Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how KOBU ("we", "us", "our") collects, uses, and protects information when you visit kobu.co or submit our Work With Us inquiry form. We aim to be straightforward — we collect the minimum we need to run the site and respond to enquiries, and we don't sell or rent your data.

Who we are

KOBU is a creative studio. For questions about this policy or your data, contact us at hello@kobu.co.

What we collect

When you submit the Work With Us form, you provide:

Your name, email address, and company name (required to respond to you).
Your project type, budget range, timeline, and a free-text message describing your project (used to triage your enquiry).
Optionally, your website.

We also record your browser's user agent string and a timing signal automatically when you submit, purely for spam and bot filtering.

If you reached us from one of our advertisements, we store the advertising click identifier and campaign name alongside your enquiry, so we can tell which advertising produced it. We never send your message, company, budget or timeline to any advertising platform.

When you browse the site, our hosting provider Vercel records standard server logs (including IP address, page requested, timestamp, referrer, and user agent) for security and operations purposes. We use Vercel Web Analytics, which is cookieless: it counts page views, top pages, referring domains, country, and device type without tracking individual visitors or setting any analytics cookies.

When you arrive from an advertisement, we use Google Tag Manager and Google Ads conversion measurement so we can tell which advertising produces genuine enquiries. This records the advertising click identifier from the link you followed, keeps it in your browser's own storage for up to 90 days, and sets first-party Google advertising cookies (names beginning "_gcl_").

We do not use Google Analytics, Meta pixels, or cross-site tracking, and we do not build advertising profiles or target you elsewhere on the internet.

Why we use this information

To respond to your enquiry and continue any resulting conversation.
To understand aggregate site traffic so we can improve the site.
To measure which of our advertisements produce genuine enquiries, so we spend on advertising that works.
To protect the site from abuse and spam.
To comply with legal obligations where they apply.

Under the GDPR, we rely on your consent (given by voluntarily submitting the form) for processing enquiry data, and on legitimate interests for operational logs, aggregate analytics, and measuring the effectiveness of our own advertising.

Who we share data with

We share data only with the service providers that help us run the site, each acting as a processor on our behalf:

Vercel Inc. (United States) — hosting, server logs, cookieless analytics.
Neon Inc. (United States) — database hosting for form submissions.
Cloudflare Inc. (United States) — image and media delivery.
Google Ireland Limited and Google LLC (United States), for advertising measurement and conversion reporting.

These providers process data on our instructions. Where personal data is transferred from the European Economic Area or the UK to the United States, we rely on Standard Contractual Clauses and the providers' own approved transfer mechanisms.

When you submit an enquiry, we send Google a one-way hash of your email address, which is an irreversible scramble rather than the address itself, so Google can confirm that an enquiry followed one of our advertisements without being able to read who you are. We send nothing else: not your message, not your company, not your budget, not your timeline.

We do not sell or rent personal information, and we do not share the content of your enquiry with advertisers or marketing networks.

How long we keep it

Enquiry submissions: retained for as long as the conversation is active, and for up to 24 months thereafter to maintain context for follow-on work.
Server logs: typically retained by Vercel for 30 days.
Analytics data: aggregate only, no personal identifiers.
Advertising click identifiers: up to 90 days in your browser, and alongside your enquiry record for as long as we keep the enquiry.

You can ask us to delete your enquiry data at any time.

Your rights

If you're in the EEA, UK, California, or another jurisdiction with applicable privacy law, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to or restrict our processing.
Receive a copy of your data in a portable format.
Withdraw consent at any time (without affecting the lawfulness of prior processing).

To exercise any of these rights, email us at hello@kobu.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Cookies

Public pages set first-party Google advertising cookies (names beginning "_gcl_"), used only to measure whether our own advertising produces enquiries. For the same purpose we keep an advertising click identifier in your browser's local storage for up to 90 days. The only other cookie is the session cookie required to log into the KOBU admin panel, used by KOBU staff. We set no third-party cookies and run no cross-site advertising profiles.

Our advertising currently reaches audiences outside the European Economic Area and the UK. Before we advertise to visitors there, we will add a consent banner and honour its choices through Google Consent Mode.

Children

The site is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

Security

We protect data using TLS in transit and at-rest encryption provided by our hosting and database providers. The Work With Us form includes anti-bot measures (honeypot fields and timing checks). No system is perfectly secure, but we take reasonable precautions.

Changes to this policy

We may update this policy occasionally. Material changes will be flagged on this page with a new "Last updated" date.

Contact

Privacy questions: hello@kobu.co.