Legal Policies

Overview

By creating an account, signing an order form, clicking “I agree”, accessing the Services, or using the Services, you agree to these Legal Policies, including the Terms of Service, on behalf of the organisation you represent. If you do not have authority to bind that organisation, you must not accept these Legal Policies or use the Services on its behalf.

These Legal Policies are standard online terms for the Kobby.ai Platform. They do not replace customer-specific legal advice. Customers remain responsible for configuring and using the Platform in compliance with the laws that apply to their business, industry, employees, customers, communications, recordings, records, workflows and AI-enabled use cases.

Terms of Service

Last updated: 26 May 2026

1. Parties, business use and acceptance

These Terms of Service (“Terms”) are between Kobby AI, a company registered in the Netherlands with KvK number 67320465, having its registered office at Johan Huizingalaan 763A, 1066 VH Amsterdam, Netherlands (“Kobby”, “we”, “us”) and the business or organisation using the Services (“Customer”, “you”).

The Services are offered solely for business or professional use and not for personal, family or household use. By creating an account, signing or accepting an Order Form or Statement of Work, clicking “I agree”, accessing the Services, or using the Services, Customer accepts these Terms and represents that the person accepting them has authority to bind Customer.

For purposes of these Terms, an “Order Form” means an order form, accepted proposal, online checkout or subscription order that identifies the Services, subscription term, fees or usage limits. A “Statement of Work” or “SOW” means a written document describing professional services, implementation, integration or Customisation work. These Terms, each applicable Order Form and SOW, the Data Processing Agreement / AVV, Technical and Organisational Measures, Sub-processor List, International Transfer Terms, AI Addendum, Call Recording Addendum, Privacy Policy, Refund Policy and any other policy expressly incorporated by reference together form the “Agreement”. An invoice records charges and payment details but does not by itself amend the Agreement.

Order of precedence. If documents forming the Agreement conflict: (a) a signed Order Form or SOW controls, but only to the extent that it expressly identifies the provision being overridden and states that it overrides that provision; (b) the DPA/AVV controls solely for the processing of Customer Personal Data, and mandatory Standard Contractual Clauses control for restricted international transfers; (c) these Terms control; (d) the applicable online plan or checkout terms control; and (e) the remaining policies control.

Terms contained in any Customer purchase order, procurement portal, vendor form, confirmation, policy or other Customer document do not amend or supplement the Agreement and are rejected unless an authorised representative of Kobby expressly accepts them in writing.

2. Platform description

Kobby.ai is a conversational operations platform for business process management. Depending on the subscription, configuration, integrations and enabled features, the Platform may include:

• CRM features for contacts, customers, leads, opportunities, pipelines, tasks and communications;
• ERP and operations features for workflows, processes, internal records, projects, inventory, orders, service operations and reporting;
• AI-assisted chat, search, classification, summarisation, drafting, recommendations, workflow automation and analytics;
• communication features such as email, messaging, chat, telephony integrations, call logging, call recording, transcription and call summaries;
• integrations with third-party systems selected by Customer or made available by Kobby;
• dashboards, audit logs, access management, exports, notifications and administrative controls.

Kobby may add, modify or discontinue features from time to time. Feature availability may depend on plan, region, configuration, applicable law, Customer instructions and third-party service availability.

3. Accounts, authorised users and security

Customer is responsible for all activity under its accounts and for ensuring that only authorised users access the Platform. Customer must maintain accurate account information, protect credentials, enable appropriate security controls, and promptly notify Kobby of suspected unauthorised access. Customer is responsible for assigning appropriate roles and permissions to its users, limiting access to Customer Data on a need-to-know basis, and ensuring that users comply with these Terms and Customer’s internal policies.

4. Customer Data and responsibility for use

“Customer Data” means data, content, records, communications, audio, transcripts, files, metadata, prompts, outputs, instructions, business requirements and other materials submitted to, generated in or processed through the Platform by or on behalf of Customer.

Customer retains all rights in Customer Data. Kobby may process Customer Data only to provide, secure, support, maintain and improve the Services as permitted by these Terms, the DPA/AVV, Customer’s documented instructions and applicable law.

For clarity, Customer Data may include configuration instructions, specifications and business requirements supplied by Customer, but it does not include Kobby Technology, Customisations, software, source code, object code, workflows, templates, schemas, connectors, integrations, technical configurations or any other technical implementation created, configured or provided by or for Kobby, even where developed specifically for Customer or based on Customer’s requirements.

Customer is responsible for determining whether and how to use the Platform, including the purposes and legal basis for processing Customer Data, the configuration of retention rules, user access rights, call-recording settings, AI features, workflows, integrations, exports, and internal use of Platform outputs.

5. Acceptable use

Customer must not use the Services to:

• violate applicable law or third-party rights;
• record communications without legally required notice, consent, authorisation or other lawful basis;
• conduct unlawful surveillance, hidden employee monitoring, unlawful profiling or discriminatory decision-making;
• send spam, phishing messages, malware or unlawful communications;
• attempt to gain unauthorised access to the Platform, third-party systems or other customers’ data;
• interfere with the security, integrity, availability or performance of the Platform;
• use AI outputs as the sole basis for decisions producing legal or similarly significant effects on individuals (Article 22 GDPR) unless expressly agreed and lawfully implemented with appropriate safeguards;
• engage in any AI practice prohibited under Article 5 of the AI Act, including but not limited to subliminal manipulation, exploitation of vulnerabilities, social scoring, untargeted scraping of facial images, emotion recognition in the workplace or in educational institutions, biometric categorisation inferring sensitive attributes, or real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes;
• use the Platform for high-risk, prohibited, regulated or safety-critical use cases without written approval from Kobby and a separate risk and compliance assessment.

6. AI features and outputs

AI features may generate transcripts, summaries, classifications, recommendations, drafts, insights or other outputs. AI outputs may be incomplete, inaccurate, outdated, biased or unsuitable for a particular purpose. Customer is responsible for reviewing outputs before relying on them and for ensuring that human oversight is applied where required. Kobby does not provide legal, financial, tax, medical, employment or professional advice. AI outputs are assistive and must not be treated as professional advice or as final decisions about individuals.

7. AI literacy

Pursuant to Article 4 of the AI Act, each party must take measures to ensure a sufficient level of AI literacy of its staff and other persons dealing with the operation and use of AI systems on its behalf, taking into account their technical knowledge, experience, education and training, and the context in which the AI systems are to be used. Kobby maintains an internal AI-literacy programme for personnel involved in the development and operation of the Platform. Customer is responsible for the AI literacy of its own users.

8. Customer compliance obligations

Customer is responsible for compliance with laws applicable to its use of the Platform, including data protection, employment, consumer protection, communications, call-recording, electronic-messaging, sector-specific, bookkeeping, records-retention and AI-governance laws. Where Customer records calls, monitors employees, processes employee data, uses AI for HR, performance, productivity, compliance or decision-support purposes, or processes sensitive data, Customer is responsible for lawful-basis assessments, privacy notices, employee notices, DPIAs, works-council involvement where applicable, retention policies, data-subject-rights procedures and human-oversight controls.

9. Third-party services and integrations

The Platform may interoperate with third-party services, including hosting, databases, payment processors, messaging providers, telephony providers, email services, AI model APIs, customer-selected integrations and other external systems. Kobby is not responsible for third-party products that Customer enables or uses outside the Platform. Where Kobby uses third-party providers to process Customer Personal Data on Kobby’s behalf, those providers are handled as sub-processors under the DPA/AVV. Where Customer independently enables a third-party integration, Customer is responsible for assessing and authorising that integration.

10. Subscription, fees and payment

Fees, billing cycles, usage limits, overage charges, plan features, taxes and payment terms are specified in the applicable Order Form, online checkout, subscription plan, invoice or written agreement. Unless otherwise stated, fees are exclusive of taxes and are payable in advance. Kobby may suspend access for overdue payments, payment failures, security risks, legal risks, breach of these Terms or use of the Services that may harm the Platform, Kobby, other customers or third parties.

11. Service levels, support and availability

Kobby will use commercially reasonable efforts to provide the Services reliably. However, the Services may be unavailable due to maintenance, updates, third-party failures, internet disruptions, force majeure, security incidents or circumstances outside Kobby’s reasonable control. Specific service levels apply only if agreed in an Order Form or service-level agreement.

12. Intellectual property

“Kobby Technology” means the Platform, Services, software, source code, object code, APIs, systems, databases, data models, designs, user interfaces, documentation, algorithms, models, system prompts, prompt frameworks, workflows, templates, schemas, connectors, integrations, configuration frameworks, tools, methods, know-how and other technology owned, licensed, developed or used by or for Kobby, including updates, improvements, derivative works and reusable or generic elements of any Customisation.

“Customisations” means configurations, custom development, modifications, enhancements, integrations, connectors, workflows, modules, scripts, code, schemas, templates, documentation and other deliverables developed, configured or provided by or for Kobby in connection with the Services, including work requested, specified, funded or paid for by Customer.

“Customer Materials” means Customer Data and any branding, content, documentation, specifications, business rules, instructions or other materials supplied by or on behalf of Customer.

Kobby and its licensors retain all right, title and interest, including all intellectual property rights, in and to the Kobby Technology and Customisations. Customer retains all right, title and interest in Customer Materials. Customisations do not include Customer Materials or third-party materials, each of which remains subject to the rights of its owner.

Unless a separate SOW or other written instrument signed by authorised representatives of both parties expressly identifies the rights being transferred and states otherwise, all Customisations form part of the Kobby Technology and remain owned by Kobby, even if they are created specifically for Customer or requested, specified, funded or paid for by Customer.

Payment for Customisations, implementation, integration, development or other professional services does not assign, sell or transfer to Customer any ownership, copyright, source-code right, title or other intellectual property right. Payment alone does not constitute an assignment, exclusive licence or other instrument transferring intellectual property rights.

Subject to Customer’s payment of applicable fees and compliance with the Agreement, Kobby grants Customer a limited, non-exclusive, non-transferable and non-sublicensable right, during the applicable subscription term, to permit its authorised users to access and use the Services and any Customisations made available to Customer solely for Customer’s internal business purposes. No exclusivity is granted unless expressly stated in a signed SOW.

Customer must not, except to the extent expressly permitted by the Agreement or by mandatory law, copy, sell, resell, sublicense, distribute, disclose, publish, modify, create derivative works from, reverse engineer, decompile, disassemble or attempt to derive the source code, underlying structure, algorithms or non-public technical elements of the Kobby Technology or Customisations.

Customer has no right to receive or access source code, source-code repositories, development environments, build systems, deployment credentials or internal technical documentation unless expressly agreed in a separate SOW signed by authorised representatives of both parties.

Customer grants Kobby and its providers a non-exclusive, worldwide, limited right to host, copy, transmit, display, modify and otherwise use Customer Materials only as reasonably necessary to provide, secure, support and maintain the Services, perform the Agreement and comply with applicable law.

Kobby may use and reuse general ideas, concepts, skills, know-how, methods, techniques, tools, components and non-customer-specific code developed or acquired in connection with the Services, provided that Kobby does not disclose or reuse Customer Data, Customer Materials or Customer Confidential Information and does not identify Customer. All rights not expressly granted to Customer are reserved by Kobby and its licensors.

13. Professional services and Customisations

Kobby will provide implementation, migration, integration, consulting, training, development or other professional services only as described in an applicable Order Form or SOW. The Order Form or SOW should specify the scope, assumptions, dependencies, milestones, fees, deliverables, acceptance criteria, support and any Customer-specific usage rights.

Customer must provide timely access to information, systems, personnel, decisions, approvals and Customer Materials reasonably required for the work. Customer represents that it has the rights and permissions necessary for Kobby to use Customer Materials for the work. Customer-caused delay or failure to meet a dependency may extend schedules and may require a written change order for additional work or fees.

Any material change to scope, assumptions, integrations, deliverables or timing must be agreed in writing, including any corresponding adjustment to fees or deadlines. Kobby is not required to perform out-of-scope work without such agreement.

Unless a signed SOW expressly states otherwise, professional-services deliverables and Customisations are non-exclusive, may incorporate pre-existing or reusable Kobby Technology, and are licensed for use only as provided in section 12. Kobby may provide similar functionality or services to other customers, provided that it does not disclose or reuse Customer Data or Customer Confidential Information.

Fees for professional services and Customisations purchase the agreed services and the applicable usage rights only. They do not purchase the Platform, source code, repositories, development tooling, ownership or intellectual property rights.

Third-party and open-source components may be subject to separate licence terms. Nothing in the Agreement transfers ownership of such components or grants rights broader than their applicable licences.

14. Confidentiality

“Confidential Information” means non-public information disclosed by or on behalf of a party that is marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. Customer Data and Customer Materials are Customer Confidential Information. Non-public Kobby Technology, Customisations, source code, product plans, pricing, security information and technical documentation are Kobby Confidential Information.

The receiving party must protect Confidential Information using at least reasonable care and no less than the care it uses for its own similar information, use it only to perform or exercise rights under the Agreement, and disclose it only to personnel, affiliates, professional advisers, contractors and providers who need access and are bound by confidentiality obligations at least as protective as those in this section.

Confidential Information does not include information that the receiving party can demonstrate: (a) is or becomes public without breach of the Agreement; (b) was lawfully known without restriction before disclosure; (c) is received lawfully from a third party without confidentiality duty; or (d) is independently developed without use of the disclosing party’s Confidential Information.

If disclosure is required by law, court order or competent authority, the receiving party may disclose the minimum required information and, where legally permitted, will give prompt notice and reasonable assistance so the disclosing party may seek protective measures. These confidentiality obligations continue for five years after disclosure, except that trade secrets remain protected for as long as they qualify as trade secrets under applicable law.

15. Warranties and disclaimers

The Services are provided “as is” and “as available” except where expressly agreed otherwise in an Order Form or SOW. Kobby does not warrant that the Services will be uninterrupted, error-free, secure against every threat, or that AI outputs will be accurate, complete or suitable for Customer’s specific use case.

16. Liability

To the maximum extent permitted by law, Kobby is not liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, revenues, goodwill, business opportunities, anticipated savings, or loss or corruption of data, arising out of or relating to the Agreement, even if advised that such loss may occur.

To the maximum extent permitted by law, Kobby’s aggregate liability arising out of or relating to the Agreement, whether in contract, tort (including negligence), misrepresentation, restitution, breach of statutory duty or otherwise, will not exceed an amount equal to one month of the fees payable by Customer for the affected Services, calculated on a monthly basis regardless of the applicable billing cycle. Any different liability cap will apply only if an Order Form expressly refers to this Section 16 and expressly states that it overrides the liability cap set out in this Section 16.

Nothing in the Agreement excludes or limits liability to the extent it cannot be excluded or limited under applicable law, including liability for fraud, intentional misconduct, or death or personal injury caused by negligence where such liability cannot lawfully be limited.

17. Term, suspension, termination and deletion

The Agreement begins when Customer first accepts it and continues for the applicable subscription or service term. Renewal, cancellation and termination for convenience are governed by the applicable Order Form, subscription plan or SOW.

Either party may terminate the affected Agreement for a material breach that the other party fails to cure within 30 days after written notice. Kobby may suspend or terminate access immediately where reasonably necessary to address unlawful use, an urgent security or legal risk, material harm to the Platform or third parties, or a breach that is not capable of cure. For overdue payment or a curable breach, Kobby will give reasonable notice where practicable and will use reasonable efforts to limit the scope and duration of suspension.

Upon termination or expiry: (a) Customer’s right to access and use the Services and Customisations ends, except for any standalone usage right expressly granted in a signed SOW; (b) all accrued and undisputed fees become payable; (c) Customer must stop using and, where applicable, return or destroy Kobby Confidential Information; and (d) Kobby will make Customer Data available for export or delete it in accordance with the DPA/AVV, the applicable export period, retention settings and applicable law.

Termination or expiry does not entitle Customer to source code, repositories, development environments or other Kobby Technology. Provisions concerning accrued payment obligations, intellectual property, confidentiality, liability, termination consequences, general provisions, governing law and any provisions that by their nature should survive will continue after termination or expiry.

18. Changes to these Terms

Kobby may update these Terms from time to time. For material changes, Kobby will provide at least 30 days’ advance notice by email or through the Platform and will provide the complete updated text, or a link from which Customer can download and retain it, together with the effective date.

If a material change materially and adversely affects Customer’s rights, Customer may reject that change by terminating the affected subscription before the effective date by written notice to Kobby. Termination will take effect when the change takes effect, and Kobby will refund any prepaid fees for the unused portion of the terminated subscription, unless the change is required by applicable law or is reasonably necessary to address an urgent security, abuse or legal risk.

Kobby may make a legally required or urgent security-related change on shorter notice where waiting 30 days would not be reasonable, but will notify Customer as soon as reasonably practicable. Changes do not apply retroactively to a dispute arising before their effective date. Continued use of the affected Services after the effective date constitutes acceptance of the updated Terms unless applicable law requires a different mechanism.

19. General provisions

Entire agreement. The Agreement is the entire agreement between the parties concerning its subject matter and supersedes prior or contemporaneous proposals, discussions and understandings concerning that subject matter. Any amendment must comply with section 1 or section 18, as applicable.

Assignment. Customer may not assign or transfer the Agreement, in whole or in part, without Kobby’s prior written consent. Kobby may assign the Agreement to an affiliate or in connection with a merger, reorganisation, financing, sale of assets or transfer of the business to which the Agreement relates, provided that the assignee assumes Kobby’s obligations. Any other attempted assignment is void to the extent permitted by law.

Force majeure. Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, including internet or utility failures, labour disputes, acts of government, war, terrorism, civil unrest, natural disasters, epidemics, failures of third-party infrastructure, or cyberattacks not caused by that party’s failure to maintain reasonable safeguards. This does not excuse Customer’s obligation to pay fees already due.

Notices. Legal notices to Kobby must be sent to legal@kobby.ai. Notices to Customer may be sent to the account owner or billing email address, through the Platform, or to another address stated in an Order Form. Notices of material breach or termination must be in writing. Routine operational notices may be delivered through the Platform.

Severability and waiver. If a provision is held unenforceable, it will be limited or replaced to the minimum extent necessary to make it enforceable while preserving its purpose, and the remaining provisions remain effective. Failure or delay to exercise a right is not a waiver, and a waiver is effective only for the specific instance in which it is given.

Relationship and third parties. The parties are independent contractors. The Agreement does not create a partnership, joint venture, fiduciary, agency, franchise or employment relationship. Except for Kobby’s licensors and providers where expressly stated, no third party has a right to enforce the Agreement.

Interpretation. Headings are for convenience only. “Including” means “including without limitation”. The English version controls over any translation unless a signed Order Form expressly states otherwise.

20. Governing law and venue

Unless a signed Order Form expressly identifies and overrides this section 20, the Agreement is governed by the laws of the Netherlands, without regard to conflict-of-law rules. The competent courts of Amsterdam, the Netherlands, have exclusive jurisdiction, unless mandatory law, including applicable consumer-protection rules, requires another venue or the application of another law.

Privacy Policy

Last updated: 29 May 2026

This Privacy Policy explains how Kobby collects, uses, discloses, stores and protects personal data when you visit our website, contact us, create an account, use the Platform, receive support or otherwise interact with us. It is provided in compliance with Articles 12, 13 and 14 GDPR and equivalent provisions of the UK GDPR and Swiss FADP.

1. Controller identity and contact details

The controller responsible for personal data processed for Kobby’s own purposes is:

• Legal entity: Kobby AI
• Registered office: Johan Huizingalaan 763A, 1066 VH Amsterdam, Netherlands
• Chamber of Commerce (KvK) number: 67320465
• Privacy contact: privacy@kobby.ai

For Customer Personal Data processed through the Platform on behalf of a business Customer, the Customer is the controller and Kobby acts as processor. Data subjects whose data has been entered into the Platform by a Customer (for example employees, suppliers, callers or contacts of that Customer) should direct privacy enquiries primarily to the relevant Customer; Kobby will forward such requests where required.

2. Privacy Contact / Data Protection Officer

Kobby has appointed an internal Privacy Contact responsible for monitoring compliance with this Privacy Policy and applicable data-protection law and for handling data-subject requests addressed to Kobby:

• Email: privacy@kobby.ai
• Postal: Privacy Contact, Kobby AI, Johan Huizingalaan 763A, 1066 VH Amsterdam, Netherlands

Kobby has assessed its obligation to designate a Data Protection Officer under Article 37(1) GDPR. As at the “Last updated” date, Kobby’s core activities do not, in Kobby’s assessment, consist of (i) regular and systematic monitoring of data subjects on a large scale or (ii) large-scale processing of special categories of data, and Kobby therefore does not currently designate a statutory DPO. Kobby reviews this assessment periodically and will designate a DPO and notify the competent supervisory authority if the criteria are met.

3. Categories of personal data we process as controller

• Account data: name, business email, business phone, organisation, role, authentication identifiers, account settings and preferences.
• Billing data: billing address, tax identifiers, invoice details, payment status, payment-provider references and transaction history. Card details are processed directly by Stripe and are not stored by Kobby.
• Communications data: content of emails, support tickets, chat messages with our team, meeting notes, call notes and feedback you send to us.
• Website and Platform usage data: IP address, device type, operating system, browser type and version, language preference, pages or screens viewed, timestamps, referring URL, server logs, error diagnostics and security-relevant events such as login attempts.
• Marketing data: preferences, event registrations, newsletter subscriptions, campaign interactions and unsubscribe history.

We do not knowingly collect special categories of personal data within the meaning of Article 9 GDPR for our own controller purposes.

4. Sources of personal data

• Directly from you, when you register an account, contact us, fill in a form, attend an event or interact with the Platform or website.
• Automatically, when you interact with our website or Platform, through server logs and security telemetry described in section 11 below.
• From your employer or organisation, if a colleague or administrator creates an account or invites you to a Customer workspace.
• From third parties, such as payment processors, public business registers, professional networks, event organisers or referral partners, where lawful and proportionate.

5. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases under Article 6 GDPR. Where we rely on legitimate interests, we have carried out a balancing test, the outcome of which is available on request via privacy@kobby.ai.

We do not use personal data processed under our controller role for automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. AI features inside the Platform are used by Customers as controllers; their use of those features is governed by the AI Processing Addendum.

6. Recipients and categories of recipients

• Internal personnel of Kobby and its affiliates, bound by confidentiality.
• Sub-processors providing infrastructure, hosting, database, email, payment, AI model and communications services. The current list and locations are published in the Sub-processor List on this page.
• Professional advisors (legal, accounting, auditors, insurers), bound by professional confidentiality.
• Payment providers (Stripe and equivalent), acting as independent controllers for payment data.
• Competent authorities, courts and regulators where required by law.
• Parties to a corporate transaction under appropriate confidentiality safeguards.
• The relevant Customer, where a request or incident concerns Customer Personal Data processed by Kobby as processor.

We do not sell personal data and do not share it for cross-context behavioural advertising.

7. International transfers

Some of our sub-processors are established outside the European Economic Area, including in the United States and other jurisdictions. Where personal data is transferred outside the EEA, the United Kingdom or Switzerland to a country that does not benefit from a European Commission adequacy decision, we rely on one or more of the following transfer mechanisms under Chapter V GDPR:

• the European Commission Standard Contractual Clauses (Decision (EU) 2021/914), with the appropriate module, supplemented by the UK International Data Transfer Addendum and the Swiss adaptations where applicable;
• the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), where the U.S. recipient is certified for the relevant data categories;
• adequacy decisions under Article 45 GDPR where applicable;
• the derogations in Article 49 GDPR, only in limited and exceptional cases.

We carry out transfer impact assessments where required and implement supplementary technical, organisational and contractual measures such as encryption in transit, encryption at rest where feasible, access restrictions and provider due diligence. You can obtain a copy of the relevant transfer mechanism or further information by writing to privacy@kobby.ai.

8. Retention

We retain personal data only for as long as necessary for the purposes set out in section 5, after which it is deleted or anonymised. The following retention periods apply to data processed under Kobby’s controller role; Customer Personal Data retention is configured by the Customer under the DPA/AVV.

Where the law requires a shorter retention period for a specific category, that shorter period prevails.

9. Your rights

To the extent that the GDPR or equivalent law applies to the processing of your personal data, you have the following rights, subject to the conditions and limits set out in the GDPR:

• the right of access (Article 15);
• the right to rectification (Article 16);
• the right to erasure (“right to be forgotten”) (Article 17);
• the right to restriction of processing (Article 18);
• the right to data portability (Article 20), for processing based on consent or contract and carried out by automated means;
• the right to object to processing based on legitimate interests, including profiling (Article 21), and an absolute right to object to processing for direct-marketing purposes at any time;
• the right to withdraw consent at any time, where processing is based on consent (Article 7(3)), without affecting the lawfulness of processing carried out before withdrawal;
• the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects (Article 22). As stated in section 5, we do not carry out such processing under our controller role.

You may exercise these rights by writing to privacy@kobby.ai. We will respond within one month, extendable by a further two months for complex or numerous requests in accordance with Article 12(3) GDPR. We may ask for reasonable information to verify your identity. We do not charge for handling requests unless they are manifestly unfounded or excessive within the meaning of Article 12(5).

10. Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, in accordance with Article 32 GDPR. These measures are described in the Technical and Organisational Measures section and include encryption in transit, encryption at rest for personal data stores, role-based access control, multi-factor authentication for administrative access, logging and monitoring, vulnerability management, backups and incident response procedures.

11. Children

The Platform and our website are intended for business use and are not directed to children under the age of 16. We do not knowingly collect personal data from children for our own controller purposes. If you believe a child has provided us with personal data, please contact privacy@kobby.ai and we will take appropriate steps to delete it.

12. Automated decision-making and profiling

As stated in section 5, when acting as controller Kobby does not carry out automated decision-making producing legal or similarly significant effects on data subjects within the meaning of Article 22 GDPR. Customers who use AI features inside the Platform are themselves controllers for those purposes and are responsible for assessing and lawfully implementing any such processing, as set out in the AI Processing Addendum.

13. Data not collected directly from the data subject

Where we receive personal data about you from someone other than yourself (for example, a colleague who invites you to a Customer workspace, or a public business register), we comply with Article 14 GDPR by informing you of the source, the categories of data, the purposes and the other information set out in this Privacy Policy at the first reasonable opportunity, ordinarily through this Privacy Policy and the welcome message you receive when first interacting with the Platform.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version, with its “Last updated” date, is always available at kobby.ai/legal.html. For material changes affecting how we process your personal data, we will give reasonable advance notice through the Platform, by email or by website notice before the changes take effect. Previous versions are available on request.

Storage & Tracking Technologies Disclosure

Last updated: 29 May 2026

This disclosure explains how the Kobby website and Platform store information on your device and how we comply with Article 5(3) of Directive 2002/58/EC (the “ePrivacy Directive”), as implemented in the Netherlands by Article 11.7a of the Telecommunicatiewet, and with Article 13 GDPR.

1. Technologies we do not use

• first- or third-party analytics cookies (e.g. Google Analytics, Plausible, Matomo cookie variants);
• advertising or retargeting cookies or pixels (e.g. Meta Pixel, LinkedIn Insight Tag, Google Ads);
• social-media share or login cookies;
• session-replay or heatmap tools that store identifiers on your device;
• device-fingerprinting techniques;
• web beacons or tracking pixels in our marketing emails for individual-level open or click tracking.

2. Technologies we do use, and why they are exempt from the consent requirement

A small set of technical mechanisms are necessary for the Platform to function. Each is described below together with the legal basis on which we rely under Article 5(3) ePrivacy and Article 6 GDPR. Authentication tokens are issued only after you log into the Platform with your credentials and are present only on the signed-in dashboard — not on the public website.

3. Information collected without storage on your device

Even though we do not store anything on your device for tracking purposes, your browser necessarily transmits some information to our servers every time you load a page:

• IP address, processed for routing, security, abuse prevention and aggregated geographic statistics. IP addresses are stored in server logs for up to 90 days and may be truncated or pseudonymised where feasible.
• User-agent string (browser, version, operating system), processed for compatibility, security and aggregate diagnostics.
• Request metadata (URL requested, response code, timestamp, referrer header), processed for service operation and security.

These are not stored on your device and so do not fall within Article 5(3) ePrivacy. They are personal data under the GDPR and are processed on the legal bases set out in section 5 of the Privacy Policy.

4. Email communications

We do not embed individual-level tracking pixels in our marketing or transactional emails. Email service providers may collect standard deliverability metadata (delivery status, bounces, spam reports) which we use for the integrity of our mailing system, not to profile individual recipients.

5. Changes to this disclosure

If we introduce any cookie or comparable storage technology in the future that requires consent under Article 5(3) ePrivacy, we will deploy a compliant consent banner that meets EDPB and AP guidance (genuine, granular, freely given consent with an equally prominent “reject all” option) before the technology is activated, and update this disclosure accordingly.

Refund Policy

Last updated: 26 May 2026

1. Scope

This Refund Policy applies to paid subscriptions and paid services purchased from Kobby, unless an order form, invoice or separate written agreement states otherwise. The Platform is offered for business use; the EU consumer right of withdrawal under Directive 2011/83/EU does not apply between businesses, but Kobby grants the voluntary refund period below.

2. Trial and refund eligibility

If a paid subscription includes a trial or refund period, the applicable terms will be stated during checkout or in the order form. Unless otherwise stated, a customer may request a refund within 14 days of the first paid subscription purchase, provided the customer has not previously received a refund and has not materially used custom development, implementation, or usage-based services.

3. Non-refundable items

• custom development, consulting, onboarding, migration, integration, training or implementation services;
• usage-based charges, AI usage, call minutes, messaging charges, storage overages or third-party pass-through fees;
• subscription periods already used, unless required by law or agreed in writing;
• refund requests made after the stated refund period;
• accounts suspended or terminated for breach of the Terms or unlawful use.

Payment for custom development, implementation, integration, consulting or other professional services does not transfer ownership, source code or intellectual property rights. Ownership and usage rights are governed by section 12 and section 13 of the Terms of Service and any applicable signed SOW.

4. How to request a refund

Contact support@kobby.ai with your account email, organisation name, invoice or subscription ID, purchase date and reason for the request. We may request additional information to verify eligibility.

5. Processing

Approved refunds are normally issued to the original payment method. Processing times depend on the payment provider. Cancellation of a subscription stops future billing but does not automatically entitle the customer to a refund for past charges.

Data Processing Agreement / AVV

Last updated: 29 May 2026

1. Definitions

Customer Personal Data means personal data contained in Customer Data that Kobby processes on behalf of Customer. Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in applicable data-protection law.

2. Roles

Customer is the controller of Customer Personal Data, unless Customer acts as processor for another controller, in which case Kobby acts as Customer’s sub-processor. Kobby processes Customer Personal Data as processor only on Customer’s documented instructions, including these Terms, the order form, Customer’s configuration and Customer’s use of the Platform. Kobby is an independent controller for account, billing, security, website, legal and business-contact data processed for Kobby’s own purposes.

3. Subject matter, duration, nature and purpose

The subject matter, duration, nature, purposes, types of data and categories of data subjects are set out in the Processing Annex below. Kobby will process Customer Personal Data for the duration of the Services and any post-termination deletion or export period.

4. Customer instructions

Kobby will process Customer Personal Data only on documented instructions from Customer, unless required by Union or Member State law to which Kobby is subject. If Kobby believes an instruction infringes applicable data-protection law, Kobby will inform Customer unless prohibited by law.

5. Customer obligations

• having a valid legal basis for processing Customer Personal Data;
• providing privacy notices and transparency information to data subjects;
• obtaining legally required consent, authorisation or approval for call recording and communications monitoring;
• handling data-subject requests and regulatory communications;
• setting retention rules and access permissions;
• assessing DPIA requirements and works-council or employee-consultation requirements where applicable;
• ensuring that Customer’s use of AI outputs and Platform analytics is lawful.

6. Confidentiality

Kobby will ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

7. Security

Kobby will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data, as described in the TOMs section. Customer acknowledges that security measures may evolve over time, provided they do not materially reduce the overall level of protection.

8. Sub-processors

Customer grants Kobby general authorisation to engage sub-processors listed in the Sub-processor List or otherwise notified to Customer. Kobby will impose data-protection obligations on sub-processors that are substantially equivalent to those in this DPA, including confidentiality, security, deletion and transfer obligations.

Kobby will provide at least 30 days’ prior notice of any new or replacement sub-processor through the Platform, by email or on this page. Customer may object on reasonable data-protection grounds within that notice period. If the parties cannot resolve an objection, Customer may terminate the affected Services for convenience according to the Terms or order form, with a pro-rata refund of pre-paid fees for the unused period.

9. International transfers

Where Customer Personal Data is transferred outside the EEA, UK, Switzerland or another relevant protected jurisdiction, Kobby will use appropriate transfer mechanisms as described in the International Transfer Terms.

10. Assistance

Taking into account the nature of processing and the information available to Kobby, Kobby will reasonably assist Customer with data-subject requests, DPIAs, prior consultation, security obligations, breach assessment, deletion, export and other obligations under applicable data-protection law.

11. Personal data breaches

Kobby will notify Customer without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting Customer Personal Data. The notice will include the information reasonably necessary for Customer to assess its notification obligations under Articles 33 and 34 GDPR, including the nature of the incident, affected data categories and approximate number of data subjects and records, likely consequences, mitigation measures taken or proposed, and a contact point for follow-up. Where the full information is not available within 48 hours, Kobby will provide an initial notification and supplement it as the investigation progresses.

12. Return and deletion

At the end of the Services, Kobby will return or delete Customer Personal Data according to Customer’s instructions, the Platform’s export/deletion functionality, the order form and applicable law. Unless a longer period is agreed in writing or required by law, deletion from active systems will be completed within 30 days of termination. Deletion from backups will occur according to standard backup cycles (typically up to 35 days), during which backup data remains encrypted, access-restricted and is not restored to active processing except where necessary for disaster recovery, legal compliance or security.

13. Audits and information

Kobby will make available the information reasonably necessary to demonstrate compliance with this DPA, including security documentation, sub-processor information, certifications, third-party audit summaries, questionnaires and contractual evidence. Customer may request an on-site audit no more than once per year (and more frequently in case of a documented incident or regulator request), upon reasonable prior notice, subject to confidentiality, security restrictions and limitations to protect other customers, systems or sensitive security information. Audits may be carried out through an independent, mutually acceptable third-party auditor where appropriate.

14. Order of precedence

If there is a conflict between this DPA and the other Terms, this DPA controls for the processing of Customer Personal Data as processor. Mandatory Standard Contractual Clauses control over conflicting terms for restricted international transfers.

Processing Description Annex

Last updated: 29 May 2026

Technical and Organisational Measures (TOMs)

Last updated: 29 May 2026

Kobby maintains appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful processing, in accordance with Article 32 GDPR. Measures may vary depending on plan, configuration, region, customer instructions and feature set.

Sub-processor List

Last updated: 29 May 2026

Kobby uses selected sub-processors to provide, secure, support and improve the Platform. Not all sub-processors are used for every customer or every feature. Actual use depends on configuration, region, enabled integrations, plan, customer instructions and product availability. Kobby will maintain an up-to-date list and provide at least 30 days’ notice of material changes as set out in the DPA/AVV.

International Transfer Terms

Last updated: 29 May 2026

These International Transfer Terms apply where Customer Personal Data is transferred from the European Economic Area, United Kingdom, Switzerland or another protected jurisdiction to a country that does not benefit from an adequacy decision or equivalent lawful transfer basis.

1. Transfer mechanisms

• European Commission Standard Contractual Clauses (Decision (EU) 2021/914);
• UK International Data Transfer Addendum or UK International Data Transfer Agreement where applicable;
• Swiss transfer adaptations where applicable;
• adequacy decisions by the European Commission or relevant authority;
• EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where applicable and valid;
• derogations or other lawful transfer mechanisms where permitted by Article 49 GDPR.

2. Standard Contractual Clauses

Where Standard Contractual Clauses are required, the applicable module is selected according to the parties’ roles: Module Two (controller-to-processor) for Customer-to-Kobby transfers where Kobby is established outside the protected jurisdiction, and Module Three (processor-to-processor) for Kobby-to-sub-processor transfers. The SCCs are incorporated by reference to the extent required for lawful transfers and prevail over conflicting terms.

3. Transfer impact assessments and supplementary measures

Where required, Kobby will reasonably assist with transfer impact assessments by providing information about processing, locations, transfer mechanisms, sub-processors and safeguards. Supplementary measures may include encryption in transit, encryption at rest, access restrictions, data minimisation, provider due diligence, contractual commitments and logging.

4. Onward transfers

Sub-processors may make onward transfers only where permitted under their agreement with Kobby and subject to appropriate safeguards. Kobby maintains a sub-processor framework designed to ensure onward transfers remain lawful.

AI Processing Addendum

Last updated: 29 May 2026

This AI Processing Addendum applies to AI-enabled features of the Platform, including AI chat, transcription, summarisation, classification, recommendations, drafting, search, workflow automation, analysis, insights and reporting. It is read together with the AI Act (Regulation (EU) 2024/1689).

1. Roles under the AI Act

Where Kobby develops AI functionality embedded in the Platform and places it on the market under its own brand, Kobby acts as a provider of an AI system within the meaning of Article 3(3) AI Act. Where Customer uses that functionality in the course of its own activity under its authority, Customer acts as a deployer within the meaning of Article 3(4). Customer may itself become a provider under Article 25 AI Act if it substantially modifies the system, puts it into service under its own name or trademark, or modifies the intended purpose into one that classifies the system as high-risk. Where the Platform integrates a general-purpose AI model from a third-party provider listed in the Sub-processor List, that third-party provider remains the provider of the underlying GPAI model.

2. Permitted AI use

Customer may use AI features to assist with business operations, CRM, ERP, workflow management, communications, documentation, support, analytics and productivity, subject to these Terms, applicable law and Customer’s internal policies.

3. Article 5 AI Act — prohibited practices

Customer must not use the Platform, and Kobby will not knowingly enable the Platform to be used, for any AI practice prohibited under Article 5 of the AI Act, including:

• subliminal techniques beyond a person’s consciousness, or purposefully manipulative or deceptive techniques, with the objective or effect of materially distorting a person’s behaviour in a way that causes or is likely to cause significant harm;
• exploitation of vulnerabilities of a person or group due to age, disability or specific social or economic situation;
• social scoring of natural persons based on social behaviour or personal characteristics leading to detrimental or unfavourable treatment;
• risk assessments of natural persons to assess or predict the risk of committing a criminal offence based solely on profiling or personality traits;
• untargeted scraping of facial images from the internet or CCTV to build or expand facial-recognition databases;
• emotion recognition in the workplace and educational institutions, except for strictly medical or safety reasons;
• biometric categorisation systems that infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation;
• real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, except in the narrow exceptions provided by the AI Act.

4. High-risk AI use cases

Customer must notify Kobby in writing before using the Platform for any use case classified as high-risk under Annex III of the AI Act, including biometrics; critical infrastructure; education and vocational training; employment, worker management and access to self-employment (including recruitment, performance evaluation, task allocation and promotion); access to essential private and public services and benefits (including creditworthiness, insurance pricing); law enforcement; migration, asylum and border control; and administration of justice and democratic processes. Such use is subject to a separate written assessment and to the additional safeguards required by Chapter III of the AI Act (risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy/robustness/cybersecurity, post-market monitoring and conformity assessment), as allocated between Kobby and Customer based on their respective roles.

5. Customer responsibilities (Article 26 obligations of deployers)

• determining whether an AI use case is lawful, appropriate and proportionate;
• providing notices and obtaining consent or authorisation where required;
• ensuring effective human oversight of AI outputs before they are used for important business or individual-impacting decisions, by persons with the necessary competence, training and authority;
• assigning input data that is relevant and sufficiently representative for the intended purpose, where Customer controls the input;
• monitoring the operation of the AI system in line with Kobby’s instructions and informing Kobby of serious incidents or risks identified;
• conducting a fundamental rights impact assessment (FRIA) where required by Article 27 AI Act;
• complying with works-council, staff-council or employee-consultation duties before deploying AI systems in the workplace;
• ensuring that AI outputs are not used in a discriminatory, deceptive, unsafe, unlawful or unfair manner.

6. Article 50 transparency obligations

From 2 August 2026, the Platform implements the transparency requirements of Article 50 AI Act:

• natural persons interacting with an AI system (for example AI chat or voice agents) are informed that they are interacting with an AI system, unless that is obvious from the circumstances and context of use;
• synthetic audio, image, video or text content generated or manipulated by the Platform is, where required, marked as artificially generated or manipulated in a machine-readable format;
• where Customer uses AI to generate text published with the purpose of informing the public on matters of public interest, Customer must disclose that the text has been artificially generated, except for limited exceptions in the AI Act;
• where Customer deploys an emotion-recognition or biometric-categorisation system (outside the prohibitions in Article 5), Customer must inform the natural persons exposed to it.

7. No unauthorised model training

Kobby will not use Customer Personal Data — including audio, transcripts, prompts, outputs, embeddings, files, CRM/ERP records or metadata — to train general AI models, and contractually requires its AI sub-processors not to use Customer Personal Data to train their models, unless Customer expressly authorises it in writing and a valid legal basis and transparency requirements are satisfied.

8. AI provider routing

Kobby may route AI requests to approved AI providers listed as sub-processors. Routing may depend on availability, performance, configuration, geography, model capability, legal restrictions and customer settings. Customer may, where the Platform supports it, restrict routing to specific providers or regions.

9. Accuracy, review and traceability

AI outputs may be inaccurate. Customer must review AI outputs before relying on them. Where feasible, Kobby maintains traceability between AI outputs and the relevant input, such as the source message, call, transcript, record, workflow, prompt or integration event, and logs in accordance with the TOMs.

Call Recording Addendum

Last updated: 29 May 2026

This Call Recording Addendum applies where Customer enables call recording, call logging, voice processing, speech-to-text, transcription, call summaries, voice analytics or AI analysis of calls through the Platform or connected telephony providers.

1. Customer responsibility for lawful recording

Customer is responsible for ensuring that every call recording is lawful. This includes determining and documenting the legal basis, providing required notices, obtaining consent or authorisation where required, handling objections, training employees, configuring non-recorded alternatives and complying with telecommunications, employment, criminal, consumer-protection and data-protection laws of all relevant jurisdictions.

2. Member-State variations

Call-recording rules vary significantly across EU Member States. Without limitation:

• Netherlands — Articles 139a–139c of the Dutch Criminal Code criminalise unlawful recording of private conversations; for B2B and call-centre contexts, AP guidance imposes strict transparency and retention requirements.
• Germany — § 201 StGB protects the confidentiality of the spoken word; in commercial practice, recording of telephone conversations typically requires the consent of all parties.
• France — CNIL guidance requires prior information and proportionate retention; recording for quality or training purposes must be limited and justified.
• Italy and Spain — Garante and AEPD impose specific transparency, retention and access-rights duties.

3. No recording before required notice or authorisation

Where applicable law requires consent, authorisation or prior notice before recording, Customer must configure the Platform and related telephony systems so that recording does not start until the required step is completed. In jurisdictions with stricter rules, including Germany, Customer must ensure that legally valid authorisation or consent is obtained before recording begins, unless a specific lawful exception applies.

4. Inbound calls

For inbound calls, Customer should ensure that callers receive a clear announcement before recording starts, explaining that the call may be recorded, transcribed, analysed using AI, stored and used for specified purposes such as documentation, quality assurance, customer support, compliance, training or workflow management. Where required, callers must be given a genuine choice or an alternative non-recorded channel.

5. Outbound calls

For outbound calls, Customer must ensure that the called party is informed before recording starts and that any required consent or authorisation is obtained. Recording should be technically blocked, delayed or discarded if the required notice or authorisation step fails, where such controls are available.

6. Internal and employee calls

If employee calls may be recorded or analysed, Customer must provide employee notices, internal policies, training, legal-basis assessments, retention rules and human-oversight rules. Where a works council, staff council, union or similar employee representative body has co-determination or consultation rights, Customer must complete the required process before enabling recording or monitoring features. Customer must also assess Article 5 AI Act limits on emotion recognition in the workplace.

7. Recording logs

Where technically available, Kobby will provide recording-related logs such as call ID, direction, user, timestamp, recording start/stop time, notice/consent configuration, recording status, transcript status, AI processing status, export events and deletion events. Customer is responsible for using these logs to demonstrate compliance.

8. AI processing of recordings

AI processing of calls must only be enabled where recording and subsequent processing are lawful. Customer must ensure that notices cover transcription, summarisation, AI analysis, retention, recipients and rights where required. Kobby will process recordings and transcripts according to Customer’s instructions and the DPA/AVV.

9. Retention and deletion

Customer is responsible for setting retention periods for recordings, transcripts, summaries, metadata and AI outputs. Kobby implements deletion according to Platform functionality, Customer instructions and applicable technical limitations, including backup deletion cycles described in the DPA.

GDPR Compliance

Last updated: 29 May 2026

1. Controller and processor roles

Kobby acts as controller for personal data processed for its own business purposes and as processor for Customer Personal Data processed through the Platform on behalf of Customer. Customer remains responsible for determining purposes, legal bases, retention, access rules, notices, AI use cases, call-recording rules, employee-data processing and data-subject rights.

2. Customer-side GDPR documents

• privacy notices for customers, callers, employees, suppliers and other data subjects;
• lawful-basis assessments and legitimate-interest assessments;
• call-recording scripts and consent/authorisation records;
• Data Protection Impact Assessments for high-risk processing;
• records of processing activities;
• retention and deletion policies;
• data-subject-rights procedures;
• employee-monitoring and AI-use policies;
• works-council, staff-council, union or employee-representative agreements where required;
• AI governance and human-oversight documentation; fundamental-rights impact assessments where required.

3. Kobby-side GDPR controls

• DPA/AVV under Article 28 GDPR;
• Technical and Organisational Measures under Article 32 GDPR;
• sub-processor management with at least 30 days’ notice and contractual flow-down obligations;
• international transfer safeguards under Chapter V GDPR;
• incident-response and breach-notification procedures (within 48 hours to Customer);
• access, export and deletion procedures;
• support for DPIAs and data-subject rights;
• AI-processing safeguards and no-unauthorised-model-training commitment.

4. Data-subject requests

Where Kobby receives a request relating to Customer Personal Data, Kobby will refer the request to the relevant Customer and reasonably assist Customer with requests for access, deletion, correction, restriction, objection and portability, taking into account Platform functionality and the nature of processing.

5. Supervisory authority

The lead supervisory authority for Kobby is the Dutch Autoriteit Persoonsgegevens (AP). Data subjects also have the right to lodge a complaint with the supervisory authority of their country of residence, place of work or place of the alleged infringement.

Contact

Last updated: 29 May 2026

For questions about these Legal Policies, please contact:

• Legal: legal@kobby.ai
• Privacy contact: privacy@kobby.ai
• Support: support@kobby.ai
• Postal address: Kobby AI, Johan Huizingalaan 763A, 1066 VH Amsterdam, Netherlands
• KvK: 67320465