TL;DR

- Kubera does not sell your personal data.
- Kubera does not share your financial portfolio data for advertising.
- Kubera uses your data to provide and improve the service.
- Kubera does not own your data.

Terms of Service

Last updated: Mar 18, 2026

Please read these Terms and Conditions carefully before using Our Service.

Interpretation and Definitions

The words of which the initial letter is capitalized have meanings defined under the following conditions.

The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of these Terms and Conditions:

  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
  • Account means a unique account created for You to access our Service or parts of our Service.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Kubera Apps, Inc., 251 Little Falls Drive, Wilmington, New Castle County, DE 19808.
  • Content refers to content such as text, images, or other information that can be posted, uploaded, linked to or otherwise made available by You, regardless of the form of that content.
  • Country refers to: Delaware, United States
  • Feedback means feedback, innovations or suggestions sent by You regarding the attributes, performance or features of our Service.
  • Promotions refer to contests, sweepstakes or other promotions offered through the Service.
  • Service refers to the Kubera portfolio tracking and related applications, websites, features, content, and services made available by the Company.
  • Subscriptions refer to the services or access to the Service offered on a subscription basis by the Company to You.
  • Trial refers to a limited period of time a user can use the product before purchasing a Subscription, whether free or paid.
  • Terms and Conditions (also referred to as “Terms”) mean these Terms and Conditions that form the entire agreement between You and the Company regarding the use of the Service.
  • Third-party Services means any services, content, data, software, applications, websites, institutions, custodians, brokerages, exchanges, wallets, data aggregators, AI assistants, or other third parties that may be displayed, linked, connected to, integrated with, or made available through the Service.
  • Website refers to the Kubera website, accessible from https://www.kubera.com
  • You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Financial Advice Disclaimer

Kubera isn’t a registered financial advisor or broker-dealer and doesn’t provide personalized financial, investment, tax, legal, accounting, or other professional advice. Our information is intended for informational purposes only and should not be considered specific advice, recommendations, solicitations, or endorsements. Nothing in the Service constitutes an offer to sell or a solicitation of an offer to buy any security or financial product. Your decisions should be based on your own judgment, risk tolerance, and financial situation, and where appropriate, advice from qualified professionals.

Acknowledgement

These are the Terms and Conditions governing the use of this Service and the agreement that operates between You and the Company. These Terms and Conditions set out the rights and obligations of all users regarding the use of the Service.

Your access to and use of the Service is conditioned on Your acceptance of and compliance with these Terms and Conditions. These Terms and Conditions apply to all visitors, users and others who access or use the Service.

By accessing or using the Service You agree to be bound by these Terms and Conditions. If You disagree with any part of these Terms and Conditions, You may not access the Service.

Your access to and use of the Service is also conditioned on Your acceptance of and compliance with the Privacy Policy of the Company. Please read Our Privacy Policy carefully before using Our Service.

If You are using the Service on behalf of an entity, You represent and warrant that You have authority to bind that entity to these Terms.

You must be at least 18 years of age, or the age of majority in your jurisdiction if higher, to use the Service.

Electronic Communications

You agree that We may provide disclosures, notices, agreements, and other communications to You electronically, including by posting them in the Service, on the Website, or by emailing the email address associated with Your Account. You are responsible for keeping Your contact information current. Electronic communications satisfy any legal requirement that such communications be in writing.

Subscriptions

Subscription period

The Service or some parts of the Service are available only with a paid Subscription. You will be billed in advance on a recurring and periodic basis (monthly or annually), depending on the type of Subscription plan You select when purchasing the Subscription.

At the end of each period, Your Subscription will automatically renew under the same conditions unless You cancel it or the Company cancels it.

Subscription cancellations

You may cancel Your Subscription renewal either through Your Account settings page or by contacting the Company.

You will not receive a refund for the fees You already paid for Your current Subscription period, and You will be able to access the Service until the end of Your current Subscription period.

Billing

You shall provide the Company with accurate and complete billing information including full name, address, state, zip code, telephone number, and valid payment method information.

Should automatic billing fail to occur for any reason, the Company may issue an electronic invoice indicating that You must proceed manually, within a stated deadline, with the full payment corresponding to the billing period as indicated on the invoice.

You authorize Us and Our payment processors to charge all applicable fees, taxes, and other charges to Your selected payment method.

Fee Changes

The Company, in its sole discretion and at any time, may modify the Subscription fees. Any Subscription fee change will become effective at the end of the then-current Subscription period.

The Company will provide You with reasonable prior notice of any material change in Subscription fees to give You an opportunity to terminate Your Subscription before such change becomes effective.

Your continued use of the Service after the Subscription fee change comes into effect constitutes Your agreement to pay the modified Subscription fee amount.

Refunds

Except when required by law, paid Subscription fees are non-refundable.

Certain refund requests for Subscriptions may be considered by the Company on a case-by-case basis and granted at the sole discretion of the Company.

Except as required by law, promotional pricing, credits, and discounts have no cash value, are non-transferable, may be revoked if issued in error or abused, and may expire.

Trial

The Company may, at its sole discretion, offer a trial period. Trial terms, duration, and any applicable fee will be presented to You at the time of sign-up and are part of these Terms.

If a fee applies to the trial, You will be charged that fee at the time stated in the trial sign-up flow. If no fee applies, no charge will occur until You actively select and confirm a paid Subscription.

The Subscription does not automatically start after the trial unless expressly stated at the time of sign-up. You may choose a paid Subscription at any point during Your trial.

If You have any credits in Your account, these may be applied as a discount when Your card is charged for a Subscription.

If You decide not to subscribe, certain connections, integrations, shared access, and related Service functionality may be severed, disabled, or deleted after the trial period.

At any time and without notice, the Company reserves the right to modify, limit, or cancel any Trial offer.

Promotions

Any Promotions made available through the Service may be governed by rules that are separate from these Terms.

If You participate in any Promotions, please review the applicable rules as well as Our Privacy Policy. If the rules for a Promotion conflict with these Terms, the Promotion rules will apply.

User Accounts

When You create an account with Us, You must provide Us information that is accurate, complete, and current at all times. Failure to do so constitutes a breach of the Terms, which may result in immediate suspension or termination of Your account.

You are responsible for safeguarding the password that You use to access the Service and for any activities or actions under Your password, whether Your password is with Our Service or a Third-party Service.

You agree not to disclose Your password to any third party. You must notify Us immediately upon becoming aware of any breach of security or unauthorized use of Your account.

You may not use as a username the name of another person or entity that is not lawfully available for use, a name or trademark subject to rights of another person or entity without appropriate authorization, or a name that is otherwise offensive, vulgar, or obscene.

You may connect authorized third-party applications or AI assistants to your Kubera account. You are responsible for all actions these tools perform. Kubera is not liable for errors, data inaccuracies, losses, or unintended changes resulting from their use. Access can be revoked at any time, and Kubera may limit or terminate access if abused or posing a security risk. You are responsible for securing any API credentials and for compliance with applicable laws when using these tools.

You are responsible for all activity occurring under Your Account, whether or not authorized by You, to the maximum extent permitted by law.

Acceptable Use

You may not, and may not permit any third party to:

  • use the Service for any unlawful, fraudulent, deceptive, or misleading purpose;
  • copy, reproduce, modify, create derivative works of, frame, mirror, republish, download, scrape, crawl, harvest, or otherwise extract data or content from the Service except as expressly permitted by the Service;
  • reverse engineer, decompile, disassemble, decode, or attempt to derive source code, trade secrets, or underlying ideas or algorithms of the Service, except to the limited extent such restriction is prohibited by law;
  • interfere with, disrupt, degrade, or compromise the integrity, performance, or security of the Service;
  • bypass or attempt to bypass any rate limits, access controls, security protections, or usage restrictions;
  • use any robot, spider, crawler, scraper, or automated means to access the Service except through expressly authorized features or interfaces;
  • resell, lease, sublicense, timeshare, or commercially exploit the Service except as expressly authorized in writing by the Company; or
  • use the Service in a manner that imposes unreasonable or disproportionate load on the Service or related systems.

We may investigate violations of these Terms and may suspend, restrict, or terminate access to the Service at any time, with or without notice.

Fair Usage Policy

Kubera is committed to providing a seamless and efficient experience for managing and tracking your financial portfolios. To ensure optimal performance and data accuracy, we have established the following Fair Usage Policy as part of our Terms and Conditions:

Unique Connections for Bank and Brokerage Logins

  • Users are allowed to add multiple connections from the same bank or brokerage, provided they use different login credentials (e.g., personal and business accounts, or accounts belonging to family members).
  • Duplicate logins—where the same bank or brokerage login is added more than once—are not permitted and can lead to data discrepancies and synchronization issues.
  • Kubera’s platform is designed to handle each bank or brokerage login as a unique instance. Adding the same login more than once can disrupt the accuracy and efficiency of the Service.

Recommended Practices

  • When managing multiple accounts from the same institution, use separate logins for each account type (e.g., personal vs.business) instead of duplicating the same login credentials.
  • Organize your financial accounts into distinct portfolios based on their purpose or ownership, without duplicating the same login across multiple portfolios.

Handling and Resolution of Issues

  • Errors or discrepancies arising from the use of duplicate logins across multiple portfolios may not be resolvable by Kubera’s support team.
  • To maintain data accuracy and avoid synchronization issues, users are advised to remove any duplicate logins and ensure that each login is only used once within Kubera.

Account Limitations

  • Kubera reserves the right to monitor, limit, suspend, or restrict usage patterns that, in Our sole discretion, are excessive, abusive, or harmful to the Service or other users.

Violation of Fair Usage

  • Violations of this Fair Usage Policy may result in restricted access to certain features or, in extreme cases, suspension of the account.

By adhering to this Fair Usage Policy, users can ensure the smooth functioning of their financial tracking and management experience with Kubera.

Content

Your Right to Post Content

Our Service allows You to post Content. You are responsible for the Content that You post to the Service, including its legality, reliability, and appropriateness.

You represent and warrant that: (i) the Content is Yours or You have the right to use it, and (ii) the posting of Your Content on or through the Service does not violate the rights of any person.

As between You and the Company, You retain ownership of Your Content. You grant the Company a worldwide, non-exclusive, royalty-free license to host, store, reproduce, process, transmit, display, perform, modify, and use Your Content solely as necessary to operate, provide, maintain, improve, secure, support, and enforce the Service and these Terms.

You acknowledge that the Service may use third-party providers and infrastructure in providing the Service, and the foregoing license includes the right to permit such providers to process Content on Our behalf.

Content Restrictions

The Company is not responsible for the content of the Service’s users. You expressly understand and agree that You are solely responsible for the Content and for all activity that occurs under Your account.

You may not transmit any Content that is unlawful, offensive, upsetting, intended to disgust, threatening, libelous, defamatory, obscene or otherwise objectionable. Examples of such objectionable Content include, but are not limited to, the following:

  • Unlawful or promoting unlawful activity.
  • Defamatory, discriminatory, or mean-spirited content, including references or commentary about religion, race, sexual orientation, gender, national/ethnic origin, or other targeted groups.
  • Spam, machine– or randomly–generated, constituting unauthorized or unsolicited advertising, chain letters, any other form of unauthorized solicitation, or any form of lottery or gambling.
  • Containing or installing any viruses, worms, malware, trojan horses, or other content that is designed or intended to disrupt, damage, or limit the functioning of any software, hardware or telecommunications equipment or to damage or obtain unauthorized access to any data or other information of a third person.
  • Infringing on any proprietary rights of any party, including patent, trademark, trade secret, copyright, right of publicity or other rights.
  • Impersonating any person or entity including the Company and its employees or representatives.
  • Violating the privacy of any third person.
  • False information and features.

The Company reserves the right, but not the obligation, to, in its sole discretion, determine whether or not any Content is appropriate and complies with these Terms, refuse or remove this Content. The Company further reserves the right to make formatting and edits and change the manner of any Content. The Company can also limit or revoke the use of the Service if You post such objectionable Content.

As the Company cannot control all content posted by users and/or third parties on the Service, you agree to use the Service at your own risk. You understand that by using the Service You may be exposed to content that You may find offensive, indecent, incorrect or objectionable, and You agree that under no circumstances will the Company be liable in any way for any content, including any errors or omissions in any content, or any loss or damage of any kind incurred as a result of your use of any content.

Content Backups

Although regular backups of Content may be performed, the Company does not guarantee there will be no loss or corruption of data.

Corrupt or invalid backup points may be caused by, without limitation, Content that is corrupted prior to being backed up or that changes during the time a backup is performed.

The Company will provide support and attempt to troubleshoot any known or discovered issues that may affect the backups of Content. But You acknowledge that the Company has no liability related to the integrity of Content or the failure to successfully restore Content to a usable state.

You agree to maintain a complete and accurate copy of any Content in a location independent of the Service.

Third-Party Services and Data

The Service may depend on or interoperate with Third-party Services. The availability, accuracy, completeness, timeliness, formatting, and continued availability of Third-party Services and third-party data are outside Our control.

We do not endorse, control, or assume responsibility for any Third-party Services or third-party content, data, products, or services. We may add, remove, suspend, or discontinue any Third-party Service integration at any time, without liability.

Account balances, holdings, transactions, valuations, market prices, cost basis, and similar information shown in the Service may be delayed, estimated, incomplete, or inaccurate. You are responsible for reviewing and confirming all such information independently before making any financial, tax, legal, or other decision.

Beta Features

From time to time, We may offer beta, preview, early access, or experimental features. Such features are provided “as is,” may be modified or discontinued at any time without notice, and may be subject to additional terms. We have no obligation to provide support for beta features and no liability arising from Your use of them.

Copyright Policy

Intellectual Property Infringement

We respect the intellectual property rights of others. It is Our policy to respond to any claim that Content posted on the Service infringes a copyright or other intellectual property right of any person.

If You are a copyright owner, or authorized on behalf of one, and You believe that the copyrighted work has been copied in a way that constitutes copyright infringement taking place through the Service, You must submit Your notice in writing to the attention of our copyright agent via email at hello@kubera.com and include a detailed description of the alleged infringement.

You may be held accountable for damages (including costs and attorneys’ fees) for misrepresenting that any Content is infringing Your copyright.

DMCA Notice and DMCA Procedure for Copyright Infringement Claims

You may submit a notification pursuant to the Digital Millennium Copyright Act (DMCA) by providing our Copyright Agent with the following information in writing (see 17 U.S.C. 512(c)(3)):

  • An electronic or physical signature of the person authorized to act on behalf of the owner of the copyright’s interest.
  • A description of the copyrighted work that You claim has been infringed, including the URL of the location where the copyrighted work exists or a copy of the copyrighted work.
  • Identification of the URL or other specific location on the Service where the material that You claim is infringing is located.
  • Your address, telephone number, and email address.
  • A statement by You that You have a good faith belief that the disputed use is not authorized by the copyright owner, its agent, or the law.
  • A statement by You, made under penalty of perjury, that the above information in Your notice is accurate and that You are the copyright owner or authorized to act on the copyright owner’s behalf.

You can contact our copyright agent via email at hello@kubera.com.

Upon receipt of a notification, the Company will take whatever action, in its sole discretion, it deems appropriate, including removal of the challenged content from the Service.

Intellectual Property

Kubera® is a registered trademark of the Company, in the United States of America.

The Service and its original content (excluding Content provided by You or other users), features, functionality, and all related intellectual property rights are and will remain the exclusive property of the Company and its licensors.

The Service is protected by copyright, trademark, and other laws of the United States and foreign countries.

Our trademarks, service marks, logos, and trade dress may not be used in connection with any product or service without the Company’s prior written consent.

Your Feedback to Us

You assign all rights, title, and interest in any Feedback You provide the Company. If for any reason such assignment is ineffective, You grant the Company a non-exclusive, perpetual, irrevocable, royalty-free, worldwide right and license to use, reproduce, disclose, sublicense, distribute, modify, and exploit such Feedback without restriction and without compensation to You.

Links to Other Websites

Our Service may contain links to third-party websites or services that are not owned or controlled by the Company. The Company has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third-party websites or services.

We strongly advise You to read the terms and conditions and privacy policies of any third-party websites or services that You visit.

Suspension, Termination, and Service Changes

We may suspend, restrict, discontinue, or terminate all or any part of the Service, Your Account, or Your access to the Service at any time, with or without notice, for any reason or no reason, including if We believe You have violated these Terms, pose a security or legal risk, or create potential liability for Us, other users, or third parties.

Upon termination, Your right to use the Service will cease immediately.

We may modify, remove, or discontinue features, functionality, integrations, or supported institutions at any time, with or without notice, and without liability.

Sections of these Terms that by their nature should survive termination will survive, including ownership, licenses, disclaimers, limitations of liability, dispute resolution, and any payment obligations accrued before termination.

Limitation of Liability

To the maximum extent permitted by applicable law, the total aggregate liability of the Company and its Affiliates, officers, directors, employees, agents, suppliers, licensors, and service providers arising out of or relating to the Service or these Terms will not exceed the greater of (a) the amount You paid to the Company for the Service in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) US $100.

To the maximum extent permitted by applicable law, in no event will the Company or its Affiliates, officers, directors, employees, agents, suppliers, licensors, or service providers be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenues, goodwill, use, data, business opportunities, or other intangible losses, arising out of or related to the Service or these Terms, even if advised of the possibility of such damages.

The limitations in this section apply regardless of the theory of liability and even if any remedy fails of its essential purpose.

Some jurisdictions do not allow the exclusion of implied warranties or limitation of liability for certain damages, so some of the above limitations may not apply to You.

Indemnity

You agree to defend, indemnify, and hold harmless the Company and its Affiliates, officers, directors, employees, agents, suppliers, licensors, and service providers from and against any claims, demands, actions, proceedings, liabilities, damages, judgments, awards, losses, costs, and expenses, including reasonable attorneys’ fees, arising out of or relating to: (a) Your Content; (b) Your use of the Service; (c) Your violation of these Terms; (d) Your violation of any law or regulation; or (e) Your infringement or violation of any rights of any third party.

We reserve the right, at Our expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by You, and You agree to cooperate with Our defense of such claim. You may not settle any matter subject to indemnification under these Terms without Our prior written consent if the settlement imposes any obligation, restriction, admission, or liability on the Company.

"AS IS" and "AS AVAILABLE" Disclaimer

The Service is provided to You “AS IS” and “AS AVAILABLE” and with all faults and defects without warranty of any kind.

To the maximum extent permitted under applicable law, the Company, on its own behalf and on behalf of its Affiliates and its and their respective licensors, suppliers, service providers, and contractors, expressly disclaims all warranties, whether express, implied, statutory, or otherwise, with respect to the Service, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, quiet enjoyment, accuracy, availability, and any warranties arising out of course of dealing, course of performance, usage, or trade practice.

Without limiting the foregoing, the Company provides no warranty or undertaking, and makes no representation of any kind, that the Service will meet Your requirements, achieve any intended results, be compatible or work with any other software, applications, systems, or services, operate without interruption, meet any performance or reliability standards, or be error free, or that any errors or defects can or will be corrected.

Without limiting the foregoing, the Company makes no representation or warranty regarding any Third-party Services, third-party data, imported data, account balances, holdings, transactions, valuations, prices, cost basis, tax information, exchange rates, or similar information displayed through the Service.

Some jurisdictions do not allow the exclusion of certain types of warranties or limitations on applicable statutory rights of a consumer, so some or all of the above exclusions and limitations may not apply to You.

Governing Law

The laws of the State of Delaware, excluding its conflicts of law rules, shall govern these Terms and Your use of the Service.

Your use of the Service may also be subject to other local, state, national, or international laws. Nothing in these Terms limits any non-waivable consumer rights You may have under applicable law.

Dispute Resolution; Venue; Class Action Waiver

If You have any concern or dispute about the Service, You agree to first try to resolve the dispute informally by contacting the Company at hello@kubera.com.

To the maximum extent permitted by applicable law, any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be brought solely in Your individual capacity and not as a plaintiff or class member in any purported class, collective, consolidated, coordinated, representative, or mass action or proceeding.

Except to the extent prohibited by applicable law, and except for claims that may be brought in small claims court, any dispute, claim, or controversy arising out of or relating to these Terms or the Service shall be brought exclusively in the state or federal courts located in Delaware, and each party irrevocably consents to the personal jurisdiction and venue of such courts.

Notwithstanding the foregoing, the Company may seek injunctive or other equitable relief in any court of competent jurisdiction to protect the Service, its intellectual property, confidential information, security, or other rights or interests.

You and the Company waive any right to a jury trial to the maximum extent permitted by applicable law.

For European Union (EU) Users

If You are a European Union consumer, You will benefit from any mandatory provisions of the law of the country in which You are resident.

United States Federal Government End Use Provisions

If You are a U.S. federal government end user, our Service is a “Commercial Item” as that term is defined at 48 C.F.R. §2.101.

United States Legal Compliance

You represent and warrant that (i) You are not located in a country that is subject to a United States government embargo or that has been designated by the United States government as a “terrorist supporting” country, and (ii) You are not listed on any United States government list of prohibited or restricted parties.

You will not use, export, re-export, or transfer the Service except as authorized by United States law and the laws of the jurisdiction in which the Service was obtained or is used.

Assignment

You may not assign, delegate, or transfer these Terms or any of Your rights or obligations under these Terms, whether by operation of law or otherwise, without Our prior written consent. Any attempted assignment in violation of the foregoing is void. The Company may assign, delegate, or transfer these Terms, in whole or in part, without restriction.

Force Majeure

The Company will not be liable for any delay or failure in performance resulting from causes beyond its reasonable control, including failures of internet or telecommunications services, utility failures, labor disputes, acts of God, war, terrorism, civil unrest, epidemics, pandemics, governmental actions, or failures or delays of Third-party Services.

Severability and Waiver

If any provision of these Terms is held to be unenforceable or invalid, that provision will be modified and interpreted to accomplish the objectives of such provision to the greatest extent possible under applicable law, and the remaining provisions will continue in full force and effect.

Except as provided herein, the failure to exercise a right or to require performance of an obligation under these Terms shall not affect a party’s ability to exercise such right or require such performance at any time thereafter, nor shall the waiver of a breach constitute a waiver of any subsequent breach.

Entire Agreement

These Terms, together with the Privacy Policy and any additional terms or policies expressly incorporated by reference, constitute the entire agreement between You and the Company regarding the Service and supersede all prior or contemporaneous understandings, agreements, communications, and proposals relating to the Service.

No Third-Party Beneficiaries

Except as expressly provided in these Terms, these Terms are for the benefit of You and the Company only and do not create any third-party beneficiary rights.

Translation Interpretation

These Terms and Conditions may have been translated if We have made them available to You on Our Service.

You agree that the original English text shall prevail in the case of a dispute.

Changes to These Terms and Conditions

We reserve the right, at Our sole discretion, to modify or replace these Terms at any time.

If a revision is material, We will make reasonable efforts to provide notice before the updated Terms become effective, including by posting the updated Terms on the Website or through the Service, or by sending notice to the email address associated with Your Account. What constitutes a material change will be determined at Our sole discretion.

By continuing to access or use Our Service after those revisions become effective, You agree to be bound by the revised Terms. If You do not agree to the new Terms, in whole or in part, You must stop using the Service.

Contact Us

If You have any questions about these Terms and Conditions, You may contact the Company through the contact information made available on the Website, or by emailing hello@kubera.com.

Go to Top

Privacy Policy

Last updated: Mar 18, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service. Under GDPR, You can be referred to as the Data Subject or as the User.
  • Company (referred to as “the Company”, “We”,“Us” or “Our”) refers to Kubera Apps, Inc., 251 Little Falls Drive, Wilmington, New Castle County, DE 19808. For the purpose of GDPR, the Company is the Data Controller.
  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities.
  • Account means a unique account created for You to access our Service or parts of our Service.
  • Website refers to the Kubera website, accessible from https://kubera.com
  • Service refers to the Kubera portfolio tracking and related applications, websites, features, content, and services made available by the Company.
  • Service Provider means any natural or legal person who processes data on behalf of the Company, including third-party companies employed to facilitate the Service, perform services related to the Service, or assist the Company in analyzing how the Service is used. For the purpose of GDPR, Service Providers are considered Data Processors.
  • Third-party Services means any services, content, data, software, applications, websites, institutions, custodians, brokerages, exchanges, wallets, data aggregators, AI assistants, or other third parties that may be displayed, linked, connected to, integrated with, or made available through the Service.
  • Personal Data is any information that relates to an identified or identifiable individual. For GDPR purposes, this includes name, identification number, location data, online identifier, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity. For CCPA purposes, this means any information that identifies, relates to, or could reasonably be linked with You.
  • Cookies are small files placed on Your device by a website, containing details of Your browsing activity.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
  • Data Controller for the purposes of GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
  • Do Not Track (DNT) is a concept promoted by US regulatory authorities for the Internet industry to develop a mechanism allowing internet users to control the tracking of their online activities across websites.
  • Business for the purpose of CCPA, refers to the Company as the legal entity that collects Consumers’ personal information and determines the purposes and means of processing.
  • Consumer for the purpose of CCPA, means a natural person who is a California resident.
  • Sale for the purpose of CCPA, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a Consumer’s Personal information to another business or third party for monetary or other valuable consideration.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information. This may include, but is not limited to:

  • Email address
  • First name and last name
  • Date of birth
  • Display picture
  • Files you’ve uploaded
  • Phone number
  • Mailing Address
  • Home address
  • Vehicle VIN number
  • Internet Domain Names
  • Assets, Debts — Details and Value
  • Net Worth
  • Insurance details
  • Beneficiary Name, Email and Phone
  • Backup beneficiary (Trusted Angel) Name, Email and Phone

Usage Data

Usage Data is collected automatically when using the Service. This may include information such as Your device’s IP address, browser type and version, pages visited, time and date of visit, time spent on pages, and other diagnostic data.

When You access the Service through a mobile device, We may also collect information such as the type of mobile device, mobile operating system, browser type, unique device identifiers, and other diagnostic data.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service.

You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service.

We use both session and persistent Cookies for the following purposes:

  • Necessary / Essential Cookies Session Cookies administered by Us. Essential to provide You with services available through the Website and to authenticate users and prevent fraudulent use.
  • Cookies Policy / Notice Acceptance Cookies Persistent Cookies administered by Us. Identify if users have accepted the use of cookies on the Website.
  • Functionality Cookies Persistent Cookies administered by Us. Allow Us to remember choices You make when You use the Website, such as login details or language preference.
  • Tracking and Performance Cookies Persistent Cookies administered by Third-Parties. Used to track information about traffic to the Website and how users use the Website.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

  • To provide and maintain our Service.
  • To manage Your Account: to manage Your registration as a user of the Service.
  • For the performance of a contract: the development, compliance and undertaking of the purchase contract for products, items, or services You have purchased or any other contract with Us through the Service.
  • To contact You: by email, telephone calls, SMS, or other equivalent forms of electronic communication regarding updates, security notices, or informative communications related to contracted services.
  • To provide You with news, special offers and general information about services we offer, unless You have opted not to receive such information.
  • To manage Your requests: to attend and manage Your requests to Us.
  • To send You rewards: We may collect your Mailing Address for sending rewards based on Our loyalty programs.

Beneficiary and Trusted Angel Data Disclosure

Kubera includes a “Life Beat Check” feature designed to transfer Your portfolio data to designated beneficiaries or trusted angels in the event of Your prolonged inactivity. Specifically:

  • If You fail to respond to a series of 5 reminder emails sent over 10 days following an inactivity period (default 45 days, or as set by You), Kubera will email Your designated beneficiaries and/or trusted angels and provide them with a downloadable copy of Your portfolio data.
  • This data may include Your complete portfolio, asset values, uploaded documents, and any other information stored in Your Kubera account at the time of transfer.
  • You acknowledge and accept this data transfer by designating beneficiaries or trusted angels and by using the Life Beat Check feature. It is Your responsibility to keep beneficiary and trusted angel contact information current and to ensure You are comfortable with them receiving access to Your complete account data.
  • One year after Your last account activity, Kubera will send a final reminder. If unanswered within 7 days, Your account and all associated data will be permanently deleted.

API & AI Access

Kubera allows users to connect authorized third-party tools and AI assistants via API or MCP to interact with their Kubera account. If you choose to enable this access, those tools may read your portfolio and asset data, create new assets on your behalf, and update asset values.

Kubera does not grant third-party tools or AI assistants direct access to your account data unless you explicitly authorize that connection. Separately, Kubera uses service providers and processors as described elsewhere in this Privacy Policy to operate, secure, support, analyze, and improve the Service.

This access is granted only with your explicit consent and can be revoked at any time from your account settings. We may log API requests and related metadata for security, monitoring, and abuse prevention purposes.

Sharing of Your Personal Data

We may share your personal information in the following situations:

  • With Service Providers: We may share Your personal information with Service Providers for connecting Your online financial accounts, fetching latest asset value, processing payments, monitoring usage, reporting bugs, customer support, email marketing, and for targeting the Company’s promotional campaigns.
  • For Business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business.
  • With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
  • With ‘White Label Customers’: We may share Your personal information with our ‘White-Label Customers’, ONLY if You signed up to the Service as their client.
  • For advertising: We may share limited non-financial data (such as email address or device identifiers) with advertising platforms solely to promote Kubera’s own services to potential customers. We do not sell Your personal data. Your financial portfolio data, asset values, net worth, account connection information, and similar financial information are never shared with advertising services. Users who are citizens of or residents in the European Union (EU) or European Economic Area (EEA) are excluded from this sharing entirely.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. Our standard data retention practices are as follows:

  • Active account data is retained for the duration of Your subscription and for a reasonable period thereafter.
  • If Your account is inactive for 45 days (or a period You have set), the Life Beat Check process is initiated as described in the Beneficiary and Trusted Angel Data Disclosure section above.
  • Your account and all associated data will be permanently deleted 12 months and 7 days after Your last account activity if no response is received to our final reminder.
  • If You request account deletion, We will process Your request within 30 days and confirm deletion.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. This information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to: comply with a legal obligation; protect and defend the rights or property of the Company; prevent or investigate possible wrongdoing in connection with the Service; protect the personal safety of Users of the Service or the public; or protect against legal liability.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Do Not Track

Our Service does not currently respond to Do Not Track (“DNT”) browser signals. This is because there is no universally accepted standard for how DNT signals should be interpreted. We will continue to monitor developments in this area and update this policy if our practices change. You may opt out of certain tracking as described in the Tracking Technologies and Cookies section above.

Detailed Information on the Processing of Your Personal Data

Service Providers have access to Your Personal Data only to perform their tasks on Our behalf and are obligated not to disclose or use it for any other purpose.

Financial Account Aggregation

Users may link their bank, brokerage, and crypto wallet accounts for the Service to automatically fetch financial information. They may also provide home address, vehicle VIN, or domain names to automatically fetch estimated values. We use third-party Service Providers to power this functionality.

  • Finicity by Mastercard provides account aggregation in the USA and Canada. Finicity collects and securely stores the credentials you share. This information is never stored by, or disclosed to, Us. Privacy Policy: https://www.finicity.com/privacy/
  • Plaid provides account aggregation in the USA and Canada. Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy
  • Yodlee provides account aggregation in the USA, Canada, UK, South Africa, UAE, India, Malaysia, Hong Kong, Singapore, Australia and New Zealand. Privacy Policy: https://www.yodlee.com/legal/privacy-notice
  • MX provides account aggregation in the USA and Canada. Privacy Policy: https://www.mx.com/privacy-policy/
  • Akoya provides account aggregation in the USA. Privacy Policy: https://akoya.com/privacy-policy
  • Salt Edge provides account aggregation mainly in Europe and other regions. Privacy Policy: https://www.saltedge.com/pages/privacy_policy
  • SnapTrade provides account aggregation in USA, Canada, UK, Netherlands, India, and Australia. SnapTrade collects and securely stores the credentials you share. This information is never stored by, or disclosed to, Us. Privacy Policy: https://snaptrade.com/privacy-policy
  • Akahu is an open finance platform focused on New Zealand. Privacy Policy: https://www.akahu.nz/privacy-notice
  • Lean provides account aggregation in the Middle East. Privacy Policy: https://www.leantech.me/legal/privacy
  • VinAudit allows Kubera customers to enter their vehicle’s VIN number to get an estimated market value. Privacy Policy: https://www.vinaudit.com/privacy-policy
  • EstiBot allows Kubera customers to enter their domain names to get an estimated market value. Privacy Policy: https://www.estibot.com/privacy
  • Hiive allows Kubera customers to track their pre-IPO stocks in Kubera. Privacy Policy: https://www.hiive.com/privacy

Analytics

We may use third-party Service providers to monitor and analyze the use of our Service.

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. You can opt-out via the Google Analytics opt-out browser add-on. Google Privacy Policy: https://policies.google.com/privacy

Email Marketing

We may use Your Personal Data to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

We may use Email Marketing Service Providers to manage and send emails to You.

Advertisements

Some Personal Data may be shared with advertising services in order to promote the Company's brand and Services to Our target audience.

Payments

We may provide paid products and/or services within the Service. In that case, we may use third-party services for payment processing (e.g. payment processors).

We will not store or collect Your payment card details. That information is provided directly to Our third-party payment processors whose use of Your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

Stripe's Privacy Policy can be viewed at https://stripe.com/us/privacy

White-Label Customers

The Service can also be accessed through our ‘White-Label Customers’, such as Registered Investment Advisors, who have licensed the Service to apply their brand and offer it to their clients. Under these circumstances Kubera is the Data Processor and the ‘White-Label Customer’ is the Data Controller. Kubera’s obligation to the User is therefore limited to its role as Processor and the User must contact the ‘White Label Customer’ for more information about their Terms of Use and Privacy Policies.

If You are accessing the Service through such a ‘White Label Customer’, they may be able to access, add, edit, and retain information shown on your portfolio. However, they will not be able to access your bank/brokerage/crypto account credentials unless you provide them such access or they access it through other means. ‘White Label Customers’ may also be able to suspend or terminate your account access.

Your California Privacy Rights (CCPA)

If You are a California resident, the California Consumer Privacy Act (CCPA) provides You with specific rights regarding Your Personal Information. This section describes Your CCPA rights and explains how to exercise them.

Your Rights Under CCPA

  • Right to Know: You have the right to request that We disclose what Personal Information We have collected about You, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with whom We share it, and the specific pieces of Personal Information We have collected about You.
  • Right to Delete: You have the right to request that We delete Personal Information We have collected from You, subject to certain exceptions.
  • Right to Opt-Out of Sale or Sharing: We do not sell Your Personal Information. We may share limited non-financial data (such as email address or device identifiers) with advertising platforms solely to promote Kubera’s own services to potential customers. Your financial portfolio data, asset values, net worth, and account connection information are never shared with advertising services. To the extent this sharing constitutes “sharing” of personal information for cross-context behavioral advertising under California law, You have the right to opt out. To exercise this right, contact us at hello@kubera.com.
  • Right to Non-Discrimination: We will not discriminate against You for exercising any of Your CCPA rights.

To exercise Your CCPA rights, please contact us at hello@kubera.com. We will respond to verifiable consumer requests within 45 days.

Children's Privacy

Our Service does not address anyone under the age of 18, or the age of majority in their jurisdiction if higher. We do not knowingly collect personally identifiable information from anyone under the age of 18, or the applicable age of majority. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone below the applicable age threshold without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email, or via a notice on Our Service, or via an update to the “Last updated” date at the top of this Privacy Policy prior to the change becoming effective. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us at hello@kubera.com or by visiting https://www.kubera.com

Go to Top

GDPR — Data Protection Impact Assessment

Last updated: Mar 18, 2026

For our European users we can confirm that we comply with the European General Data Protection Regulation (“GDPR”). Please see our Data Protection Impact Assessment (“DPIA”) which demonstrates the measures we have taken to comply with our Data Protection obligations.

Data Protection Impact Assessment – Report.

Step 1 – Identify the Need for a DPIA

Kubera as a data controller for a web page and mobile app that processes data directly from user accounts and also from the synchronization of other platforms, such as banks and other financial institutions, is undertaking a DPIA in order to identify any areas of risk in the collection and processing of its user data.

Kubera collects personal data of data subjects who are citizens of the European Union (“EU”) and are based in the European Economic Area (“EEA”) in order to provide them with services through the Kubera web and mobile app. It is therefore appropriate to use a DPIA to identify any risks associated with the collection, processing, transmission, retention, review and deletion of all personal data being collected for the purposes of providing a service to its users.

Step 2 – Data Processing

Responsibilities and Standards Applicable to the Processing:

Kubera is collecting personal data directly from its users when they create an account, including personal data of “beneficiaries” and “trusted angels”. Some data is collected when users synchronize 3rd party platforms (e.g. bank accounts, brokerages, crypto exchanges, etc.) with their Kubera account.

The applicable standards are the European General Data Protection Regulation (“GDPR”) in relation to all personal data collected from EU citizens and associated implementing legislation, including the UK GDPR and the UK Data Protection Act 2018 (“DPA’18”) for UK data subjects. As personal data is being stored on infrastructure located in the United States, the Company relies on the Standard Contractual Clauses adopted by the EU Commission on 4 June 2021 (the “2021 SCCs”) for the transfer of personal data outside the EEA, and on the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner’s Office for transfers from the UK. All third-party processor agreements have been updated to incorporate the 2021 SCCs (or UK IDTA as applicable).

Describe the Nature and Scope of the Processing:

Kubera is processing the personal data of their users. This includes first name, last name, email address, password, profile picture and any information uploaded to the virtual “safe deposit box”. This could include special category data including the user's ID, passport, driving license, share certificates and details of any possible investments or liabilities. Users could upload highly sensitive data including details of divorce proceedings, child custody arrangements, wills and trusts, and details of medical histories.

To ensure that Kubera does not collect and process the data of those who are defined as a minor under relevant law, Kubera’s Service is not directed at individuals under the age of 18, or the age of majority in their jurisdiction if higher. A clear notice to this effect is displayed at the point of account registration.

Describe the Context and Purpose of the Processing:

Personal data of Kubera users is collected and retained for the purposes of providing the user with a modern-day wealth tracker. Personal data is shared with third parties by Kubera primarily to facilitate the provision of the service. Separately, Kubera may share limited non-financial data (such as email address or device identifiers) with advertising platforms solely to promote Kubera’s own services to potential customers; financial portfolio data is never shared for this purpose. Personal data of EU/EEA users is not shared with advertising services.

Step 3 – Types of Personal Data Collected.

For the avoidance of doubt, the types of personal data collected include: first name; last name; email address; password; phone number; date of birth; profile image; and any information uploaded to the virtual “safe deposit box” including, but not limited to, the user’s ID, passport, driving license, share certificates, and details of any possible investments or liabilities.

Step 4 – Life Cycle of the Personal Data Collected.

  • Data Processing: In order to provide the service, Kubera uses the following third parties who act as data processors: AWS, Finicity by Mastercard, Yodlee, Plaid, Akoya, Salt Edge, SnapTrade, MX, Akahu, Lean, LogRocket, Sentry, Help Scout, Google Analytics, Google Gemini, Mailerlite, and Stripe.
  • Data Storage: Kubera’s servers are operated by Amazon Web Services (“AWS”). All data is stored on AWS facilities in North Virginia, US (US East Region), encrypted using AES-256 bit encryption. 2-factor authentication is in place. Data transfers to the US from the EU/EEA rely on the 2021 EU Commission SCCs. Data transfers from the UK rely on the ICO’s International Data Transfer Agreement (IDTA).
  • Data Retention: Personal data is retained on the system on the basis that if a user fails to login for a period of 45 days (or as set by the user) a series of 5 reminder emails/notifications known as the “Life Beat Check” will be sent over a period of 10 days. If unanswered, the beneficiaries and/or trusted angels are contacted and supplied with a copy of the user’s data. 12 months after the last user activity, a further reminder is sent and if unanswered after 7 days the account is deleted from all systems including backups.

Step 5 – Legal Basis for Processing such Personal data.

Under article 6 of GDPR, Kubera is acquiring and processing the personal data of users for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Step 6 – Data Subject Rights.

  • Right of Access (Article 15 GDPR): All EU data subjects have the right to make a subject access request. Kubera has an option in the application allowing users to download a full copy of their personal data. Users can contact Kubera at hello@kubera.com. Requests will be responded to within the statutory 30-day deadline.
  • Right to Rectification (Article 16 GDPR): Users have the ability to change or update any of their personal information via the settings in the app.
  • Right to Erasure (Article 17 GDPR): Part of this process can be completed by the user via Kubera settings. To ensure complete erasure including from backups, users can contact hello@kubera.com. Kubera has 30 days to comply.
  • Right to Restriction of Processing (Article 18 GDPR): Users may request restriction of processing by writing to hello@kubera.com.
  • Right to Data Portability (Article 20 GDPR): Users may request a portable copy of their information by contacting hello@kubera.com.
  • Right to Object (Article 21 GDPR): Where Kubera processes personal data on the basis of legitimate interests, data subjects have the right to object to such processing. Kubera will cease processing unless it can demonstrate compelling legitimate grounds. To exercise this right, contact hello@kubera.com.
  • Automated Decision-Making (Article 22 GDPR): Kubera does not engage in solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning data subjects.

Step 7 – Risks Associated with the Processing

The following identifies risks associated with Kubera’s data processing activities, assessed by likelihood of harm (remote, possible or probable), severity of harm (minimal, significant or severe), overall risk level, and measures currently in place to mitigate each risk.

Describe source of risk and nature of potential impact on individuals. Include associated compliance and corporate risks as necessary:
Likelihood of harm (remote, possible or probable), severity of harm (minimal, significant or severe) and overall risk:
Measures currently in place to mitigate risks associated with the processing:
1. The inadvertent disclosure of account data to beneficiaries and/or trusted angels where for whatever reason the user has failed to respond to reminders but is not incapacitated but for some reason may not have the ability to get online or login to their account. Users are only given a period of 10 days to check in and confirm they are “okay” which is considered to be a short period of time (Likelihood: Probable | Severity: Significant | Overall Risk: High).
Users are informed about the Life Beat Check process, including the flow of data from the user’s account to the beneficiaries and/or trusted angels, from the outset using a clear flowchart. Annual prompt to verify beneficiary contacts. Users can extend inactivity threshold in settings.
2. The system is at risk of being subject to a cyber-attack including Denial of Service (Likelihood: Possible | Severity: Severe | Overall Risk: High).
Kubera periodically audits their infrastructure for any security issues. Any security issues found will be fixed/patched as soon as is reasonably possible.

Kubera uses Amazon GuardDuty to detect and monitor incidents that may impact the security of their assets, for example malicious activity and unauthorised behavior.

Kubera prevents access to user assets by using AWS Identity and Access Management (“IAM”).

All employees of Kubera are given training on cyber security principles. Backups of the main server are taken regularly. Access to user data is limited to a small number of employees.

Passwords on corporate accounts are changed frequently. 2-factor authentication is also applied where possible. Penetration testing conducted periodically.
3. As part of this exercise Kubera explained that they do not view any of the personal data that is connected to the user’s account or is stored in the user’s safe deposit box. However, for the avoidance of doubt it is necessary to confirm the security measures that are in place to ensure that no Kubera employee is in the position to access any personal data stored by Kubera or any of the accounts that the user has synchronized with their Kubera account (Likelihood: Probable | Severity: Severe | Overall Risk: High).
Database administrators have access to the database encryption keys and therefore can view any user data that is processed and retained by Kubera on their systems. This is because there is no end-to-end encryption. However, internal tools are in place to ensure that all personally identifiable information viewed by operational staff is masked.

Access to the servers where data is stored is given on a need-to-know basis and is limited to a small number of employees. If an employee does need to access user data for any reason, they are required to state a valid reason for that specific access session. An audit trail/record is maintained for all data access sessions which are reviewed periodically.
4. The risk of a Kubera employee being able to access and potentially distribute (intentionally or unintentionally) any user account login and password information (Likelihood: Possible | Severity: Severe | Overall Risk: Medium).
User accounts are managed through AWS Cognito. Therefore, Kubera employees do not have access to any user account passwords.
5. The risk of the synchronisation of the user’s financial accounts that are linked with their Kubera account being compromised by a malicious third party (Likelihood: Possible | Severity: Severe | Overall Risk: High).
Kubera syncs financial institution accounts using their own keys which are kept in AWS Secrets Manager. This reduces the chance of the keys being compromised. These keys are also rotated frequently. Access to keys restricted to authorised services only.
6. The risk of a data breach by any third parties acting as data processors (Likelihood: Possible | Severity: Severe | Overall Risk: High).
Kubera ensures valid contracts are in place with all third party data processors. Regularly checks for any updated terms, any change as to legal status of third party (e.g. takeover/buyout) or any other substantial variation in service. Institute regular coordination with third party processors e.g. half yearly or quarterly management calls to review operations.

Processor incidents reported to Kubera under contractual obligation.
7. The risk of users being overseen when accessing the app or web page (Likelihood: Probable | Severity: Minimal | Overall Risk: Low).
Establish a code or guide for Kubera users bringing to their attention possible risks as to how and where they access the app.

1. Do not use free public Wi-Fi when accessing the app or web page.

2. When accessing the app or web page via a new Wi-Fi system for the first time (e.g. hotel or airport) consider access via a VPN.

3. Do not access the app or web page when travelling on public transport or in a crowded area where the device screen may be overseen. Consider the purchase and use of a privacy screen for your device.

4. Ensure the security of your mobile device when used at home by putting all of your personal devices as well as important home systems on a secure password protected home network.

5. Ideally access the app or webpage using a secure 4G or 5G data connection for safe and speedy use.

6. Users are advised that due to the sensitivity of the data held by Kubera and accessed via the app, users may wish to ensure they dispose of their mobile devices securely rather than passing them to friends or family members or donating them due to the risk of inadvertent access to the system by an unauthorized user.
8. The risk of beneficiary and/or trusted angel contact information not being up to date, which could mean that user data is sent to the wrong recipient (Likelihood: Probable | Severity: Significant | Overall Risk: High).
An email/notification is sent to the user each year prompting them to confirm that the contact details of their beneficiaries and/or trusted angels are accurate.
9. It is a significant risk that if a user has access to the app on a mobile device and passes the use of that device temporarily or permanently to another user, that user may be able to gain access to the account including the wealth tracker and safe deposit documents (Likelihood: Probable | Severity: Significant | Overall Risk: Medium).
The app requires authentication on each session. Users are advised to: enable device screen lock and biometric authentication; use app-level PIN or biometric lock if available; remotely revoke device sessions from account settings; and factory reset device before transferring or disposing of it.
10. Contrary to the principles of necessity, proportionality and data minimization, Google (via Google Sign-In or Google Gemini) may be sharing more information with Kubera than is strictly necessary for the provision of services (Likelihood: Possible | Severity: Significant | Overall Risk: Medium).
For Google Sign-In: Kubera requests only email address, name and profile photo, and actively monitors for scope creep. For Google Gemini: data passed to Gemini is limited to what is strictly necessary to provide the AI-assisted feature; Google’s API terms prohibit use of API data for model training. Data minimisation reviewed with each Gemini integration.
11. The risk that backups are not being taken regularly (Likelihood: Remote | Severity: Severe | Overall Risk: Low).
Automated backups are taken. This process is managed by AWS. Backup success is logged and alerts are triggered on failure.
12. The risk that backups are not being regularly tested for effectiveness or recoverability (Likelihood: Probable | Severity: Significant | Overall Risk: High).
Backup restoration tests are conducted periodically to validate recoverability. AWS backup logs reviewed on a scheduled basis.
13. The risk that backups are not being taken on a secure system totally separate from the AWS primary infrastructure (Likelihood: Possible | Severity: Significant | Overall Risk: Medium).
Backups are stored on AWS servers located in multiple geographically distant availability zones and are encrypted using AES-256 bit encryption. An independent backup separate from the primary AWS region is maintained as a secondary safeguard.
14. The risk that backup or log data is retained outside of the data retention policy outlined above (Likelihood: Possible |Severity: Significant | Overall Risk: Medium).
Backup and log files are configured to rotate every 30 days. Kubera constantly verifies that this process is working as expected.
15. The risk that EU/EEA personal data is transferred to US-based processors without an adequate legal transfer mechanism, following the invalidation of the EU-US Privacy Shield (Schrems II, July 2020) (Likelihood: Possible | Severity: Severe | Overall Risk: High).
All third-party data processor agreements have been updated to incorporate the Standard Contractual Clauses adopted by the EU Commission on 4 June 2021 (the “2021 SCCs”), which became mandatory for all contracts from 27 December 2022. Transfer Impact Assessments (TIAs) have been conducted for key US-based processors. Contracts are reviewed on an annual basis.
16. The risk that UK personal data is transferred to US-based processors without an adequate legal transfer mechanism following Brexit (Likelihood: Possible | Severity: Severe | Overall Risk: High).
UK data transfers rely on the ICO International Data Transfer Agreement (IDTA) (in force 21 March 2022) rather than EU SCCs. Key processor agreements have been updated to include UK IDTA addenda. Reviewed annually and monitored for ICO updates.
17. The risk of third-party AI assistants or applications connected via API/MCP exceeding their authorised data access scope or acting erroneously on user data (Likelihood: Possible | Severity: Significant | Overall Risk: Medium).
API/MCP access is granted only with explicit user consent. Users can revoke access at any time. API access is scoped to read/create/update only; no bulk export or deletion capability is permitted. API requests are logged for security monitoring. Rate limiting is applied. Kubera may suspend API access if abuse or anomalous behavior is detected.

Step 8 – Sign Off

This DPIA has been reviewed and accepted on behalf of Kubera Apps, Inc. as Data Controller. It will be reviewed and updated at least annually, or whenever a significant change is made to Kubera’s data processing activities, including the introduction of new features, or the engagement of new third-party processors. Responsibility for compliance with this DPIA and the obligations identified herein rests with the directors of Kubera Apps, Inc.

Go to Top