Privacy policy

1. Who we are

Umbiko B.V., established in Bussum, the Netherlands, is the controller of personal data processed through this website and the procurement platform.

You can reach us at hello@umbiko.ai for any privacy-related question, including requests to exercise your rights.

2. What data we collect

Account data: name, business email address, company, job title provided by you when signing up for a trial account or requesting a demo.

Usage data: visited pages, used features, timestamps, browser and device metadata, click, scroll, and interaction data. On the public website, this data may be processed via Microsoft Clarity for analytics, heatmaps, and session recordings, after you have given consent via the cookie banner. Sensitive form fields and personally identifiable information are masked where possible.

Document content — procurement platform only: tenders, quotations, and related files that you upload. This data is stored strictly within your own tenant.

Chat conversations: messages with the marketing chatbot are temporarily processed to generate a response and are not retained long-term.

3. Why we process your data

To provide and improve the service: account creation, authentication, document analysis, support.

To communicate with you: respond to demo requests, send service updates, security advisories.

To comply with legal obligations such as accounting and tax law.

Our legal basis is contract performance (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f)) for product analytics, and consent (Art. 6(1)(a)) where we ask for it explicitly.

4. Where data is stored

All personal data and customer documents are stored in Microsoft Azure data centres in the European Union (West Europe region). Data does not leave the EU.

We use Microsoft Azure as a sub-processor under a Data Processing Agreement that complies with Art. 28 GDPR.

5. Sharing with third parties

We do not sell personal data. We share data only with sub-processors strictly necessary to deliver the service: Microsoft Azure (hosting, AI services) and Microsoft Clarity (analytics on the public site).

If we ever introduce additional sub-processors we will notify customers in advance.

6. Retention

Trial accounts: documents and account data are retained for 90 days after the trial ends, then permanently deleted.

Paid accounts: data is retained for the duration of the contract plus 30 days, after which it is permanently deleted unless legal retention obligations apply.

Marketing leads (demo requests): retained for 24 months unless you ask us to delete them sooner.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. You can also withdraw consent at any time.

To exercise any of these rights, email hello@umbiko.ai. We respond within one month.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — autoriteitpersoonsgegevens.nl.

8. Security

We apply industry-standard technical and organisational measures: encryption in transit (TLS) and at rest, role-based access control, audit logging, automated patching, principle of least privilege.

Our roadmap targets SOC 2 Type II. Suspected security issues can be reported to security@umbiko.ai.

9. Cookies

On our public website, we use cookies and similar technologies. Cookies are small text files that are placed on your device when you visit our website.

We use the following types of cookies:

Necessary cookies These cookies are required for the website to function properly. Without these cookies, certain parts of the website may not work correctly.

Analytics and optimisation cookies We use Microsoft Clarity to better understand how visitors use and interact with our website. This may involve the collection of behavioural data, heatmaps, and session recordings. We use this information to improve our website, communication, and services, to measure the popularity of pages and website elements, for site optimisation, security/fraud prevention, and — where applicable — for marketing and advertising purposes.

Website usage may be recorded through first-party and third-party cookies and similar tracking technologies. Microsoft may also process this data in accordance with its own privacy terms. More information about how Microsoft collects and uses data can be found in the Microsoft Privacy Statement (https://www.microsoft.com/nl-nl/privacy/privacystatement).

Microsoft Clarity is only loaded after you have given consent via our cookie banner. If you choose “Reject”, no Clarity cookies will be placed and the Clarity script will not be loaded.

Clarity automatically masks sensitive form fields and personally identifiable information. We do not enrich Clarity data with external identifiers.

You can manage or delete cookies through your browser settings. In addition, you can adjust your cookie preferences via our cookie banner.

10. Changes

We may update this policy from time to time. Material changes are announced on the website at least 30 days in advance. The "last updated" date above always reflects the current version.