<!-- Version 2.0 of the website privacy policy. Replaces the 2021 general Zondax text that shipped as 1.0, which described a newsletter and server logs and nothing else. Drafting position, deliberate: disclose what Article 13 GDPR and the Swiss FADP require and take on nothing beyond that. Recipients are categories in the policy and named on the mutable /legal/providers page, so a provider swap is not a policy change; retention is criteria, not periods; no voluntary commitments. Preconditions before merging — the policy below is only true once these hold: 1. Verify the GTM container defaults every non-essential consent signal to "denied" and that no measurement/marketing tag fires before consent (container-side config; the repo cannot prove it). 2. Gate the signed-in hashed-email dataLayer push (clerk-user-bridge.tsx) on marketing consent — today it fires unconditionally. 3. Wire the cookie preferences dialog (it exists but is unreachable) so consent can actually be withdrawn on the Site. 4. The cookies policy page is still Zondax boilerplate and should be rewritten to name the actual cookies. Not legal advice: have counsel review before merging. -->

Kunobi Website Privacy Policy

Effective Date: 25 August 2026

Version: 2.0

Controller: Zondax AG, Dammstrasse 16, 6300 Zug, Switzerland

This policy covers the public Kunobi websites at kunobi.com and kunobi.ninja (the "Site"). The Kunobi desktop application and Zondax Ping are covered by their own policies, at https://kunobi.com/privacy/desktop and https://kunobi.com/privacy/ping.

What changed in version 2.0. Version 1.0 was a general Zondax policy dating from 2021 and did not describe this Site. This version describes the Site as it operates today. Version 1.0 remains permanently available at https://kunobi.com/privacy/web/1.0.

1. What we process, and why

• Visiting. The data every web request carries — IP address, requested page, referrer, browser and operating system, time — is processed in the server logs of our hosting and delivery providers, and in our own operational monitoring, to deliver pages and keep the Site secure and available. Legal basis: legitimate interest, Article 6(1)(f) GDPR.
• Measurement and marketing. The Site uses Google Tag Manager with Google Consent Mode. Which measurement and marketing tags run, and what they may read or store on your device, follows the choices you make in the consent banner; without your consent, no measurement or marketing processing takes place. Legal basis: consent, Article 6(1)(a) GDPR, withdrawable at any time with effect for the future. Cookies and similar storage are described in the cookies policy.
• Signing in. Accounts are operated by our identity provider. If you sign in, we receive your email address, name, username and profile picture, and process them to operate your account, your subscription and entitlements, and team features. If you invite someone to a team, their email address is processed to deliver and manage that invitation. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• Paying. Checkout and billing run on our payment provider's own pages; your card details never touch the Site. After a purchase we receive confirmation data — such as the email address used and the amount — to show you the result and manage your plan. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• Newsletter. The email address you subscribe with is processed to send you the newsletter, until you unsubscribe; every issue carries an unsubscribe link. Legal basis: consent, Article 6(1)(a) GDPR.
• Writing to us. What you submit through the contact or feedback forms — including, for feedback sent from the desktop application, the diagnostic context attached to it — is processed to handle your message. Legal basis: legitimate interest, Article 6(1)(f) GDPR.
• Anti-abuse. Public forms are protected by an anti-bot verification that processes your IP address and browser characteristics. Legal basis: legitimate interest, Article 6(1)(f) GDPR.
• Video and downloads. Embedded videos and software downloads are delivered directly by content delivery providers, which receive your IP address and request data in order to serve you. Legal basis: legitimate interest, Article 6(1)(f) GDPR.

Zondax AG is a Swiss company; the Swiss Federal Act on Data Protection applies to this processing alongside the GDPR.

2. Recipients

Personal data is processed on our behalf by service providers, each bound by data protection obligations: hosting, content delivery and anti-abuse, identity, payment processing, email delivery, operational monitoring and — only per your consent — measurement and marketing. The current list of providers and their locations is maintained at https://kunobi.com/legal/providers. We do not sell personal data. Beyond these providers, personal data is disclosed only where the law requires it.

3. Transfers

Some of these providers process data outside Switzerland and the EEA. Such transfers rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, as recognised for transfers from Switzerland.

4. Retention

Personal data is kept no longer than the purpose it was processed for requires, unless a statutory retention duty applies. Account data is kept while your account exists; newsletter subscriptions until you unsubscribe; logs and monitoring data under the retention settings of the respective provider.

5. Your rights

Subject to the conditions of the GDPR and the FADP, you can request access to your personal data and a copy of it, its correction or deletion, restriction of its processing, and a portable copy; you can object to processing based on legitimate interest; and you can withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Requests go to dataprotection@zondax.ch. You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner, in the EEA the authority of your place of residence or work.

6. Automated decision-making

The Site makes no automated decisions producing legal or similarly significant effects about you.

7. Changes

The current version of this policy is always available at https://kunobi.com/privacy/web. Every published version, this one included, remains permanently available at its own versioned address with its version number and effective date.

8. Contact

Zondax AG Dammstrasse 16 6300 Zug Switzerland

Email: dataprotection@zondax.ch