Privacy policy

Who we are

Kubera Software is the trading name of a sole trader based in the United Kingdom. This policy covers this website (kuberasoftware.com) and our two products, eCom Pal and RuneProfit. For the purposes of UK and EU data protection law, Kubera Software is the data controller for the personal data described below, which means the responsibility for how it is handled rests here rather than with a parent company.

Data protection enquiries, including any request to see or delete your data, go to [email protected] and are handled directly by the person who runs the business.

eCom Pal also publishes its own privacy policy and cookie policy, which give product-specific detail. Where the two documents overlap, the eCom Pal policy governs the eCom Pal service.

What we collect

This website

This site is static. It has no accounts, no analytics tracking, no advertising and no third-party marketing scripts, and it does not set cookies for tracking or profiling. Our hosting and content delivery provider records standard server logs — IP address, timestamp, requested page, browser user agent — which are used to serve the site, keep it available and defend it from abuse.

Web fonts on this site are loaded from Google Fonts, which means your browser makes a request to Google when a page loads. If you would rather that did not happen, we can serve the fonts from our own domain instead — tell us and we will.

When you email us

If you contact us we hold your email address, your name if you give it, and the contents of your message, so that we can answer you and keep a record of the exchange.

eCom Pal

To use eCom Pal you create an account, which requires an email address and a password. Payment for paid plans is handled by a third-party payment processor; we receive confirmation of a subscription and its status, and we do not receive or store your full card details.

When you connect a sales channel, eCom Pal stores the access credentials issued by that platform, together with the listing identifiers and stock quantities for the products you choose to link. This is the data the sync feature operates on.

eCom Pal is an inventory tool. It is not built to collect your customers’ personal information, and keeping stock levels in agreement does not require buyer names, addresses or contact details. Where a connected platform makes such data available, we limit our requests to the permissions the inventory features need.

RuneProfit

RuneProfit requires an account, so we hold an email address and a password for it. New accounts begin with a three-day free trial. If you continue after the trial, subscription payments are handled by a third-party payment processor; we receive confirmation of the subscription and its status, and we do not receive or store your full card details.

Beyond your account and subscription status, RuneProfit works from public market data. We never ask for your RuneScape account credentials, and you should not give them to us or to any other third-party tool. As with the rest of our sites, standard server logs apply.

Why we use it, and our legal basis

• To provide the service you asked for — running your account, syncing the products you linked, taking payment. Legal basis: performance of a contract.
• To answer you when you get in touch. Legal basis: legitimate interests, or performance of a contract if you are a customer.
• To keep the service secure and working — logging, error diagnosis, preventing abuse. Legal basis: legitimate interests.
• To meet legal and accounting obligations, such as retaining billing records. Legal basis: legal obligation.

We do not sell personal data. We do not share it with advertisers or data brokers, and we do not use it to build profiles for marketing. We will not send you marketing email you did not ask for.

How we protect it

Kubera Software is a one-person business, and that shapes the security model more than any single control does.

• One person has administrative access to the systems holding your data: the sole trader who runs Kubera Software. There are no employees, contractors or outsourced support staff who can reach it.
• Administrative access is granted from within the applications themselves rather than through a shared third-party console.
• We run our own servers on a virtual private server we administer directly, so your data is not spread across a chain of managed platforms.
• Data is encrypted in transit using HTTPS with a valid TLS certificate — on these websites, in the apps, and in every call our software makes to a marketplace.
• We request the narrowest set of platform permissions each feature needs, rather than the broadest set available.
• Credentials and secrets are not written to application logs.
• We keep the operating system and the application's dependencies patched, and monitor for vulnerabilities in the components we rely on.
• If a breach affects your personal data, we will notify you and the relevant supervisory authority within the time limits the law requires, and tell you what happened and what we are doing about it.

Who else processes data

We run our own infrastructure on a virtual private server that we administer directly, rather than building on a managed platform. That keeps the number of third parties involved deliberately small. Those that remain fall into three categories: the provider of the server and its network connectivity, the processor that handles subscription payments, and the service that delivers transactional email such as password resets. Each processes data only on our instructions. Marketplace platforms you choose to connect — such as eBay, Amazon or WooCommerce — receive and return data as part of that connection, under their own terms.

Some providers may process data outside the UK. Where that happens we rely on the safeguards the law allows, such as UK adequacy regulations or the International Data Transfer Agreement and its EU equivalent standard contractual clauses. You can ask us for the current list of providers for your account.

How long we keep it

• Account and connection data: for as long as your account is open.
• Email correspondence: normally up to two years, so we have context if you come back to us.
• Billing records: as long as tax and accounting law requires, which in the UK is currently six years.
• Server logs: a short rolling window, typically under 90 days.

Deleting your data

You can disconnect any store at any time from your eCom Pal settings or from the platform’s own authorisation screen; the stored credentials for that connection are then deleted and syncing stops.

If you close your account, or ask us in writing to delete your data, we delete your account data and any stored platform credentials and connection records within 30 days. We keep only what we are legally required to keep, such as billing records for tax purposes, and backups are purged on their normal rotation.

Your rights

Under UK GDPR, and EU GDPR where it applies, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable form, and to withdraw consent where processing relies on it.

To exercise any of these, email [email protected]. We will respond within one month. There is no charge, and we will not treat you differently for asking.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority if you are in the EU. We would rather you told us first so we can put it right.

Children

In the UK a child can consent to an online service from the age of 13. We do not knowingly collect personal data from anyone younger than that, and a paid subscription is intended to be taken out by someone old enough to enter into a contract. If you believe a child has given us personal data, tell us and we will delete it.

RuneProfit concerns a video game whose players span a wide range of ages. It shows market data and profit calculations only: there is no user-to-user contact, no social feature, and no profiling for advertising.

Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. Where a change materially affects you, we will tell account holders by email rather than relying on you to notice.

Contact

Questions, requests or complaints about privacy: [email protected]. See also our contact page.