Cubbie Privacy Policy

Effective:

May 7, 2026

Last updated:

October 29, 2026

1. Who we are

Cubbie is operated by Rei Llazani, an individual, and is not yet incorporated. In this policy, “Cubbie,” “we,” and “us” mean Rei Llazani as the operator of Cubbie. Rei plans to form a company to operate Cubbie. When it is formed, Cubbie, this policy, your account, and the personal information we hold may be transferred to that company, and we will tell you before the transfer takes effect. Information we received from Google APIs will move to that company only with your explicit consent. You can reach us at [email protected]. For most personal information described in this policy, we act as the controller. For personal information processed on behalf of business customers (e.g., subscription data uploaded by an enterprise about its employees), we act as processor for that customer; the relevant DPA governs.

2. Information we collect

2.1 Information you give us

• Account & profile. Name, email address, phone (optional), employer / organization, job title, profile photo, time zone, and authentication identifiers.
• Identity verification and payout details. For Vendors who set up payouts: business verification details (legal entity, beneficial ownership) and tax forms (e.g., W-9 / W-8) where we request them, and the bank account details you enter or link through Plaid, which we store encrypted. Vendors who connect Stripe give their details to Stripe directly.
• Revenue verification. If you are a Vendor and choose to verify your company’s revenue, the bank statements you upload and the monthly deposit totals recorded from them (Section 5.6).
• Commercial information. Orders, purchase requests, price requests, contracts, refunds, disputes, Cubbie Points and Berries activity, payouts.
• Buyer-supplied data. Subscription registry entries, owner / cancellation contact emails, contracts and invoices you upload, RFP content, vendor relationship notes.
• Product feedback and case studies. Satisfaction ratings you give the vendors in your stack, feedback on recommendations, and case studies a Vendor publishes, including the customer names and quotes the Vendor adds.
• Interviews and features. If you take part in an interview we publish, your name, job title, company, photo, and the answers you give us for publication.
• People you invite. Names and email addresses of teammates or other companies you invite to Cubbie.
• Communications. Emails, support tickets, in-product chat, conversations with Cubbie’s assistant, and survey responses.

You need to give us your name, work email, and company to open an account; without them we cannot provide the Service. Everything else is optional, though some features need it.

2.2 Information we collect automatically

• Device & log data. IP address, browser, operating system, device type, referrer, pages viewed, timestamps, and approximate location derived from IP.
• Usage events. Clicks, searches, navigation, product listings shown to you, feature interactions, and outcome states (e.g., onboarding milestones).
• Cookies & similar technologies. Identifiers stored in cookies, local storage, or tags. See Section 9.
• Email engagement. Some emails we send contain a small image or tracked links that tell us whether the email was opened and which links were clicked. We use this to measure our emails and to avoid sending email people do not want.
• Performance & reliability. Real User Monitoring (Web Vitals: LCP, INP, CLS), error reports, slow-query logs, and rate-limit events.

2.3 Information from third parties

• Sign-in providers. If you sign in with Google, Microsoft, LinkedIn, GitHub, or your company’s single sign-on, we receive the profile fields you authorize.
• Directory connections. If your organization connects Google Workspace, Okta, Microsoft Entra ID, or JumpCloud, we receive the user, app, and sign-in data you authorize.
• Connected systems. If you connect billing, accounting, or spend platforms (e.g., Stripe, NetSuite, QuickBooks, Brex, Ramp), we receive the data scopes you authorize.
• Connected email. If you connect a Gmail or Outlook mailbox, we access the billing messages and, when you enable subscription requests, the related requests and replies described in Sections 4.1 and 4.2.
• Bank and card connections. If you connect a business bank account or card through Plaid, we receive read-only transaction history for the accounts you authorize, and retain only the recurring software charges detected from it. See Section 5. If you are a Vendor and verify your revenue through a payout account linked with Plaid, we receive that account’s transaction history and retain only monthly deposit totals (Section 5.6).
• Payment processors. Stripe (and any successor) processes card and bank details; we receive transaction metadata, tokenized identifiers, and risk signals, not full card numbers.
• Public sources & data partners. Vendor catalog data (including data gathered by automated crawling of publicly available vendor websites, and we respect robots.txt), company firmographics, security and compliance signals, and publicly available pricing information.

2.4 Business contacts who do not use Cubbie

To tell companies about Cubbie, we keep business contact details of people who work at software companies and other businesses: name, job title, work email address, and company. We get these details from publicly available sources such as company websites, from business data providers, from 50Pros (Section 6.1), and from people who give them to us. We use them to send business emails about Cubbie (for example, to tell a vendor that its customers use its product on Cubbie, or to invite someone to a short demo), to avoid contacting the same person too often, and for the sharing described in Sections 6.1 and 6.2. We rely on our legitimate interest in telling businesses about a service relevant to their work.

You can object at any time. Reply to any of our emails, or write to [email protected], and we will stop emailing you and stop giving your details to 50Pros or to the organization in Section 6.2. We keep your address on our do-not-contact list so we do not email you again. You can also ask us to delete your details or tell you what we hold (Section 10).

3. How we use information

We use information for the following purposes and on the legal bases shown:

4. AI processing

We use AI models to run parts of Cubbie: search, the AI advisor and Ask Cubbie, reading invoices you upload, sorting billing emails from a mailbox you connect, drafting product profiles and researching the software catalog, reviewing new accounts (Section 4.3), and reading and answering email sent to [email protected] (Section 4.4). Our AI model provider is Anthropic (Claude models). Search text, product names, and the names of subscriptions in your stack are also sent to Voyage AI to match them to products; we do not send Voyage your name, email, or account details. When you use Ask Cubbie while signed in, your company’s software and spend records may be sent to the model so it can answer you. We:

• Send only the inputs needed for the requested feature.
• Strip or redact obvious secrets where feasible (e.g., tokens, keys).
• Do not use your content to train AI models. Under Anthropic’s commercial terms, Anthropic does not train its models on the content we send through its API.
• Apply per-organization budget caps to limit cost, scope, and abuse.
• Keep a record of each AI request, such as the feature, the model, and usage, and keep results where a feature needs them, for security, debugging, abuse review, and audit.

4.1 Google API data (Google Workspace and Gmail): Limited Use

When you connect Google Workspace to Cubbie, we access only the directory and usage data you authorize (for example, your organization’s users, license/seat counts, and aggregate usage reports) for the sole purpose of providing the features you requested: surfacing your software stack and generating seat-rightsizing recommendations. When you connect a billing mailbox through the Gmail API, we read the vendor invoice, receipt, and renewal messages needed to surface those subscriptions and reminders to you. If you also enable subscription requests and allow Cubbie to send email on your behalf, we use that permission only to send the requests you explicitly confirm from your connected account, and we access relevant vendor replies to track their status. A billing-only connection stays read-only unless you approve the additional permission. To identify the vendor, amount, and renewal date, the sender, subject, and a short excerpt of each matching message, together with the connected mailbox address, are processed by our AI inference provider (Anthropic) solely to provide this feature, and are not used to train generalized AI models. Cubbie’s use and transfer to any other app of information received from Google APIs (including Google Workspace APIs and the Gmail API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google Workspace and Gmail data only to provide and improve the user-facing features you authorized, and never for advertising.
• We do not use Google Workspace or Gmail data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
• We do not sell Google Workspace or Gmail data, and we do not transfer it to others except as necessary to provide or improve the user-facing feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets, only with your explicit prior consent.
• We do not allow humans to read Google Workspace or Gmail data unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations. When you confirm a subscription request sent from your connected account, you give that agreement for the vendor’s replies to that request: our team may see the sender, subject, date, and message ID of each reply to track the request’s status.

4.2 Microsoft Outlook mailboxes

When you connect a billing mailbox through Microsoft, we read the vendor invoice, receipt, and renewal messages needed to show those subscriptions and reminders to you. If you also enable subscription requests and approve sending permission, we may send the requests you explicitly confirm from your connected account and access relevant vendor replies to track their status. A billing-only connection stays read-only unless you approve the additional permission. The sender, subject, a short preview of each matching message, and the connected mailbox address are processed by our AI inference provider (Anthropic) only to provide this feature, and are not used to train AI models. We do not use this data for advertising and do not sell it. Disconnecting the mailbox stops our access and deletes the billing messages we extracted from it. Saved subscription records and cancellation history are treated as described below.

Connected email: subscription requests and disconnection

Connecting an email account does not authorize a cancellation. Each subscription request requires your confirmation. When you confirm a request sent from your connected email, you also agree that our team may see the sender, subject, date, and message ID of the vendor’s replies to it to track its status. We retain the approved request and limited delivery, response, and authorization records to operate and document the process. Related reply text is retrieved when you open a request; we do not store a separate copy of that full reply body. Requests may identify Cubbie as the service assisting you.

You can disconnect in Cubbie or revoke access with your email provider. When we detect lost access, affected features pause and we notify you. Disconnecting in Cubbie removes the connection credentials and extracted billing messages. Saved subscription records and cancellation history remain available, subject to the retention and deletion provisions in this policy. Disconnecting does not recall requests already sent or reverse a confirmed cancellation.

4.3 Automated review of new accounts

When you sign up and set up your account, we use automated tools, including an AI model, to review the details you give us, such as your company name, work email domain, website, and product information, together with public information about your company, including its website. For accounts set up as a vendor, the review checks that the company makes a software product. The result decides whether your account opens straight away, waits for a person to look at it, or is declined; a declined account is told why and is checked again each week. You can ask for a person to review a decision about your account, give your point of view, and contest it: email [email protected] with “Human review” in the subject line, and a person will handle it. Where the GDPR applies, we rely on this review being necessary to decide whether to enter into a contract with you (Article 22(2)(a)).

4.4 Our email assistant

Email sent to [email protected] is read by an AI assistant, which answers routine questions on our behalf from our help articles, our public pages, and the details of your Cubbie account, sometimes without a person reviewing each reply. Requests that would commit us to something, such as a payment, a legal position, a response to a security report, or closing or deleting an account, are passed to a person. The assistant can also carry out simple catalog requests made by email, such as correcting or removing a product listing, after checking that the request comes from the company’s own email domain. Email with “Privacy request,” “Privacy appeal,” “Human review,” “Legal notice,” “Security report,” or “Copyright notice” in the subject line always goes to a person, and the assistant does not answer it.

5. Bank and card connections

Buyers may connect a business bank account or company card so Cubbie can detect the software subscriptions being paid for. This section describes how that connection works and what Cubbie does with the data it returns. Section 5.6 covers Vendors who verify their revenue.

5.1 What we access

Bank connections run through Plaid Inc. You enter your bank credentials with Plaid, not with Cubbie; we never receive or store them. Plaid returns a read-only access token, which Cubbie uses to request transaction history for the accounts you authorize, going back up to 730 days. For these connections we request only Plaid’s Transactions product: Cubbie cannot move money, initiate payments, or change anything at your bank. Vendors who link a payout account through Plaid use Plaid’s Auth product instead, which gives us that account’s account and routing numbers so payouts can be sent to it. A Vendor that also verifies its revenue through that link shares the account’s transaction history as well, as described in Section 5.6.

Recurring charges can only be identified against the full history, so a scan reads the transactions on those accounts rather than a pre-filtered subset. Charges unrelated to software are read in the course of a scan and are not retained; Section 5.2 sets out exactly what is kept.

5.2 What we keep, and what we discard

Only the recurring software subscriptions our detector identifies are written to your Account. For each one we store the vendor name, amount, billing cadence, first and last charge dates, month-by-month totals, an inferred renewal date, and references to the charges it was detected from. If you mark a subscription as canceled, we also keep later charges from that vendor, with their date and amount, to confirm the cancellation. To pay the connection bonus only once per account, we keep a one-way hashed identifier of each connected account. Where you dismiss a detection as incorrect, we retain that merchant name so the same entry is not re-imported.

For these connections, we do not store your raw transaction history, account or routing numbers, or account balances. Transactions that are not identified as software subscriptions exist only in memory for the duration of a scan and are discarded when it finishes. They are never written to our database, never used to build a profile of your spending, and never shared with vendors. Payout accounts that Vendors add are different: their account and routing numbers are stored encrypted, as described in Section 2.1, and used only to send payouts. A Vendor that shares a payout account’s deposits with Verify revenue on also lets us read that account’s transaction history through the same Plaid link, as described in Section 5.6.

5.3 Security, retention, and disconnecting

• Plaid access tokens are encrypted.
• Each scan re-requests data from Plaid rather than reading a stored copy of your transactions.
• You can disconnect any connected account from your dashboard at any time. Disconnecting revokes the token at Plaid.
• When you disconnect your last connected account, the subscriptions detected from bank data are removed from your stack and archived, and pending detections are deleted. You can ask us to delete the archived records at any time (Section 10).
• Subscription records you keep, edit, or confirm are retained under Section 8 like any other registry entry.

5.4 Plaid’s own handling of your data

Plaid processes your bank data under its own agreement with you, and its practices are described in Plaid’s End User Privacy Policy. Requests to Plaid about the data it holds, including deletion, are made to Plaid directly through my.plaid.com. Disconnecting in Cubbie revokes our access; it does not by itself erase records Plaid keeps as a controller.

5.5 What we never do with bank data

We do not sell bank or card data or use it for advertising. If a subscription detected from your bank or card is in your company’s stack, we may tell that vendor that your company uses its product and name a member of your team (Section 6). We never tell a vendor amounts, dates, or other transaction details, and we never share bank, card, or transaction data with 50Pros. Connecting a bank or card sends nothing to 50Pros.

5.6 Revenue verification for Vendors

If you are a Vendor, you can choose to verify your company’s revenue with the Verify revenue switch where you set up payouts. We use what you share to verify your company’s revenue. There are two ways to share it:

• Deposits through Plaid. With Verify revenue on, linking your payout account through Plaid, or choosing Share deposits once it is linked, shares that account’s transaction history with us through Plaid’s Transactions product, going back up to 24 months. While Verify revenue stays on, we may read it again to keep the totals current. We keep only monthly deposit totals and counts, grouped by source, such as a payment processor or customer payments. We do not store individual transactions.
• Bank statements. You can upload bank statements instead. A person at Cubbie checks them and records monthly deposit totals from them. We delete the statement files once that check is done, or sooner if you remove them or turn Verify revenue off.

A person at Cubbie decides whether your revenue is verified. If it is not verified, we delete the totals. We do not publish revenue figures or show them to Buyers, other Vendors, or 50Pros. You can turn Verify revenue off at any time, which withdraws your consent: we stop reading deposits and delete the totals and any statements we still hold. Your payout account stays linked so payouts can still be sent, and a verification already approved stays approved, along with any Berries it earned.

6. How we share information

We share information in the following situations:

• Vendors and Buyers. Information necessary to complete transactions (e.g., a Vendor sees the company name, contact, and order details for a Buyer who places an Order). When you ask a vendor for its price, the vendor sees that a buyer asked, but not your name or your company.
• Vendors whose products your company uses. When a vendor’s product is in your company’s stack on Cubbie, whether your team added it or it was detected from a connected bank, card, or directory, we may tell that vendor that your company uses it, including the name of a member of your team. We do not tell the vendor amounts, dates, or other transaction details. To stop us naming you or your company to vendors, email [email protected] with “Privacy request” in the subject line.
• Vendors you ask us to contact. If you tick “Let Cubbie contact” a vendor when you ask to buy its software, we contact that vendor about your request.
• Partners. Partners who run a perks portal on Cubbie see activity that starts on their portal, such as visits, clicks, and sign-ups, including the name, email address, and company of people who sign up, claim an offer, or are registered as leads through it, and the applications vendors send through it.
• Service providers (sub-processors). Hosting, payment processing, bank connections, email delivery, analytics, AI inference, security and bot protection, observability, code hosting and issue tracking, e-signature, and similar service providers, all under written contracts that limit their use of personal information.
• Advertising partners. LinkedIn, Google, and ShareThis receive information through the advertising cookies and tags described in Section 9, unless you opt out.
• Legal and safety. Where required by law, valid legal process, or to protect rights, safety, and property of Cubbie or others.
• Business transfers. To a company Rei Llazani forms to operate Cubbie, or in connection with a merger, acquisition, financing, or sale of assets, with notice to you.
• With your consent. Any other sharing you direct or authorize.

6.1 50Pros, an affiliated company

Rei Llazani, who operates Cubbie, also operates 50Pros, a directory of service agencies. 50Pros provides the agency directory on Cubbie’s product profiles and agency partner pages. The directory loads from 50Pros’ website, so 50Pros receives what your browser sends when it loads, such as your IP address and browser type. Beyond that, we share limited information with 50Pros and receive limited information from it:

• Contacts we share. Business contact details of people at agencies and other businesses, which 50Pros uses for its own business emails, and records of the business emails each of us has sent, so the same person is not contacted too often. Cubbie and 50Pros decide together how that shared record is used and are joint controllers of it; you can use your rights over it with either of us through [email protected].
• Contacts we receive. Business contact details, which we use as described in Section 2.4.
• Agency partners. If you apply to Cubbie’s agency partner program, your email address and agency details, so 50Pros can confirm your agency’s 50Pros verification.
• Account review. When we review a new account, we check whether your company’s website domain appears in 50Pros’ agency directory.
• Shared service accounts. Some of our emails and the share buttons on our interview pages run on service accounts 50Pros holds, so 50Pros can see the records those services keep.

We never share bank, card, or transaction data with 50Pros. 50Pros handles what it receives under its own privacy policy.

6.2 Invitations for another organization

We may use business contact details to send membership invitations on behalf of a separately operated organization. Those emails come from that organization, and it receives the name and email address of each person invited.

6.3 Selling and sharing under U.S. state laws

We do not sell personal information for money. Some things we do may count as “selling” or “sharing” under California and other state laws: the advertising cookies and tags in Section 9, which let LinkedIn, Google, and ShareThis use visits to our site for advertising (cross-context behavioral advertising, or targeted advertising); the business contact details we share with 50Pros for its own emails (Section 6.1); the membership invitations in Section 6.2; and telling vendors that your company uses their product (Section 6). To turn off the advertising cookies and tags, use “Your Privacy Choices” at the bottom of our pages or turn on Global Privacy Control in your browser; that choice applies to the browser you use. To opt out of the rest, email [email protected] with “Privacy request” in the subject line and tell us what you want us to stop. We do not knowingly sell or share the personal information of anyone under 16.

7. International data transfers

Cubbie is based in the United States and collects your information directly. If you use the Service from outside the U.S., your information is processed in the U.S. and in other countries where our service providers operate. When a business customer in the European Economic Area, the United Kingdom, or Switzerland sends us personal data to process on its behalf, the Standard Contractual Clauses and U.K. Addendum in our Data Processing Addendum apply. Where our service providers need a transfer mechanism for data from those countries, we rely on Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Email [email protected] for a copy of the relevant safeguards.

8. Retention

We retain personal information only as long as needed for the purposes described in this policy and to comply with our legal, accounting, and reporting obligations. Specific retention windows include:

• Account records: for the life of the Account. If you delete your Account, we anonymize your profile after the 14-day cooling-off period described in Section 10.
• Transaction and tax records: seven (7) years to satisfy financial and tax-reporting obligations.
• Audit logs: at least one (1) year, longer where required for compliance.
• Usage, search, email engagement, and AI request records: kept while we use them to run, secure, debug, and improve the Service, and for the audit and security records described in this policy. We do not currently delete them on a fixed schedule.
• Data from connected sources: while the connection is active. Disconnecting a mailbox deletes the messages we extracted from it; disconnecting your last bank or card archives the subscriptions it found (Section 5.3); records a directory connection already supplied stay in your workspace unless you ask us to delete them.
• Revenue verification (Section 5.6): monthly deposit totals until you turn Verify revenue off or ask us to delete them, and bank statements only until a person at Cubbie has checked them. We keep a record of your Verify revenue choices and of whether your revenue was verified.
• Business contact details (Section 2.4): kept while we may still contact the person for the purposes in Section 2.4, until the person objects or asks us to delete them. After an objection we stop using the details, keep the address on our do-not-contact list, and keep the contact record only so it is not collected again. Ask us and we will delete that record (Section 10).
• Marketing preferences and opt-out lists: retained as long as you remain on or off lists, so we can honor your choice.
• Backups: rotated according to our backup policy and overwritten in due course.

We may keep any information longer than described above when the law requires it, when we must preserve it because of a legal hold, investigation, or other legal process, or when we need it to establish, exercise, or defend legal claims. When that reason ends, the normal period applies again.

9. Cookies and tracking

We use cookies, local storage, and similar technologies in the categories below. We do not display a cookie consent banner. Essential, functional, and analytics technologies run for every visitor. Advertising technologies also run for every visitor unless you turn them off or your browser sends Global Privacy Control.

Your advertising choice. Use “Your Privacy Choices” at the bottom of our pages to turn advertising cookies off. When they are off, or when your browser sends Global Privacy Control, we do not load the LinkedIn Insight Tag or ShareThis, and we turn off Google Analytics’ advertising features; analytics keeps working. We honor Global Privacy Control automatically. Your choice is saved in a first-party cookie, cubbie_ads_opt_out, for up to 400 days and applies to the browser and device you used, so make it again if you clear your cookies or use another browser. You can also manage or block cookies in your browser settings or use Google’s Analytics opt-out browser add-on, and you can control Google’s ad personalization at myadcenter.google.com. Disabling cookies may degrade some features.

Embedded content. Product profiles and agency partner pages include an agency directory from 50Pros, which loads from 50Pros’ website and is covered by 50Pros’ privacy policy. A product profile can include a demo video from YouTube, Vimeo, or Loom. The video player loads from that service only when you press Play, and that service may then set its own cookies under its own privacy policy. Features such as bank connections and bot checks load content from Plaid and Cloudflare when you use them.

10. Your rights

Depending on where you live, you may have the rights described below. To exercise a right, sign in to your Account and use the data export / deletion tools, or email [email protected] with “Privacy request” in the subject line, which sends it straight to a person. We may verify your identity before responding, usually by confirming the request comes from the email address we hold, and will respond within the time required by law. You can use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity with us.

If you delete your Account, a 14-day cooling-off period starts, during which you can cancel. After it, we anonymize your profile and sign-in details, delete your saved searches and preferences, and disconnect the mailboxes and directory connections you set up. We keep some records: financial, tax, and audit records the law requires; your email address on our do-not-contact list so we do not email you again; records we must preserve because of a legal hold or other legal process; security, support, and usage records kept for the reasons in Section 8; and records that belong to your company’s workspace rather than to you. Ask us and we will tell you which kinds of records we kept and the reason for each kind, such as a legal obligation.

10.1 EEA, U.K., and Switzerland

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (subject to legal retention requirements).
• Restrict or object to processing based on legitimate interests, including business emails and advertising.
• Data portability for data you provided.
• Not be subject to a decision based solely on automated processing that significantly affects you, and obtain human review of the automated account review (Section 4.3).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your supervisory authority.

10.2 California (CCPA / CPRA)

In the last 12 months we collected the categories of personal information below, from the sources in Section 2, for the purposes in Sections 2.4, 3, and 4, and we keep each for the periods in Section 8.

You have the right to:

• Know what personal information we collect, use, disclose, sell, or share, and get a copy of it.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information (Section 6.3).
• Not be discriminated against for exercising these rights.

We use sensitive personal information only to provide the Service and for other purposes the law allows, so the right to limit its use does not apply. We do not knowingly sell or share the personal information of consumers under 16.

Notice of financial incentive. The vendor Berries rewards below involve information about your company’s software, spend, and revenue. The three buyer Points offers listed first are historical and closed to new claims. Previously recorded commitments remain subject to their original terms; new signups and connections do not earn Points:

• Historical bank or card connection offer: 500 Points, once the connection finds 3 or more subscriptions and stays connected for 30 days, once per workspace and bank account.
• Historical stack signup offer: 5,000 Points, once a connected account finds 3 or more subscriptions, once per company.
• Historical vendor invitation offer: 1,000 Points, after you connect your company’s software.
• For Vendors, until October 31, 2026: 2,000 Berries for connecting company spend; 1,500 Berries for verifying your company’s revenue, once per company, after a person at Cubbie approves it; and up to 2,500 Berries for each invited company that joins and is rewarded, up to 10 companies (for an invited buyer, 500 once it joins and adds 3 tools it uses, and 2,000 once it connects its company’s software). On November 1, 2026, Berries already earned this way are lowered to the amounts below, and the difference is taken from Berries not yet spent, or from Berries later returned for a booking open on that date.
• For Vendors, from November 1, 2026: 1,000 Berries for connecting company spend; 1,000 Berries for verifying your company’s revenue, on the same terms; up to 1,000 Berries for each invited buyer, up to 10 (300 once it joins and adds 3 tools it uses, and 700 once it connects its company’s software); and 500 Berries for each invited vendor whose profile is ready for the homepage, up to 5.

The information involved is described in Sections 2 and 5, and the full conditions are shown in the product before you take part. You take part by completing the action and can stop at any time by disconnecting the account, turning off Verify revenue, or not completing it; a reward that has not been earned yet may then be lost. We estimate the value of the information to us as the cost of the reward, valuing a Point and a Berry at $0.10 each: about $50, $500, and $100 for the historical buyer rewards above; $200, $150, and $250 for the Vendor rewards until October 31, 2026; and $100, $100, $100, and $50 for the Vendor rewards from November 1, 2026.

10.3 Other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comparable laws have similar rights: to confirm whether we process your personal information and get a copy, to correct and delete it, and to opt out of targeted advertising, the sale of personal information, and profiling that produces legal or similarly significant effects. We honor Global Privacy Control as an opt-out of targeted advertising and of the sale or sharing that happens through our advertising cookies and tags. We provide the same controls used for CCPA requests to residents of those states.

Appeals. If we decline your request, you can appeal by replying to our decision with “Privacy appeal” in the subject line. A person who did not make the first decision will review it and tell you the result in writing, within the time the law requires. If you disagree with the result, you can contact your state attorney general.

11. Children

The Service is for businesses and is not directed to children. You must be 18 or older to create an account, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

12. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS) and at rest, access controls, audit logging, role-based permissions, secret-rotation tooling, and a tamper-evident audit chain for sensitive records. No system is perfectly secure; if you believe your Account has been compromised, contact [email protected] with “Security report” in the subject line.

13. Marketing communications

We send transactional emails (e.g., receipts, password resets, security alerts) without marketing-opt-in because they are necessary to operate the Service. For marketing emails, we rely on your consent or our legitimate interest as permitted by law. Every marketing email tells you how to stop receiving them, either with an unsubscribe link or by replying to it, and we honor opt-outs promptly and permanently. You can also manage preferences in your Account settings.

14. Third-party links

The Service may link to third-party websites and applications. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing personal information.

15. Changes to this policy

We may update this policy from time to time. If a change is material, we will provide reasonable advance notice (such as by email or in-product notice). The “Last updated” date at the top of this policy reflects the most recent changes.

16. Contact us

Questions, requests, and complaints can be sent to [email protected]; put “Privacy request” in the subject line for anything about your personal information. For data processing on behalf of business customers, see our Data Processing Addendum. EEA and U.K. residents can reach us at the same address.

© 2026 Cubbie. All rights reserved.