Privacy Policy

1. What this covers

This policy explains what we collect and how we use it when you use Cubes Cloud (the hosted service at cubes.im) and our websites. If you self-host Cubes, your data lives on your own infrastructure and this policy does not apply to that deployment — your organization is the data controller there.

2. What we collect

• Account data — name, email, password (stored hashed), avatar, and workspace/team membership.
• Workspace content — the projects, tasks, comments, files, videos, docs, HR records, and other content you and your team create.
• Billing data — plan, invoices, and payment status. Card details are handled by our payment processor and never touch our servers.
• Usage & device data — logs (IP address, browser, timestamps) and basic product analytics used to keep the Service secure and improve it.
• Client portal visitors — portal access is token-gated; we log access events but do not require your clients to create accounts.

3. How we use it

• To provide, secure, and improve the Service;
• To send transactional email (invites, notifications, receipts, security alerts);
• To respond to support requests;
• To comply with legal obligations.

We do not sell your personal data or your content, and we do not use your content to train AI models. Optional AI features run only when your workspace configures them, using the provider you choose.

4. Where your data lives

Cubes Cloud runs on managed cloud infrastructure (application hosting, Postgres database, and file storage provided by our infrastructure subprocessors). All data is encrypted in transit (TLS) and at rest. Authorization is enforced in the database itself via row-level security, so your workspace’s data is isolated from other tenants.

5. Cookies

We use essential cookies only: session authentication and your UI preferences (like theme). We do not run third-party advertising or tracking cookies on the product.

6. Sharing

We share data only with:

• Subprocessors that host and operate the Service (cloud infrastructure, email delivery, payment processing) under data-processing agreements;
• People you choose — teammates in your workspace, and clients you invite via portals or share links;
• Authorities when required by law, after verifying the request.

7. Retention & deletion

Your data is retained while your account is active. When you delete content, your account, or your workspace, it is removed from production systems promptly and from backups within 30 days. After subscription termination we keep workspace data available for export for 30 days, then delete it.

8. Security

We follow industry practice: encrypted transport and storage, row-level security on every table, scoped API keys, and least-privilege access for our team. No system is perfectly secure — report vulnerabilities to security@cubes.im and we will respond quickly.

9. Your rights

Depending on your location (e.g. GDPR in the EU), you may have rights to access, correct, export, restrict, or delete your personal data. You can exercise most of these directly in Settings (profile editing, data export, account deletion) or by emailing privacy@cubes.im. If you are a member of someone else’s workspace, your workspace owner controls that workspace’s data — direct requests to them first.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy; material changes are announced by email or in-product notice at least 14 days in advance. The “Last updated” date above always reflects the current version.

12. Contact

Privacy questions: privacy@cubes.im. General support: support@cubes.im. See also our Terms of Service.