CUBICBUILDS
Who is responsible for your data
Pending publication, the operator of CubicBuilds, decides how and why your personal data is used. Data-protection law calls this the "controller".
- Controller
- Pending publication
- Address
- Pending publication
- Country
- Pending publication
- Privacy contact
- [email protected]
This policy covers cubicbuilds.com, the app at app.cubicbuilds.com and our support and community channels. We have not appointed a data protection officer, because the law does not require one for an operation of our size: [email protected] is the channel, and the area in charge, for every privacy request.
The data we collect
Your email address is required to have an account: without it we cannot sign you in. Everything else is either optional or results from using the Service.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, display name (your Discord name, or the part of your email before the @), language, account status and dates. | You; Discord if you sign in with it |
| Discord sign-in, only if you use it | Your Discord user ID, name, avatar address and verified email, and the access tokens Discord issues, which we store encrypted. We request the "identify" and "email" permissions only. | Discord |
| Sessions and security | A session identifier (stored as a hash), your IP address and browser type, and short-lived counters that limit repeated attempts. | Your device |
| Organizations | The organizations you belong to, your role, and invitations: the invited email, who invited and who accepted. | You; whoever invited you |
| Your content | Prompts and messages to the AI, project names, rules and notes, style answers and comments, reference images, schematics and other files, generated builds, renders and revisions, and the technical log of each generation. | You; generated by the Service |
| Usage and credits | Generations run, credits granted and used, your plan and the codes you redeem. | Generated by the Service |
| Activity records | A record of important actions in your organization (who did what, and when), including actions by our staff. | Generated by the Service |
| Purchases | When you buy, PayNow tells us your name, email, billing details and what you bought. We never receive your full card number. | PayNow |
| Messages to us | What you write to us by email or on Discord. | You |
| Technical logs | For each request: an identifier, the address requested, the result and how long it took. | Your device |
We do not collect payment card numbers, precise location or advertising identifiers, and we do not ask for special categories of data such as health, beliefs or biometrics. Please keep personal data about other people, and sensitive information, out of your prompts and files.
What we use it for, and on what basis
| What we do | Data used | Legal basis under the GDPR |
|---|---|---|
| Create and run your account, sign you in, and manage organizations and invitations | Account, Discord sign-in, sessions, organizations | Performing our contract with you |
| Generate, store, show and export your builds, which includes sending your request to our AI provider | Your content, usage | Performing our contract with you |
| Count credits, apply plans and limits, and handle purchases | Usage and credits, purchases | Performing our contract with you; a legal obligation for the accounting and tax records we must keep |
| Keep the Service secure: prevent abuse and fraud, limit repeated attempts, keep activity records and protect against attacks | Sessions and security, activity records, technical logs | Our legitimate interest in a secure and reliable service |
| Help you when you ask and fix problems, which can include opening a build or reading a generation's technical log | Your content, messages to us | Performing our contract with you; our legitimate interest in fixing faults |
| Send service messages: sign-in codes, confirmations and important notices | Account | Performing our contract with you |
| Show builds in our gallery and marketing, without personal data | Builds, renders and the edited request | Our legitimate interest in showing what the Service does. You can object at any time |
| Improve the Service: the shared style library, quality checks and aggregate figures | Style options, usage | Our legitimate interest in improving the Service |
| Comply with the law and defend legal claims | What each case requires | A legal obligation; our legitimate interest in defending our rights |
We do not send marketing emails. If we ever do, it will be only with your consent, and every message will let you unsubscribe.
In countries where the law takes your authorization as the basis for processing, such as Colombia and Argentina, you give it when you create your account and accept this policy, and you can withdraw it by asking us to delete your account.
We do not take decisions that produce legal or similarly significant effects on you by automated means alone. Limits on repeated attempts are applied automatically: if one affects you unfairly, write to us and a person will review it.
How the AI handles your requests
To generate a build we send your request to Anthropic, the company that provides the Claude AI models. The request contains the text you wrote, the reference images and areas you attached, recent messages of the conversation and the context of the project: its name, your rules and notes, file names and style choices. We do not attach your name, your email address or your account identifiers to it.
- Anthropic processes this content on our behalf, to return the result. Under its commercial terms it may not use it to train its models.
- Anthropic deletes requests and results from its systems within 30 days by default. Content that it flags as breaking its usage policy may be kept longer, as its retention documentation describes.
- When the AI looks for visual references it may send a short search phrase, written by the AI, to Wikipedia and Wikimedia Commons. It contains no personal data.
- Anything you type into a prompt becomes part of the request, so do not include personal data.
International transfers
Your data is stored on servers in the European Union. The operator is established in Pending publication and its team accesses the data from there to run and support the Service, and some of the providers listed above are in the United States.
When personal data leaves the European Economic Area, the United Kingdom or another country that restricts transfers, we rely on the mechanisms the law accepts, such as a decision that the destination offers adequate protection or the European Commission's standard contractual clauses included in our agreements with those providers. Write to [email protected] if you want more detail or a copy of the safeguards.
How long we keep it
We keep your data while your account or your organization exists, because we need it to provide the Service. When you ask us to delete it, we erase it or make it anonymous within 30 days of confirming that the request is yours.
| Data | How long |
|---|---|
| Account, organizations, projects, builds, files and generation logs | While the account or the organization exists; erased within 30 days of your request |
| Projects you delete in the app | Removed from your workspace at once. To have them permanently erased from our systems, write to [email protected]: we do it within 30 days |
| Sessions | A session stops working after 7 days without use, and after 30 days at most. Its record, with your IP address and browser type, is kept while your account exists |
| Sign-in codes | Valid for 10 minutes; we store them only as a hash |
| Invitations | While the organization exists |
| Counters that limit repeated attempts | From 60 seconds to 24 hours |
| Activity records and purchase records | While the organization exists, and afterwards only as long as the law requires or as we need them to resolve disputes |
| Technical logs and the messages you send us | For as long as we need them to operate and support the Service |
| Backup copies of the database | Up to 14 copies, one made before each update of the Service. Data we erased can remain in a copy until it is replaced, which can take more than 30 days |
| Content sent to our AI provider | Up to 30 days in its systems, as described above |
PayNow keeps payment records for the time its own policy states.
Your rights
Wherever you live, you can ask us to:
- Access your personal data and receive a copy.
- Correct data that is wrong or incomplete.
- Delete your data or your account.
- Restrict how we use it while a question is being resolved.
- Receive the data you gave us in a structured, commonly used format (portability).
- Withdraw your consent or authorization, where we rely on it.
You can object at any time to uses based on our legitimate interests, including the showcase of builds in our gallery and marketing. Write to [email protected] or [email protected] and we will stop, unless we have compelling reasons that the law recognizes.
To use any of these rights, write to [email protected] from the email address of your account, so that we know the request is yours. It costs nothing. We answer within one month, or sooner where the law of your country says so (see below); if a request is complex we may need up to two more months, and we will tell you why. Today our team handles these requests by email: the app does not yet have self-service tools to export or delete an account.
If you are not satisfied with our answer, you can complain to the data-protection authority of your country (see below). We would appreciate the chance to resolve it first.
Information for specific countries
European Economic Area, United Kingdom and Switzerland
You can complain to the supervisory authority of the country where you live or work. The European Data Protection Board keeps the list of EU authorities, and in the United Kingdom the regulator is at ico.org.uk.
Colombia
Your rights are those of Law 1581 of 2012: to know, update, rectify and delete your data, to ask for proof of your authorization, to be told how your data has been used, and to revoke the authorization. We answer queries within 10 business days and claims within 15 business days, each extendable once as the law provides. After making a claim to us you can go to the Superintendencia de Industria y Comercio (sic.gov.co). This policy has been in force since the date at the top of this page, and the database lasts for as long as the purposes described here.
Argentina
You can exercise the rights of access, rectification and deletion of Law 25.326: we answer access requests within 10 calendar days, and rectification or deletion requests within 5 business days. The owner of personal data may exercise the right of access to it free of charge at intervals of no less than six months, unless a legitimate interest is shown, as established in article 14, paragraph 3 of Law No. 25.326. The Agencia de Acceso a la Información Pública, as the supervisory body of Law 25.326, is empowered to hear the complaints and claims of anyone whose rights are affected by a breach of the data-protection rules in force.
Brazil
You have the rights listed in article 18 of the LGPD, including confirmation that we process your data, access, correction, anonymization or deletion, portability, and information about whom we share it with. [email protected] is our channel for them, and you can complain to the ANPD.
United States
We do not sell personal data, we do not share it for cross-context behavioural advertising, we run no advertising and no third party collects information about your activity across other websites through our Service. For that reason the Service works the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal. Whatever state you live in, you can make the access, correction and deletion requests described above.
If you use CubicBuilds through an organization
When you work inside an organization created by someone else (your team, your employer, a client), that organization decides what goes into its projects and who its members are, and a request about that content may need to go through the organization's owner.
Business customers who need a data-processing agreement can ask for one at [email protected]. The content of an organization that has one stays out of the showcase and the style library.
If someone invited you, we received your email address from that person in order to create the invitation. If you do not want it, ask us to delete it.
Age
CubicBuilds is for people aged 16 or over. Those under 18 need the permission of a parent or guardian, as the Terms explain. The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child under 16 has given us personal data, write to [email protected] and we will delete it.
How we protect it
We protect your data with measures suited to the risk:
- Each organization's data is isolated from the others at the database level.
- Connections to the Service are encrypted, and the browser is only allowed to load content from our own servers.
- Session identifiers, sign-in codes and invitation tokens are stored only as hashes, and Discord tokens are stored encrypted.
- The code the AI writes runs in isolated environments with no network access and no access to secrets.
- Uploaded files are held apart and checked before they are used.
- Access by our staff is limited to those who need it, and their actions on customer organizations are recorded.
No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.
Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the last update. If a change is significant, we tell you by email or in the app before it applies.
Contact
- Privacy requests
- [email protected]
- Postal address
- Pending publication
Our full details are in the Imprint.