Privacy Policy

Who this covers

This policy covers two groups, and it is worth being clear about the difference. The first is you — the person who signs up, logs in and pays. The second is your customers, whose orders and messages flow through CubieFlow because you connected a sales channel.

For your own account data, we are the data controller. For your customers' data, you are the controller and we are the processor acting on your instructions. The Data Processing Agreement covers that second relationship in detail.

What we collect

Only what the product needs to work, plus what the law requires us to keep.

• Account data: name, email address, password hash, and the workspaces you belong to.
• Billing data: company name, billing address, tax identifiers, and the last four digits of a card. Full card numbers are held by our payment provider, never by us.
• Commerce data: orders, products, customers, transactions, shipments and messages, imported from the channels you connect.
• Usage data: which screens you open and which actions you take, used to find broken workflows.
• Technical data: IP address, browser and device type, retained for 90 days for security investigation.

What we do not do

We do not sell personal data, and we do not share it with advertisers. We do not use your commerce data to train models that serve other customers. We do not read your customer conversations except when you ask us to investigate a specific problem, and that access is time-limited, requires a written reason and is recorded in an audit log you can read.

Where data lives

You choose a region when you create a workspace: Europe, North America or Asia Pacific. Your commerce data stays in that region. Backups stay in the same region.

Some subprocessors operate globally — payment providers, email delivery, error monitoring. Each is listed in the DPA with what they receive and why. Transfers outside your region rely on Standard Contractual Clauses.

How long we keep it

Commerce data is kept for as long as your workspace is active. When you close a workspace, it is deleted after 30 days — a window that exists so an accidental deletion can be undone.

Some records outlive that window because the law requires it. Invoices and tax records are kept for seven years. Audit log entries are kept for 24 months and cannot be deleted by anyone, including us; that is the point of an audit log.

Your rights

Wherever you are, you can ask us to show you what we hold, correct it, export it in a portable format, or delete it. If you are in the EU, UK, California or another jurisdiction with specific statutory rights, those rights apply in full.

Most of these are self-serve inside the product rather than a request you have to file. Export is a button. Deletion is a button. If you would rather ask a person, write to privacy@cubieflow.com and we will respond within 30 days.

Security

Data is encrypted in transit and at rest. Provider credentials are encrypted separately with envelope encryption and are decrypted only inside the worker that needs them — they are never returned by the API, and no member of staff can read them.

Access to production is least-privilege and logged. If a breach affects your data, we will tell you within 72 hours of becoming aware, with what we know at that point rather than after the investigation concludes.

Changes

If we change this policy in a way that materially affects you, we will email you at least 30 days before it takes effect. Minor clarifications are published with an updated date and noted in the changelog.