Privacy Policy

Cubecen is not yet incorporated. Until it is, the Service is run by Ismail Aki, the founder of Cubecen, an individual based in Poland, who is the data controller for the personal data described here.

Postal address: 29 Listopada 3C/3, 00-465 Warsaw, Poland. Email: privacy@cubecen.com.

When a company is formed to run Cubecen, it will take over as data controller. We'll update this policy and let you know.

• Account data: your name, email address, organization, team memberships and roles, and sign-in details from our authentication provider.
• Source and integration data: when you connect GitHub, the installations and repositories you grant access to, and the code we fetch to build the applications you ask us to deploy.
• Customer content: the code, build images, configuration, environment variables, secrets, databases, and models you run on Cubecen. Secrets are stored encrypted and are write-only: nobody, including us, can read them back through the product.
• Operational data: runtime logs, build and deploy logs, metrics, and release history for your cubes, which we show you in the dashboard.
• Usage data: basic technical information about how the website and dashboard are used, such as pages viewed, browser type, and IP address, used to keep the Service secure and working.
• Billing data: once billing starts, the details needed to bill you. Card details are handled by our payment processor, not stored by us.
• Communications: messages you send us, for example to sales or support.

Cubecen doesn't monitor or track the data that goes through your models or through the AI gateway, and we never use it to train our own models or for any purpose of our own.

The AI gateway is on our roadmap and isn't available yet. When it launches and you route a request through it to a third-party provider you have chosen, such as OpenAI or Anthropic, we will pass that request to the provider so it can answer. Today, your apps can call those providers directly. Either way, the provider's own terms and privacy policy apply to what it receives.

• To provide the Service: build, deploy, run, and observe your cubes, and show you their logs and metrics.
• To operate your account: sign-in, organizations, members, roles, and invitations.
• To keep the Service secure and reliable: detect abuse, investigate incidents, and enforce our Terms.
• To communicate with you: service notices, security alerts, and replies to your messages. Product news only where you've agreed to it.
• To bill you once paid plans open, and to meet legal obligations.

Where the GDPR or a similar law applies, we rely on performing our contract with you, our legitimate interests in running a secure service, your consent where we ask for it, and our legal obligations.

We don't sell personal data. We share it only with service providers that help us run Cubecen, under contracts that limit their use of it:

• Cloud infrastructure providers that host and run the platform.
• Cloudflare, for DNS, TLS certificates, and the edge network in front of your applications.
• GitHub, when you connect repositories.
• Our authentication provider, for sign-in.
• Payment and email delivery providers, once billing and notifications need them.
• AI providers you choose to call through the gateway, once it launches, for the requests you send them.

We may also disclose data if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to protect it.

• Runtime logs: 7 days.
• Build and deploy logs: 30 days.
• Metrics: 30 days.
• Customer content: for as long as it's in your account. When you delete a cube or close your account, we delete it, apart from short-lived backups that expire on their own.
• Account and billing records: while your account is open, and afterwards only as long as the law requires.

Traffic to Cubecen and to your applications is encrypted with HTTPS. Secrets are encrypted at rest and write-only. Each project has its own private network, and access inside an organization is controlled by roles. No system is perfectly secure, so if you find a vulnerability, please tell us at the address below.

Cubecen and its providers may process data in countries other than yours. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

Under the GDPR, and similar laws such as the UK GDPR and Türkiye's KVKK, you can ask to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Most account data can be changed in the dashboard; for anything else, email us and we'll reply within the time the law sets.

You can also complain to a data protection authority. Ours is Poland's President of the Personal Data Protection Office (UODO, uodo.gov.pl), and you can also go to the authority where you live or work.

We use the cookies needed for sign-in and security in the dashboard. We don't use advertising cookies, and we don't sell or share browsing data for advertising.

Cubecen isn't meant for children under 16, and we don't knowingly collect their data.

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll tell you by email or in the dashboard before it takes effect.

Questions or requests about privacy: privacy@cubecen.com, or by post to 29 Listopada 3C/3, 00-465 Warsaw, Poland.