Privacy Policy
Version 2026-10-22 · in force from 22 October 2026
1. Who is responsible
Sergei Vronskii, a sole trader in the United Kingdom trading as "KB.PUB" ("we"), is the controller of the personal data described here. Contact for anything about your data: privacy@kb.pub. Our postal address is available on request and will be published on this page.
When a dental practice or another business uses our Clinic Website service, the personal data of visitors to that business's site (messages to the assistant, names, contact details) is processed by us on behalf of that business. The business is the controller of that data and its own privacy notice applies; we act as its processor under our Data Processing Addendum.
2. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis (UK GDPR) |
|---|---|---|
| Account: e-mail address, name, password (stored only as a hash), the businesses you manage, which edition of our terms you accepted and when | To run your account and prove what you agreed to | Contract; legal obligation |
| What you create and use: résumés and the job descriptions you paste into the résumé assistant, your course progress and test results, recipes you generate, listings you publish, and what you type into AI features | To provide the feature you asked for; text you submit to an AI feature is sent to the AI model provider to produce the result | Contract |
| Billing: plan, payment status, amount, the e-mail used at checkout. Card details go directly to Stripe; we never receive the full card number | To take payment, keep accounting records and handle refunds | Contract; legal obligation |
| Business contacts for outreach: name, practice, business e-mail and other details a practice publishes on its own website, and the demo we prepared from them | To offer that business a demo of our service | Legitimate interests (offering a relevant service to businesses); you can object at any time |
| Opt-outs: the e-mail address of anyone who asked us not to write again | So that we never write to them again | Legal obligation; legitimate interests |
| kb.pub visitors: pages viewed, device and browser data, approximate location from the IP address, through cookies and similar technologies | To run and secure the site, understand how it is used and, on kb.pub, show advertising | Legitimate interests for necessary and security cookies; your consent for analytics and advertising cookies |
| Messages to us: what you write to contact@, legal@ or privacy@ kb.pub | To answer you | Legitimate interests |
We do not sell personal data, and we do not use the messages that visitors send to a business's assistant for our own marketing.
3. Cookies
kb.pub uses cookies that are necessary (sign-in, language and theme, the cookie choice itself, and a short-lived security cookie that distinguishes browsers from automated scrapers) and, only if you agree in the cookie banner, analytics and advertising cookies from Google Analytics and Google AdSense. You can change your choice at any time in the banner or in your browser. Sites we run for businesses (for example a practice's site on a kb.pub subdomain or on its own domain) use only necessary cookies and show no advertising.
4. Who we share data with
We use these service providers ("sub-processors"), each only for the purpose shown:
- Our hosting provider: servers and backups in a data centre in Montreal, Canada;
- Google: business e-mail (Google Workspace); the Gemini AI model, which writes the assistant's replies and the results of our other AI features (such as résumés and recipes) from what you or a visitor submit; Google Analytics and AdSense on kb.pub (with your consent);
- Stripe: payments and subscriptions;
- Resend: e-mails the platform sends you (sign-in links, receipts, notices);
- Telegram: notifications about new booking requests and reports, sent to the business (or to us for our own notices);
- Cloudflare: domain name services for some of our domains.
We may also disclose data where the law requires it, or to protect our rights or the safety of others.
5. International transfers
Our servers are in Canada, which the UK recognises as providing adequate protection for personal data transferred to organisations covered by Canada's federal privacy law. Some providers listed above (such as Google, Stripe, Resend and Cloudflare) may process data in the United States or elsewhere; we rely on the safeguards they offer for such transfers, such as the UK's International Data Transfer Addendum to the EU standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework.
6. How long we keep data
- Demos: deleted 30 days after the demo expires.
- Conversations with an assistant and booking requests: kept for 12 months, then deleted or anonymised, unless the business deletes them earlier.
- Accounts: while the account exists; deleted within 30 days after it is closed.
- Billing records: as long as tax law requires (in the UK, at least five years after the relevant tax return deadline).
- Opt-out list: for as long as we contact businesses, so that we keep respecting the request.
- Backups: overwritten on a rolling basis.
7. Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use (including any use for outreach), and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Write to privacy@kb.pub; we reply within one month. If you live in a US state with its own privacy law, you can exercise the rights that law gives you in the same way.
If you are a visitor of a business's site, please contact that business first: it decides how your data is used and we will help it answer you.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office: ico.org.uk.
8. Security
Access to data is limited by role and by business account, connections are encrypted (HTTPS), and backups are kept. No method of storage or transmission is completely secure, and we do not claim any security certification.
9. Children
Our services are for businesses and adults. They are not directed at children, and you must be at least 18 to create an account.
10. Changes to this policy
Every edition is published on this page with its version and date; earlier editions stay available in the change log. Material changes are announced by e-mail at least 30 days before they take effect.