a problem you ask us to fix, or where the law makes us. On a private server it stays on your own infrastructure and never reaches us.

What you capture will often include information about other people. You decide what's collected and why, so for that information you're responsible under POPIA, GDPR and similar laws. We store it on your behalf.

Enrichments, Mimic and AI

Enrichments: when you run one, the item you selected, say an email address, goes through Mimic to that data source. The response is stored with your project, so you can search it and use it again.
Mimic: stores the APIs you set up, with the keys for those services, under your profile, and passes requests and responses through. On the public Mimic server, that happens on our server.
AI: uses your own API key, with the provider you choose, never ours. Your requests, and what the AI needs from your project, go through your Ubikron server to that provider, under your key and their terms. Your API key is stored with your account, like the rest of your account details, and your AI chats are stored with your project.

Your account and payments

For your account, we keep your email address, login, license details and the API keys you add for AI and Mimic. Payments are handled by Paddle, our reseller. Paddle collects your payment details. We receive your name, email address, country and what you bought, never your card number.

Logs

Our servers keep errors and warnings for 90 days, so we can find and fix problems.

This website

No cookies of ours. Page counts come from Plausible, which doesn't use cookies or identify you.
YouTube videos load from YouTube's no-cookie domain, and only when you press play.
The pricing and checkout pages load Paddle, which may set what it needs to take a payment.
The site runs on Cloudflare, which handles your IP address to deliver and protect it.
When you use the contact or quote form, we receive what you type in, by email.

Why we're allowed to use it

To provide what you signed up for (a contract): your account, your license, payments, and storing what you capture.
Because we have a legitimate interest, weighed against yours: error logs, keeping the service secure, page counts, and answering your emails.
Because the law requires it: billing records.

Who we share with

We use these companies to run Ubikron, and they handle data only to provide their service to us:

Akamai: hosts our public servers, in the United States.
Cloudflare: runs this website and its forms.
Paddle: takes payments and handles invoices and tax.
Brevo: sends the emails from our contact and quote forms.
Plausible: counts page views, without personal data.

Beyond that, we share data only when the law requires it, for example a valid court order. If Vortimo is ever sold, this policy goes with it.

Some of these companies are outside your country, so using Ubikron can mean your data is transferred, for example to the United States. We only use providers that protect personal information to a standard similar to POPIA. Where GDPR applies, transfers rely on the safeguards in our providers' data processing terms, such as the EU's standard contractual clauses.

How long we keep it

What you capture, and your account: until you delete it, or a year after your license runs out if you don't get a new one.
Error logs: 90 days.
Billing records: five years, because tax law requires it.
Emails to us: as long as we need them to help you.

Security

On our public server, your data is kept in two places:

Files, such as screenshots and saved pages, go into private S3 storage. Nobody can open them without a signed link, which only Ubikron hands out and which expires after a short time.
The search index and the rest of your data are on the server itself. The hosting platform encrypts the server's disk. That protects the data if a disk leaves the data centre, but not from someone who breaks into the running server.

We take reasonable steps to protect your data, but no server on the internet is perfectly safe. For sensitive work, use a private server.

If there's a breach that puts your data at risk, we'll tell you, and the Information Regulator, as soon as we reasonably can.

Your rights

You can ask to see the personal information we hold about you, correct it, delete it, get a copy to take elsewhere, or object to how we use it. Email support@ubikron.com and we'll answer within 30 days. Most of it you can also do yourself, in Ubikron.

If you're not happy with our answer, you can complain to South Africa's Information Regulator, or to the data protection authority where you live.

The Chrome extension

The extension collects what's described above only to provide Ubikron's single purpose: recording and organising your research. We don't sell this data, use it for advertising or credit decisions, or let people read it, except with your permission, for security, or where the law requires.

Children

Ubikron is for professionals, and not for anyone under 18.

Changes

When we change this policy, we update the date at the top. If a change matters, we'll email you before it takes effect.