Privacy policy and telemetry standards.

Scope and overview.

This privacy policy governs data practices across Koba HQ ("Koba", "we", "our", or "us"), encompassing:

• Marketing Website: Our public informational site at kobahq.com.
• Direct Communications: Inquiries submitted via email to hello@kobahq.com.
• Redirection Infrastructure: Our dynamic HTTP routing endpoints accessible via https://app.kobahq.com/r/{code}.
• Client Platforms: The Koba Command telemetry dashboard and custom software modules at app.kobahq.com.

We are committed to operating lean, secure, and privacy-preserving systems that collect only the technical telemetry strictly required to deliver fast, dependable service.

Marketing website visitors and communications.

When you browse kobahq.com, our servers deliver pre-rendered, lightweight static pages. We do not load third-party advertising cookies, behavioral tracking pixels, or invasive surveillance scripts. Standard web server logs may temporarily record connection details (such as requesting IP address and requested path) solely to maintain security, mitigate denial-of-service threats, and diagnose server errors.

When you send an inquiry to hello@kobahq.com, we retain your email address, message body, and supplied contact information exclusively to review your request, respond to your inquiry, and fulfill requested engineering or hardware support. We do not subscribe your contact information to automated third-party marketing lists.

Redirector infrastructure and tap telemetry.

Our physical Koba Tap cards contain NTAG213 chips encoded with unique redirect URLs pointing to our dynamic redirection service. When a retail customer taps a card with their smartphone, our servers process an ephemeral HTTP 302 redirection to send the user directly to the business's official Google review destination.

We engineered this redirection architecture with strict privacy guarantees:

• Zero Retail Customer PII: Koba does not collect, capture, or store the personal identity, name, phone number, Google account credentials, or payment details of the retail customer tapping the card.
• Ephemeral Processing: Redirections resolve immediately without presenting intermediate tracking interstitials or requiring app downloads.
• Aggregated Operational Telemetry: To calculate tap volume in Koba Command and detect hardware issues, our workers record non-blocking operational data: timestamp of the tap event, general user-agent family (to verify mobile browser compatibility), and coarse network origin. This telemetry is decoupled from individual consumer identities.

Command Center and business data isolation.

For merchants utilizing Koba Command or our custom business software, account information is stored in secure, multi-tenant partitioned databases. We access your Google Business Profile data strictly via official Google APIs following explicit merchant authorization, solely to synchronize publicly posted reviews, compute review velocity, and assist in drafting public responses.

Merchant account credentials, private operational workflows, customer intake records, and business metrics are never sold, rented, monetized, or shared with third-party advertising networks or data aggregators. Your operational records belong entirely to your business.

Data security, retention, and your rights.

All data transmitted across our infrastructure is encrypted in transit using modern Transport Layer Security (TLS 1.3) protocols. Data stored within our production databases is protected with encryption at rest, stringent firewall policies, and strict access controls restricted to authorized engineering personnel.

We retain operational telemetry and merchant account records only for as long as necessary to fulfill active business engagements, maintain historical analytics for account owners, and comply with legal requirements. Verified account holders may request a copy of their stored operational records or request complete deletion of their account data at any time by contacting hello@kobahq.com.