Privacy Policy

1. Who we are

CORBU.EX is operated by corbu.ex Limited, a company registered in Hong Kong (Business Registration Number 79318379), with its registered office at 11/F Wing Hing Factory Bldg, San Po Kong, Kowloon, Hong Kong.

We handle personal data in accordance with applicable Hong Kong law, including the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO"). We do not claim any certification or approval by a privacy regulator.

For any question about this policy, contact hello@corbu-ex.com.

2. What CORBU.EX Perform is

CORBU.EX Perform is a hospitality performance management product. It helps managers and hospitality organisations prepare and manage employee performance conversations using information such as roles, KPIs, KPI targets, KPI results, manager observations, conversation preparation, performance history, conversation findings, agreed actions and follow-ups.

3. Information we process

Depending on how CORBU.EX is used, we may process the following categories of personal data.

• Account and business information: name, business email address, company or organisation, job title or role, business contact details, account information and interface preferences.
• Employee and performance information entered by customers: employee name, role, department or operating unit, conversation dates, KPI targets and results, manager observations, performance-related notes, conversation findings, agreed actions, follow-up information and historical conversation records.
• Technical information: IP address, browser and device information, authentication information, security and system logs, and usage information necessary to operate and secure the service.
• Commercial information: subscription plan, billing status, subscription and customer identifiers held by our payment provider, and related transaction information.

4. Employee performance information

Business customers and managers may enter information about employees into CORBU.EX Perform. We process that information in order to provide the service to the customer.

We do not independently verify individual manager observations, and we are not the employer of the people described in a customer's account. Outputs produced by CORBU.EX are management support and are not legally binding employment decisions.

5. Sensitive information

CORBU.EX Perform is not intended for unnecessary sensitive personal information. Users should not enter sensitive information unless it is genuinely necessary and permitted for their use of the service.

Medical diagnoses, health details, religion, political opinions and similar information do not belong in performance notes. Approved sick leave is treated as neutral context in the product and is never used as a negative performance score.

6. Why we process personal data

• To create and manage accounts and provide CORBU.EX Perform.
• To prepare conversation materials, maintain performance history and display KPI development.
• To maintain agreed actions and follow-ups and to provide management dashboards.
• To send conversation reminders and management digests.
• To administer subscriptions and process Business enquiries.
• To provide customer support, maintain security, troubleshoot the service and prevent misuse.
• To improve the reliability and functionality of the service and to keep required business and compliance records.

Authorised CORBU.EX personnel may access a customer's employee and performance data where this is necessary to handle a support request or investigate a technical issue, and only to the extent required for that purpose. This support access is read-only and is logged. CORBU.EX does not routinely monitor employee performance data and does not use it for its own purposes.

7. How analysis and suggestions are produced

Preparation documents, KPI analysis, suggested conversation questions and suggested actions are produced by the CORBU.EX Perform software from the information entered by users. The current production system does not send personal data to an external AI provider. If that changes, this policy will be updated before such processing begins.

System-generated content is management support. It is not an automatic employment decision. We do not instruct employers to make hiring, dismissal, promotion, disciplinary or compensation decisions solely on the basis of system output. Managers remain responsible for reviewing information and making their own management decisions.

8. Accuracy of submitted information

Performance information is entered by managers or other authorised users. Customers and users are responsible for making sure that the information they submit is appropriate and reasonably accurate. We do not claim that submitted employee information is independently verified.

9. Service providers

We use a small number of providers to operate the service. We share personal data with them only to the extent needed for the purposes described above.

• Lovable — application hosting and deployment infrastructure for the website and product.
• Supabase — database, authentication and file storage used by CORBU.EX Perform.
• Stripe — payment and subscription processing for the Individual subscription.
• Resend — delivery of operational product emails such as conversation reminders and management digests.

10. Payments

Payment and subscription transactions for the Individual subscription are processed by Stripe. Payment card details are entered with Stripe and remain with Stripe; CORBU.EX does not store complete payment card information.

We receive information such as the customer and subscription identifier, subscription status, payment status, billing cycle and related transaction information, which we use to manage entitlements and billing.

11. Product emails

CORBU.EX sends operational product emails, including performance conversation reminders, management digests and relevant account or service communications. These are sent from CORBU.EX Perform <hello@corbu-ex.com> Automated product emails are written in English, German or Thai according to the CORBU.EX language stored in the recipient's user account; if no supported language is stored, English is used.

These are product and service communications rather than marketing. If marketing communication is introduced later, it will be handled separately.

12. Cross-border processing

CORBU.EX is operated from Hong Kong and uses international cloud and service providers. Personal data may therefore be processed or stored outside Hong Kong, depending on the provider and infrastructure involved.

Where cross-border processing is necessary to operate the service, we use reasonable contractual, organisational and technical safeguards.

13. Retention and deletion

We retain personal data only for as long as reasonably necessary to provide the service, maintain the account, maintain the performance history the customer has asked us to keep, meet contractual obligations, maintain security, handle disputes and satisfy legal, accounting and compliance requirements.

Retention and account deletion are separate concepts. When an Individual subscription is cancelled or expires, historical performance information is preserved and remains readable; it is not automatically deleted.

Deletion requests can be sent to hello@corbu-ex.com. We cannot promise instant deletion where legal, contractual, security or record-keeping obligations require certain information to be retained.

14. Security

We use reasonable administrative, technical and organisational measures to protect personal data. These include authenticated accounts, access controls at database level, encrypted transmission, server-side entitlement checks, restricted system access and payment processing through Stripe.

Administrative support access requires separately authorised access and is logged. Normal customer accounts do not gain access to other customers' data. Administrative support access to employee and performance data is read-only.

No system can be guaranteed to be completely secure, and we do not promise absolute security.

15. Access and correction

Under the PDPO you may request access to, and correction of, your personal data where applicable. Send such requests, and any other privacy question or account or data enquiry, to hello@corbu-ex.com.

Where employee information was entered by an employer using CORBU.EX, we will normally direct the request to that customer, who controls the content of their account.

16. Cookies and browser storage

The website and product use only technology that is necessary to operate them. Authentication uses secure session storage in the browser so that a signed-in manager stays signed in. The selected CORBU.EX language (English, German or Thai) is saved as a user setting in the account. It is used, among other things, to show the interface and send automated product emails in that language. A copy is also kept in the browser so the website appears in the chosen language before signing in.

We do not currently use advertising cookies or third-party analytics or tracking services. Payment pages hosted by Stripe use their own necessary technology. If non-essential tracking is introduced later, consent requirements will be addressed separately.

17. International users

CORBU.EX is operated by corbu.ex Limited in Hong Kong and is primarily designed for hospitality businesses and managers in international markets. Where additional privacy requirements apply because of a user's location or our activities, we will address the applicable requirements as required.

18. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes to CORBU.EX, its service providers or applicable requirements. The date of the current version is shown at the top of this page.

19. Contact

corbu.ex Limited, 11/F Wing Hing Factory Bldg, San Po Kong, Kowloon, Hong Kong. Email: hello@corbu-ex.com.