SBAM Privacy Policy

Version 1.1 | 18 October 2026

1 Who we are and what this policy covers

KUBA S.R.L., Via di Sottomonte 355, 55100 Lucca (LU), Italy, tax code and VAT number 02763370463, REA LU-274112 ("KUBA", "SBAM", "we"), operates https://sbam.ai and https://app.sbam.ai. Contact [email protected] for privacy matters, requests concerning personal data and information about this policy.

This policy covers visitors to our website, people who contact us or apply for access, people referred to us, customer representatives, authorised users and people identified in information processed through SBAM. Our current software service is offered to businesses and professionals in Italy. Operational users must be at least 18.

We act as controller when we determine why and how personal data is processed, as described below. Where we process personal data solely on a business customer's documented instructions, we act as processor or subprocessor under our separate, versioned Data Processing Agreement and its Subprocessor Register. These contractual documents are supplied through a controlled-access customer contracting process before acceptance and remain accessible to the customer afterwards. This public policy remains available to everyone without an account. The purpose of the particular operation determines our role, including in support, diagnostics and security.

2 Information and sources

Account and business information includes name, professional email, company details, user identifiers, workspace membership and roles, authentication information, interface preferences, eligibility and authority declarations, and records of contractual acceptance and optional consent. Google sign-in exchanges the relevant account information, such as email, name and profile picture where supplied, with the identity and authentication services.

Applications, introductions and correspondence may include contact details, professional role, company and store URLs, business requirements, messages and attachments. Our Priority Access application form asks about ecommerce systems, catalogue size and sources, workflows, operational difficulties, proposed use cases, pilot readiness, indicative budget and other business information supplied in open answers. It also provides internal and applicant email notifications. Applying does not subscribe you to marketing or authorise a public case study.

An introducer may supply their own name and contact details and another person's name, professional email, contact category, telephone, website and relevant notes. We identify that third-party source when contacting the referred person. Providing someone else's details is not their consent to marketing. Please share only relevant professional information and tell the person about the introduction.

Service content includes supplier documents, invoices, spreadsheets, photographs, product descriptions, prices, variants, merchant reference documents, instructions, source URLs, integration information and generated results. Business documents and public product pages may incidentally identify sole traders, staff, professional contacts or people appearing in images. Whole pages, images, extracted text and task context can be processed; transmission is not limited to product codes. Do not upload unnecessary personal data, identity documents, full payment-card details, special-category data or criminal-offence data into the standard catalogue workflow.

Billing and operational information includes billing contacts, purchase and payment references, provider/customer identifiers, credit balances and movements, integration identifiers, task/import records, technical events and errors. Payment providers collect payment-method information through their own flows. We receive relevant payment and eligibility signals, including a protected signature derived from a card fingerprint to prevent repeated free-credit claims.

We receive information from you, the customer that authorises your workspace access, connected systems, an introducer, sign-in/payment providers and public pages researched for an instructed catalogue task. Browser and service events also arise during use. Public availability does not remove the protection of personal information.

3 Purposes and legal bases

We use account and business-contact details to authenticate users, administer workspaces and manage our supply relationship. Article 6(1)(b) GDPR applies when the individual is personally our contracting customer, such as a sole trader, or requests steps before entering a contract. For employees and representatives of a company, we rely on our and the customer's legitimate interests in administering the professional relationship under Article 6(1)(f).

We handle enquiries, applications, relevant introductions and support to respond and assess or perform a business relationship. The same distinction applies between the individual's own contractual or pre-contractual request and legitimate interests in relevant professional communication. For an introduction, we consider its context, professional relevance and the person's reasonable expectations; an unsolicited introduction does not establish a pre-contractual request by that person. We provide the required information no later than the first communication and, where Article 14 applies, within its applicable time limits, normally one month after obtaining the information.

Billing, credit accounting, payment administration and necessary service notices support performance and administration of the supply relationship on the bases above. Statutory accounting, tax obligations and legally required disclosures rely on Article 6(1)(c).

For purposes we independently determine, we rely on legitimate interests in protecting accounts and service integrity, investigating faults, preventing abuse of free-credit eligibility and establishing, exercising or defending legal rights. We limit the information and access to what each purpose requires and consider the impact on the people concerned. Customer-specific operations carried out solely on instructions remain subject to the Data Processing Agreement.

With a separate optional opt-in, we send newsletters, offers and commercial updates under Article 6(1)(a). You can withdraw through the unsubscribe facility in a promotional message or by writing to [email protected]. Refusing or withdrawing marketing consent does not affect ordinary service access. Necessary account, security and billing messages are separate from promotions. Analytics and advertising require the separate choices in section 9.

Required fields are necessary for the relevant request, account, purchase or legal obligation. Without them, we may be unable to provide that function. Optional information and privacy choices are identified separately at collection.

4 Customer controlled content

Where a customer determines the purposes of personal data in its materials and connected systems, that customer is controller, or acts for its own controller, and KUBA processes the data on documented instructions. The customer must establish its lawful basis, provide required notices and limit the data supplied to what the task needs. Our separate, versioned Data Processing Agreement and Subprocessor Register specify the processing scope, security duties, authorised processing chain, assistance, transfers and return/deletion arrangements. They are provided through the controlled-access contracting process before the customer accepts them and remain accessible throughout the relationship, including the applicable exit process. Updates follow the Agreement's advance-information and authorisation or objection process; availability of software functionality does not authorise a new recipient.

You may contact [email protected] even if you do not have an SBAM account. We handle requests concerning processing for which we are controller. For data held under another business's instructions, we promptly forward the request to the appropriate controller and assist as required. You may also contact that business directly; doing so first is not a condition of sending a request to us.

5 AI research and connected services

SBAM uses contracted generative AI API services for functions such as extraction, enrichment and generating or editing product media, and a specialist web-search and page-retrieval service for instructed research of public product pages. Where personal data is involved, their use requires the binding processing and transfer arrangements specified in the Data Processing Agreement. An instructed task can involve more than one authorised service for the same purpose. Only the processing chain authorised under the Data Processing Agreement may receive Customer Personal Data. A provider is not authorised merely because it is technically available in the software.

We use customer content to perform the agreed service and documented instructions. That permission does not authorise unrelated training, advertising, resale, evaluation, product development or public case studies. Any additional use must be separately defined and supported by the required agreements and lawful personal-data arrangements before it begins. Optional provider sharing for general model improvement is not authorised by ordinary use of SBAM.

Provider security and abuse monitoring are distinct from general model training. The contracted paid AI services exclude general model training or product improvement using service inputs and outputs under their applicable terms, except for separately authorised optional sharing. Their monitoring rules differ: one normally retains abuse-monitoring data for 55 days and permits authorised human review and limited use for policy-enforcement models; another normally retains standard API abuse-monitoring logs for up to 30 days, subject to applicable exceptions. Some API functions create separately retained application state. The versioned contractual Subprocessor Register identifies the services, monitoring conditions and relevant periods for customer-controlled processing. These periods do not describe every copy held by SBAM or every AI function. We do not offer a general zero-retention, no-human-review or exclusively European-processing assurance.

An additional AI service not listed as authorised in the applicable Data Processing Agreement and Subprocessor Register must not receive Customer Personal Data. Any future addition requires a documented lawful contractual and transfer basis and the advance subprocessor process. Non-personal product information must also remain within the permitted service purpose and confidentiality arrangements.

Cloud infrastructure administration and support can include AI-assisted analysis of technical context containing personal information, such as information within operational logs. This is a distinct administrative flow limited to necessary operation and support under the applicable infrastructure-provider arrangements and its authorised service-provider chain. A contractual restriction on model training without prior written consent does not establish zero retention or exclusively European processing.

Connecting a store permits the configured exchange with that destination. Publishing or exporting may disclose selected information to that store and its users. Disconnecting an integration is not deletion of all files, logs, provider records or backups, and deletion at SBAM cannot recall material already published to an independent destination.

6 Access and recipients

Authorised personnel may access personal data when their assigned duties require it, including administration, support, fault investigation and security. They are subject to confidentiality and appropriate access controls. Workspace members may access company content according to their permissions. Administrative permissions can be broader than ordinary workspace access.

Source and reference files are stored separately from public product media. Product-media and generated catalogue-export URLs may be accessible to anyone who possesses the URL. Customer-directed publication also makes selected material accessible at its destination. Avoid including unnecessary personal or confidential information in public-facing media or exports. Private source documents are not authorised for public disclosure merely because their catalogue result is exported.

The relevant recipient categories are:

• Cloud identity, database and file-storage services in the software infrastructure sector: authentication, database operations, file storage and necessary infrastructure/support processing, as processor or subprocessor for content processed on instructions. The primary database is in Ireland; the contractual chain includes Singapore and international support/service providers, including in the United States. The provider also administers its own business-account relationship separately. Administrative AI processing follows the applicable authorised service-provider chain.
• Managed cloud application and website hosting services in the infrastructure sector: website/app hosting and related technical operations, as processor or subprocessor for instructed hosting subject to binding processing and transfer arrangements and the Data Processing Agreement conditions for customer-controlled content. Core hosting is in Western Europe; the provider is US-based and separate account/operational processing follows its applicable terms.
• Contracted generative AI API services in the cloud software sector: extraction and enrichment of customer-supplied or researched information and generation or editing of product media, under the applicable processing terms. The relevant contracting entities are established in Italy and Ireland; processing and support chains operate internationally, including in the United States. The applicable Register identifies the authorised services and specific contractual chains. OpenAI Ads has a separate role and contract, described in section 9.
• Business email and productivity services in the cloud software sector: KUBA's own account, billing and task-status communications used to administer SBAM, under the applicable service agreements and processing terms. The relevant contracting entity is established in Italy; international processing and support can include the United States. Customer-directed messaging is not included in the standard Service.
• Specialist web-search and page-retrieval services in the software sector, based in the United States: instructed product-page searches and retrieval, subject to the binding processing and transfer arrangements required under the Data Processing Agreement before personal-data processing.
• Hosted business-form services in the software sector, based in the United States: application forms, internal and applicant notifications and the configured transfer of application information to SBAM, as processor for form information supplied on our behalf under binding data-processing and transfer arrangements.
• Transactional email-delivery services in the communications software sector, based in the United States: configured website notification emails, as processor for their content. Messages and records can be stored in the United States; a European sending region does not determine storage location.
• Google provides sign-in under the applicable identity-service arrangements and can have independent purposes for identity/account administration; these are distinct from instructed processing. Google Ireland Limited provides the relevant Google Analytics service as described in section 9. See https://policies.google.com/privacy.
• Stripe Payments Europe, Limited and, where applicable, Stripe Technology Europe, Limited: payments and billing. Stripe acts on instructions for relevant services and as an independent controller for purposes such as payment-network selection, fraud prevention and legal compliance. See https://stripe.com/privacy.
• Shopify and customer-selected stores, platforms or export recipients: the exchanges selected by the customer and relevant platform billing. The European merchant-platform relationship generally involves Shopify International Limited; Shopify Inc. may act as a billing agent, and Partner/API activities follow their applicable Shopify agreement and entity. Their roles follow those functions and agreements; a connected store is not automatically our subprocessor. See https://www.shopify.com/legal/terms and https://www.shopify.com/legal/api-terms.
• Microsoft and OpenAI for optional measurement, under the roles in section 9.

We may disclose the necessary information to professional advisers, courts, competent authorities or other recipients where required by law or justified for a specific legal matter. Contact [email protected] for information about the actual recipients relevant to your personal data, including their identities and the applicable processing and transfer arrangements. These privacy rights are available without an SBAM account or a confidentiality agreement. The separate, versioned Data Processing Agreement and Subprocessor Register proactively identify the chain authorised for customer-controlled content; customers receive them through the controlled-access contracting process before acceptance and retain access afterwards. Restricted contractual access does not limit information or assistance that must be provided to individuals or competent authorities by law.

7 International processing

The primary SBAM database is hosted in Ireland. The core website/app hosting services use Western European infrastructure. These locations do not mean that all processing, support, model inference, logs or recipient access stays in the European Economic Area.

Relevant international destinations include the United States for hosted application forms, transactional email delivery, web search/page retrieval and infrastructure/support chains, and Singapore in the database and storage contractual chain. The generative AI and business email services, Google sign-in and Analytics, Microsoft Clarity, OpenAI Ads, Stripe and their service providers also operate internationally. The applicable recipients and functions determine the actual transfer. The contractual Subprocessor Register identifies the destinations relevant to the authorised customer-content chain; information about the actual recipients and destinations relevant to your personal data is also available through [email protected] without an account or confidentiality agreement.

Where personal data is transferred outside the EEA, the applicable arrangement must rely on an adequacy decision covering that recipient and processing or appropriate Article 46 safeguards, such as the European Commission's standard contractual clauses with the relevant supplementary measures. Reliance on the EU-US Data Privacy Framework requires the relevant recipient and processing to fall within a valid certification; it is not a general authorisation for every US recipient. European primary hosting does not replace these safeguards. Contact [email protected] for information about the safeguards relevant to your data and how to obtain an available copy, subject to necessary lawful confidentiality protection.

8 Retention and deletion

We determine retention separately for each purpose, data class and copy. We delete or irreversibly anonymise information when the relevant need ends, subject to specific lawful retention requirements:

• Account and relationship records remain while needed for an active account or business relationship and for completing the applicable closure/exit process. After that, only records necessary for a residual entitlement, identified legal obligation or specific claim remain under the separate criteria below.
• Applications, enquiries and introductions remain while assessment, the requested response or a relevant continuing business conversation is open. When that process ends, they are deleted unless incorporated into an active customer relationship, covered by a separate valid marketing choice or specifically needed for a legal obligation or identified claim. We do not retain the full application merely to enable unspecified future marketing.
• Customer-controlled content follows the customer's lawful instructions and the Data Processing Agreement. Switching uses the separate transition and retrieval periods in the Terms, including at least 30 calendar days for retrieval after the applicable transition. Billing cancellation alone does not start that window or erase the workspace. Processor-held data is then erased without undue delay, subject to lawful instructions and mandatory requirements.
• The minimum account link, purchased-credit balance and transaction record remain as long as necessary to administer the unused purchased-credit entitlement and outstanding financial effects. Credits do not expire. This does not justify keeping the entire workspace or its source documents. Contact us to separate account erasure from preservation or lawful settlement of that entitlement.
• Accounting records, invoices and relevant commercial documents are generally retained for ten years from the last relevant entry under Article 2220 of the Italian Civil Code, with any longer retention limited to a specific applicable legal requirement, such as unresolved proceedings.
• Support and privacy-request records remain until the matter is resolved; relevant evidence may remain for the applicable legal duty or limitation period where necessary for a specific claim. Unrelated attachments are not retained solely because a correspondence record remains.
• Routine technical records follow the relevant system/provider window. The configured managed-hosting service makes ordinary application logs available for 30 days; that visibility window is not a promise that every physical copy is erased at the same instant. Selected evidence relating to an actual incident may be isolated for its investigation and any resulting legal matter, then removed when that need ends.
• Free-credit eligibility signatures are limited to preventing repeated or abusive claims while the relevant eligibility rule operates and the signature remains necessary to enforce it. We review their continuing necessity; the signature does not authorise retention of the original payment details or complete customer content. You can object under section 10.
• Promotional contacts remain while the optional subscription remains valid and relevant to that purpose. After withdrawal we stop promotion and retain only the minimum suppression/consent evidence necessary to respect the choice and demonstrate compliance while that need continues.

Provider copies have distinct periods. For the contracted generative AI services, standard abuse-monitoring data is normally retained for 55 days for one service and standard API abuse logs for up to 30 days for another, with function-specific application state and applicable exceptions as described in section 5. The website notification email-delivery service's current standard email/log window is 30 days. The hosted application-form service describes deletion from its servers/backups within 45 days following deletion or an applicable request; copies delivered by email or integrations require separate handling. Section 9 explains measurement retention.

Backups are restricted to their recovery purpose and fixed expiry/overwrite cycle. They are not an indefinite retention exception. The configured database service provides a rolling daily-backup window; database backup coverage does not include every separately stored file. Where a copy cannot reasonably be erased individually, it is isolated from ordinary use until its bounded expiry, and relevant erasure/restriction instructions must be reapplied before restoration becomes available for ordinary processing. Restoring a backup does not reactivate a closed workspace or its jobs. We identify remaining copies and their applicable expiry when handling a deletion request. Disconnecting a store or deleting a database row does not establish deletion of every related copy.

9 Cookies analytics and advertising

Necessary authentication, security and interface functions operate for the requested service. Optional Analytics and Advertising each require a separate prior choice. We start no optional purpose before consent, after refusal or after withdrawal, including cookieless measurement. Refusing either purpose does not prevent ordinary account, catalogue, application or payment functions.

Google Analytics 4 operates only after Analytics consent. It processes page views and interactions, browser/device and connection information, approximate location and pseudonymous identifiers to understand website use. Google acts as processor for the relevant Analytics service. Google products-and-services sharing, Google Signals and collection of user-provided data are not enabled in the configuration described here; modelling/insights, technical support and business recommendations are enabled under the applicable settings. SBAM does not grant Google advertising storage or advertising personalisation through its Analytics consent. Current retention settings distinguish event data at two months and user data at fourteen months, with renewal on new activity. Standard aggregated reports are generally not subject to those settings. Browser identifiers include _ga and _ga_23T8QH4FL5.

Microsoft Clarity operates only when BOTH Analytics and Advertising consent are present. It analyses navigation and interactions through session replay, clicks, scrolling, heatmaps, page/device information and identifiers. Microsoft processes Clarity information as an independent controller, including its own product, advertising and profiling purposes under the Clarity terms. Unconnected advertising integrations do not remove those purposes. Balanced masking is configured; masking is not a guarantee that every personal or confidential item is excluded. Ordinary playback data is retained for 30 days; click/heatmap information and tagged or favourite sessions can remain for nine months under Microsoft's current retention description. Clarity may use identifiers including _clck, _clsk, CLID, MUID, MR, ANONCHK and SM according to browser/consent conditions. See https://privacy.microsoft.com/privacystatement and https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies.

OpenAI Ads Pixel and any related server conversion flow operate only after Advertising consent. They measure advertising visits and application conversions, using event, page and attribution information, identifiers and relevant browser/connection context. Our website may retrieve the corresponding full application-form response to identify the email fields needed for an authorised conversion, although the outgoing conversion does not include the full application. A server conversion may include a SHA-256 hash of an email, attribution information, IP address and user agent. Hashing does not make the information anonymous. OpenAI generally acts as an independent controller for these conversion tools, with processor treatment only in the specifically defined Restricted Processing cases. Its Ads terms and privacy arrangements are separate from its generative API; API no-training or 30-day-log terms are not a general promise for Ads. Identifiers include __obref and __oaiq_consent, and oppref/__oppref attribution where supplied or used by the tools. See https://openai.com/policies/privacy-policy/ and https://openai.com/policies/ad-tools-dpa/.

Our language preference uses PARAGLIDE_LOCALE. The authentication system stores the information needed to maintain an authorised session, and browser preference storage records your separate privacy choices and their version/time. The Privacy controls provide the current storage inventory, purpose, provider and browser lifetime for necessary and optional identifiers. The lifetime of a browser identifier differs from the retention of events already transmitted to a provider.

You can reopen Privacy controls on the website and app to change either choice. Choices apply to the browser and service for which they are recorded; a different browser/device may require a separate choice. Withdrawal stops new optional collection and transmission for the affected purpose, including queued events and any related server conversion. Withdrawal of either purpose also stops Clarity. It does not invalidate earlier lawful consent-based processing or recall data already transmitted. Optional browser identifiers under our control are removed or disabled as applicable; a record of your refusal may remain. You can also delete cookies and browser storage using your browser settings. While a supported Global Privacy Control or Do Not Track signal is detected by our Privacy controls, optional Analytics and Advertising remain disabled for that browser, overriding an earlier stored acceptance. An optional-purpose selection does not override that signal while it remains present.

10 Rights and changes

Depending on the processing and applicable conditions, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing; and withdraw consent for future consent-based processing. You may object at any time to direct marketing. Contact [email protected]. We use proportionate checks of identity and authority; an identity-document copy is not a routine requirement.

We respond within GDPR time limits, normally one month. Any permitted extension must be explained within the initial period. You may complain to the Italian Garante per la protezione dei dati personali, https://www.garanteprivacy.it, or another competent supervisory authority.

AI generates catalogue results and automated systems administer credits, metering and eligibility. These automations concern the instructed catalogue operation and service billing. You may ask us to review an automated eligibility or billing decision, explain your position and contest the outcome; credit/account decisions remain subject to the applicable contract and legal remedies. Where Article 22 GDPR applies, we provide the required information and safeguards, including human intervention where required. An automation must not be introduced for a solely automated decision about a person with legal or similarly significant effects without the required lawful basis, information and safeguards.

We identify the version of this policy and communicate material changes appropriately through the website, app or relevant contact channel. A revised policy does not itself provide consent for a new optional purpose. Copies and privacy information relevant to a previous period can be requested at [email protected].