Cubbie Privacy Policy

Effective:: May 7, 2026
Last updated:: June 22, 2026

Too long, didn’t read

The short version. The full text below is what governs.

We do not sell your data Cubbie does not sell personal information for money, and connecting your stack does not put it in front of vendors looking to pitch you. Some analytics and ad cookies still count as sharing under state law; opt out by emailing [email protected].
No AI training on your content Model providers are not permitted to train their foundation models on buyer content. We do store AI inputs and outputs, and we use your content to run and improve the Service, including aggregated, de-identified analytics.
Who else touches your data Hosting, payments, email, and AI inference run through outside companies under written contracts that limit what they may do with personal information. Every one of them is named in our Data Processing Addendum.
What a vendor sees Place an order and that vendor receives your company name, contact, and order details. Sharing beyond that happens for legal process, an acquisition of Cubbie, or when you direct it.
Cookies are on by default Essential and analytics cookies, including Google Analytics, load for every visitor. There is no consent banner; you turn them off in your browser settings or with Google’s opt-out add-on.
Export or delete anytime Account settings has self-service data export and deletion. Transaction and tax records stay for seven years and audit logs for at least one year regardless.

This policy explains what personal information Cubbie collects, why, who we share it with, how long we keep it, and the rights you have. If you process personal data through Cubbie on behalf of others (for example, an enterprise managing employee subscription data), our Data Processing Addendum applies in addition to this policy.

1. Who we are

Cubbie is owned and incubated by Elian Ventures Group, headquartered in New York City (“Cubbie,” “we,” “us”). For most personal information described in this policy, we act as the controller. For personal information processed on behalf of business customers (e.g., subscription data uploaded by an enterprise about its employees), we act as processor for that customer; the relevant DPA governs.

2. Information we collect

2.1 Information you give us

Account & profile. Name, email address, phone (optional), employer / organization, job title, profile photo, time zone, and authentication identifiers.
Identity verification. For Vendors, KYB documentation (legal entity, beneficial ownership), tax forms (e.g., W-9 / W-8), and bank / payout account details collected by our payment service providers.
Commercial information. Orders, contracts, refunds, disputes, credits, payouts.
Buyer-supplied data. Subscription registry entries, owner / cancellation contact emails, contracts you upload, RFP content, vendor relationship notes.
Reviews & product feedback. Ratings, written reviews, structured pros / cons / use case fields.
Communications. Emails, support tickets, in-product chat, and survey responses.

2.2 Information we collect automatically

Device & log data. IP address, browser, operating system, device type, referrer, pages viewed, timestamps, and approximate location derived from IP.
Usage events. Clicks, searches, navigation, feature interactions, and outcome states (e.g., onboarding milestones).
Cookies & similar technologies. Identifiers stored in cookies, localStorage, or tags. See Section 8.
Performance & reliability. Real User Monitoring (Web Vitals: LCP, INP, CLS), error reports, slow-query logs, and rate-limit events.

2.3 Information from third parties

Identity providers. If you sign in with Google, Microsoft, Okta, JumpCloud, or another IdP we support, we receive the profile fields you authorize and group / role data when applicable.
Connected systems. If you connect billing, accounting, or spend platforms (e.g., Stripe, NetSuite, QuickBooks, Brex, Ramp), we receive the data scopes you authorize.
Payment processors. Stripe (and any successor) processes card and bank details; we receive transaction metadata, tokenized identifiers, and risk signals, not full card numbers.
Public sources & data partners. Vendor catalog data (including data gathered by automated crawling of publicly available vendor websites, and we respect robots.txt), company firmographics, security and compliance signals, and public review data.

3. How we use information

We use information for the following purposes and on the legal bases shown:

Purpose	Examples	Legal basis (GDPR)
Provide and operate the Service	Account creation, checkout, subscription management, search, AI advisor	Contract; legitimate interests
Improve and personalize	Recommendations, ranking, A/B tests, analytics	Legitimate interests; consent (where required)
Security and fraud prevention	Auth, abuse detection, dispute review, audit logging	Legitimate interests; legal obligation
Compliance and reporting	KYB / AML, tax (1099, sales / VAT), audit retention	Legal obligation
Marketing and communications	Lifecycle emails, surveys, transactional notices	Consent (marketing); legitimate interests (transactional)
Customer support	Tickets, escalations, account changes	Contract; legitimate interests

4. AI processing

Our AI advisor and other AI features process inputs and produce outputs using third-party foundation models (currently including Anthropic’s Claude family). We:

Send only the inputs needed for the requested feature.
Strip or redact obvious secrets where feasible (e.g., tokens, keys).
Do not permit model providers to use Buyer Content to train their foundation models. Our providers process API inputs without training on them by default, and we do not enroll Buyer Content in any training program.
Apply per-organization budget caps to limit cost, scope, and abuse.
Log inputs, outputs, and metadata for security, debugging, abuse review, and audit.

4.1 Google Workspace API data: Limited Use

When you connect Google Workspace to Cubbie, we access only the directory and usage data you authorize (for example, your organization’s users, license/seat counts, and aggregate usage reports) for the sole purpose of providing the features you requested: surfacing your software stack and generating seat-rightsizing recommendations. Cubbie’s use and transfer to any other app of information received from Google APIs (including Google Workspace APIs) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google Workspace data only to provide and improve the user-facing features you authorized, and never for advertising.
We do not use Google Workspace data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
We do not sell Google Workspace data, and we do not transfer it to others except as necessary to provide or improve the user-facing feature, to comply with applicable law, or as part of a merger or acquisition with notice as required.
We do not allow humans to read Google Workspace data unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.

5. How we share information

We share information in the following situations:

Vendors and Buyers. Information necessary to complete transactions (e.g., a Vendor sees the company name, contact, and order details for a Buyer who places an Order).
Service providers (sub-processors). Hosting, payment processing, email delivery, analytics, AI inference, observability, e-signature, and similar service providers, all under written contracts that limit their use of personal information.
Affiliates. Subsidiaries and corporate affiliates, under terms consistent with this policy.
Legal and safety. Where required by law, valid legal process, or to protect rights, safety, and property of Cubbie or others.
Business transfers. In connection with a merger, acquisition, financing, or sale of assets, with notice as required by law.
With your consent. Any other sharing you direct or authorize.

We do not sell personal information for monetary consideration. Some routine analytics or advertising vendor cookies may qualify as “sharing” or “selling” under certain U.S. state laws (e.g., the California Consumer Privacy Act as amended by CPRA); you can opt out by emailing [email protected] or by using the browser-level cookie controls described in Section 8.

6. International data transfers

Cubbie is based in the United States. If you access the Service from outside the U.S., your personal information will be transferred to and processed in the U.S. and other countries where our service providers operate. For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (and the U.K. Addendum / Swiss equivalents where applicable), and apply additional technical and organizational measures where transfer impact assessments indicate they are warranted.

7. Retention

We retain personal information only as long as needed for the purposes described in this policy and to comply with our legal, accounting, and reporting obligations. Specific retention windows include:

Account records: for the life of the Account plus a reasonable wind-down window after closure.
Transaction and tax records: seven (7) years to satisfy financial and tax-reporting obligations.
Audit logs: at least one (1) year, longer where required for compliance.
Marketing preferences and opt-out lists: retained as long as you remain on or off lists.
Backups: rotated according to our backup policy and overwritten in due course.

8. Cookies and tracking

We use cookies and similar technologies in the following categories. Essential and analytics cookies (including Google Analytics) are set by default for all visitors; we do not currently display a cookie consent banner. You can manage or block cookies through your browser settings, use Google's Analytics opt-out browser add-on, and manage notification and communication preferences from your account settings when signed in. Disabling cookies may degrade some features.

Category	Purpose	Examples
Strictly necessary	Authentication, session, security, load balancing	Session cookies, CSRF tokens
Functional	Remember preferences (locale, theme, dismissed banners)	Locale cookies, dismissal flags
Analytics	Usage measurement and improvement	Internal RUM beacons; Google Analytics (when enabled)
Advertising	Ad attribution where you have opted in	LinkedIn Insight Tag (when enabled)

9. Your rights

Depending on where you live, you may have the rights described below. To exercise a right, sign in to your Account and use the data export / deletion tools, or contact us at [email protected]. We may verify your identity before responding and will respond within the time required by law.

9.1 EEA, U.K., and Switzerland

Access your personal data and receive a copy.
Rectify inaccurate or incomplete data.
Erase your data (subject to legal retention requirements).
Restrict or object to processing based on legitimate interests.
Data portability for data you provided.
Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Lodge a complaint with your supervisory authority.

9.2 California (CCPA / CPRA)

Know what personal information we collect, use, disclose, and (if applicable) sell or share.
Delete personal information, subject to exceptions.
Correct inaccurate personal information.
Limit use of sensitive personal information.
Opt out of sale or sharing: exercise by emailing us or via browser-level cookie controls (Section 8).
Non-discrimination for exercising rights.

We have not knowingly sold personal information of California consumers under 16 in the preceding 12 months.

9.3 Other U.S. state laws

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comparable laws have similar rights. We provide the same controls used for CCPA requests to residents of those states.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact [email protected].

11. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS) and at rest, access controls, audit logging, role-based permissions, secret-rotation tooling, and a tamper-evident audit chain for sensitive records. No system is perfectly secure; if you believe your Account has been compromised, contact [email protected].

12. Marketing communications

We send transactional emails (e.g., receipts, password resets, security alerts) without marketing-opt-in because they are necessary to operate the Service. For marketing emails, we rely on your consent or our legitimate interest as permitted by law and offer an unsubscribe link in every message. You can also manage preferences in your Account settings.

13. Third-party links

The Service may link to third-party websites and applications. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing personal information.

14. Changes to this policy

We may update this policy from time to time. If a change is material, we will provide reasonable advance notice (such as by email or in-product notice). The “Last updated” date at the top of this policy reflects the most recent changes.

15. Contact us

Questions, requests, and complaints can be sent to [email protected]. For data processing on behalf of business customers, see our Data Processing Addendum. EEA / U.K. residents may identify a representative through the contact above.