Privacy Policy

This Privacy Policy explains what personal data CubePath Inc. ("CubePath", "we", "us") collects when you visit cubepath.com, use the CubePath dashboard, API, command line tools or MCP server, or contact us; what we use it for; who receives it; how long we keep it; and the choices you have.

CubePath Inc., 41 North Main St Suite 302, Carbondale, Pennsylvania 18407, United States, is responsible for the personal data described here. For any privacy question or request, write to [email protected].

This policy covers personal data about our customers and visitors. The content you store or run on CubePath infrastructure (files, databases, websites, virtual machines) belongs to you and is processed only to provide the service, under our Terms of Service and, where applicable, our Data Processing Agreement.

1. Data we collect

Account and organization data. Name, email address, username, password (stored only as a hash), language, company name, postal address, country, phone number, billing email and notification preferences. If you sign in with Google or GitHub, we receive your name and email from that provider.

Billing data. Payment cards are handled by Stripe and PayPal accounts by PayPal: we never see or store full card numbers. We keep the last four digits, brand, expiry date, issuing country and cardholder name of saved cards, your PayPal email, and your balance, invoices and transactions.

Security and usage data. IP addresses, browser user agent, login method, session records, two factor authentication settings, API token usage (time and IP of last use), failed login attempts and an activity log of the actions taken in your account. To prevent fraud and abuse we generate a device identifier at signup and login, with signals such as whether a VPN or proxy is in use.

Service data. The resources you create (servers, IP addresses, DNS zones and records, CDN, networks, databases, storage buckets and similar), their configuration, and technical metrics about them such as CPU, memory, bandwidth and request logs, which can include the IP addresses of visitors to your services.

Communications. Support tickets, their attachments and email headers, emails we send you, feedback you submit, and forms on our website (including business verification data such as a tax identification number when you provide it).

Marketing and website data. How you found us (referral source and campaign parameters), and cookies and similar technologies used for analytics, advertising measurement and error reporting (see section 6).

Legal acceptances. When you accept our Terms of Service or other legal documents, we record the version, date, your email, IP address and user agent as evidence.

2. How we use your data

To provide the service: create and manage your account, provision and operate your resources, show metrics, and send service and security notifications.

To bill you: charge your payment method, issue invoices, keep accounting records and handle disputes.

To keep CubePath secure: authenticate you, detect fraud, abuse, account takeover and attacks, and enforce our Terms of Service and Acceptable Use Policy.

To support you: answer tickets and requests. We use AI tools to classify and summarize incoming support and abuse emails.

To improve CubePath: analyze how the website and dashboard are used and fix errors.

To communicate with you: product news and offers, which you can turn off at any time.

To comply with the law: tax, accounting and legal obligations, and valid requests from authorities.

We do not sell your personal data.

3. Who receives your data

We share personal data only with the service providers we need to run CubePath, each limited to its purpose:

Payments and accounting: Stripe, PayPal and Xero.

Security and fraud prevention: Fingerprint (device identification), Cloudflare (bot protection on forms) and Have I Been Pwned (checking passwords against known breaches; only a partial hash of the password is sent, never the password).

Sign in: Google and GitHub, when you choose to use them.

Error reporting: Sentry, which receives error details and, for a sample of dashboard sessions, a recording of the page that can include information shown on screen.

Analytics and advertising: Google (Tag Manager and Analytics) and Meta (advertising measurement on the dashboard; never on login, signup, password or authorization pages).

AI features: Google (Gemini) and OpenAI process the messages you send to the AI assistants in the dashboard, and Google (Gemini) processes incoming support and abuse emails. If you use the CubePath AI Gateway, your requests are sent to the model provider you choose.

Storage and communications: Wasabi (file storage), Discord and Slack (notifications you enable, and internal alerts to our team).

We may also disclose personal data when required by law or to protect the rights and safety of CubePath, our customers or others, and to a successor in the event of a merger or acquisition.

4. Connecting CubePath to AI assistants

You can connect your CubePath account to third party AI assistants such as ChatGPT, Claude or other MCP compatible tools. When you do:

You sign in with your CubePath account and choose which permissions to grant. The assistant can only act within the organization and projects your account belongs to, and with your role in them.

The information that CubePath tools return (for example the list of your servers or your DNS records) is sent to the assistant you connected and is processed by its provider under that provider's own privacy policy.

We do not receive your conversation with the assistant, only the specific requests it makes to CubePath.

You can disconnect any assistant at any time from Account > Connections in the dashboard, which revokes its access immediately.

5. How long we keep your data

Account, organization and service data: while your account is active. When an account is closed, we anonymize the users and the organization and revoke all sessions, tokens and connected applications.

Invoices, transactions and accounting records: for the period required by tax and accounting law, even after the account is closed.

Sessions: dashboard sessions expire after 30 days and single sign on sessions after 8 hours.

Service metrics: detailed metrics for 30 days, aggregated metrics for up to 400 days. Request logs that include visitor IP addresses are kept for up to 400 days.

Backups of your servers: for the retention period you configure.

Security records, activity logs, support tickets and legal acceptances: for as long as needed to protect the service, resolve disputes and demonstrate compliance.

6. Cookies and similar technologies

We use cookies that are necessary for the website and dashboard to work (for example to keep you signed in), and cookies and scripts from Google and Meta for analytics and advertising measurement. Sentry receives error reports to keep the service working.

Analytics and advertising cookies depend on your choice in the cookie banner, which applies to both cubepath.com and the dashboard. In the European Economic Area, the United Kingdom and Switzerland they stay off until you accept them; elsewhere they are on until you decline them. You can change your choice at any time with Cookie preferences at the bottom of cubepath.com, or block and delete cookies in your browser settings (blocking the necessary ones will prevent you from signing in).

7. International transfers

CubePath operates data centers in Spain, the Netherlands and the United States, and several of the providers listed above are based in the United States. Your data may therefore be processed outside your country. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Your choices and rights

In your account: update your profile and organization details, change notification and marketing email preferences, enable two factor authentication, sign out of all sessions, delete API tokens and SSH keys, and disconnect AI assistants and other connected applications.

Marketing emails: every marketing email includes an unsubscribe link.

Requests: you can ask us for a copy of your personal data, to correct it, to delete it or close your account, to restrict or object to its use, or to receive it in a portable format, by writing to [email protected] from the email address of your account. We will answer within the time the law requires, usually one month. Some data must be kept for legal reasons even after a deletion request (see section 5).

Complaints: if you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

9. Security

We protect personal data with encryption in transit, hashed passwords, encrypted API tokens, two factor authentication, access controls and monitoring. No system is completely secure; if a breach affects your personal data, we will notify you as required by law.

10. Children

CubePath is not intended for anyone under 16, and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy. We will post the new version on this page with its date and, for significant changes, notify you by email or in the dashboard.