Data Processing Terms

The short version: your app's end-user data is yours. We store and run it only to host your app, keep it isolated and secure, use only the providers listed in the Privacy Policy, and delete it when you delete the project.

These terms apply when an app you run on cubek processes personal data of its users ("end-user data"). For that data you are the controller and [COMPANY LEGAL NAME] is your processor under Article 28 GDPR. They are part of the Terms of Service; Custom customers may sign a separate agreement instead.

• Only on your instructions. We host, run, store, back up, replicate and serve your app and its data as you configure it through deploys, the CLI, the API and the console. We do not use end-user data for anything else. If we think an instruction breaks the law, we tell you.
• Categories. Whatever your app stores: you decide the data, the data subjects and the purpose.
• Confidentiality. Only the people who operate cubek can access it, only when needed to run or fix the service, and they are bound to confidentiality.

• Each app is isolated: its own databases, files, secrets, logs and limits.
• Traffic is encrypted with TLS; access to servers is limited to our operators.
• Point-in-time recovery (7 days) and a standby copy on another server protect against data loss.

The providers listed in the Privacy Policy. We announce a new subprocessor there in advance; if you object, you can stop using the service and delete your data.

End-user data is stored where your app runs (our locations in the EU and the US) and may be replicated between them. Transfers out of the EEA rely on the Standard Contractual Clauses or another lawful mechanism.

• End users' requests. Your app holds its own data, so you answer access, correction and deletion requests with your app and the CLI. We help where you cannot.
• Breaches. We notify you without undue delay after we become aware of a personal data breach affecting your data, with what we know.
• Compliance. On request we give you the information you need to show compliance with Article 28. Audits beyond that are agreed in a Custom agreement.

When you delete a project, an organization or your account, its data is deleted at once and its archive after 7 days. We keep nothing longer unless the law requires it.

You need a lawful basis for the data your app collects, a privacy notice for your own users, and you must not store data that the Acceptable use rules forbid.

Questions: hello@cubek.dev.