Cubence Privacy Policy

Cubence values your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use our website, dashboard, API gateway, payments, invoicing, and related services.

This Policy applies together with the Terms of Serviceand Cookie Policy.

1. Information We Collect

• Account information: email, username, login method, avatar, invitation relationship, and Terms acceptance time.
• Authentication and security information: login records, IP address, device information, browser information, captcha status, risk-control data, and security logs.
• Service usage information: API key metadata, request time, model type, quota consumption, usage statistics, error logs, service status, and analytics data.
• User inputs and outputs: code, questions, prompts, attachments, or related content you submit through the API or dashboard, and responses returned by third-party AI services. Except for troubleshooting, security, billing, or legal requirements, we do not permanently store core business content.
• Payment and invoicing information: order number, amount, currency, payment channel, payment status, refund records, invoice title, tax number, contact details, and invoice files.
• Communications: emails, support messages, feedback, reports, and customer support requests you send to us.

2. How We Use Information

• Create accounts, verify identity, keep users signed in, and protect account security.
• Provide API gateway, model access, API key management, billing, subscriptions, wallet recharge, invoicing, and support.
• Monitor service quality, troubleshoot issues, measure usage, improve product experience, and maintain system security.
• Process payments, refunds, invoices, commissions, risk control, and fraud prevention.
• Comply with laws, regulatory requirements, dispute resolution, and third-party provider policies.

3. Legal Bases for Processing

Under applicable legal frameworks (including but not limited to EU GDPR, UK GDPR, China's Personal Information Protection Law (PIPL), and other jurisdiction-specific laws), the principal legal bases we rely on for processing personal information are:

• Performance of a contract: necessary to create and maintain accounts and to provide the API gateway, subscriptions, payments, invoicing, and customer support.
• Legitimate interests: necessary to prevent fraud, secure networks and accounts, improve product quality, and maintain stable operations, where not overridden by your fundamental rights and freedoms.
• Legal obligations: to comply with tax, anti-money-laundering, regulatory, judicial, and consumer-protection laws.
• Your consent: for non-essential cookies, marketing emails, and other processing that requires consent; you may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

4. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies for login, security, language, theme, preferences, and analytics. See the Cookie Policyfor details.

5. Sharing and Third-Party Services

We do not sell your personal information. To provide the Services, we may share necessary information with the following categories of third parties:

• Third-party AI model and API providers to process requests and return results.
• Payment, banking, wallet, invoicing, and finance providers to complete transactions, refunds, and invoices.
• Hosting, database, object storage, email, analytics, security, and monitoring providers to operate and protect the Services.
• Regulators, courts, law enforcement, or dispute-related parties when required by law or necessary to protect legitimate rights.

6. International Transfers

Because Cubence serves multiple countries and regions and uses third-party AI, payment, hosting, and infrastructure services, your information may be transferred to, processed in, or stored in countries or regions outside your location. For transfers of personal information out of the EU/UK, we rely on the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or other recognized lawful transfer mechanisms; for transfers out of mainland China, we will complete the procedures required by PIPL (such as the Standard Contract for cross-border transfers of personal information or obtaining separate consent). We take reasonable measures to protect the information involved.

7. Data Retention

We retain personal information only for as long as needed for the purposes described in this Policy. Subject to mandatory legal requirements, typical retention periods for the main categories are:

• Basic account information: kept while the account is active; typically anonymized or deleted within 30 days after closure, with necessary logs retained for up to 2 years.
• Authentication, login, and security logs: typically retained for 12 months, extendable up to 3 years for specific security incidents.
• API request and billing records: typically retained for 24 months to support reconciliation, dispute resolution, and regulatory audit.
• Payment, order, and invoice records: retained for 5 to 10 years as required by tax and accounting laws.
• Customer support and communications: typically retained for 24 months.
• User inputs and outputs: not retained long-term except for troubleshooting, security, billing, or legal requirements; related temporary records are typically deleted or anonymized within 30 days.

Where legal, tax, audit, dispute, security, or compliance requirements call for longer retention, the relevant data will be retained accordingly.

8. Your Rights

To the extent permitted by applicable law, you may request access, correction, deletion, export, or restriction of processing of your personal information, and you may withdraw consent or close your account.

To protect account security, we may verify your identity before processing requests. Some information may not be immediately deleted for legal, tax, dispute, security, or compliance reasons.

9. Automated Decision-Making and Profiling

To protect accounts and platform integrity and to prevent fraud and abuse, we may perform automated analysis (such as risk scoring, anomaly detection, and rate/quota limits) on activities including login, registration, payments, and API calls. Such processing may result in actions such as restricting access, requiring additional verification, or refusing transactions without your direct involvement. Where such a decision produces a significant legal or similarly significant effect on you, you have the right to request human review, express your view, and contest the decision by contacting [email protected]. We do not use your personal information for fully automated targeted advertising or differential pricing that has a significant effect on you.

10. Children and Minors

Cubence is primarily intended for adults and users with full legal capacity. We do not knowingly collect personal information from minors under the following ages: under 14 in mainland China, under 16 in the EU/UK, under 13 in the United States, or the corresponding age defined by the law of your jurisdiction. If you are a minor, please use the Services only with the consent and guidance of a parent or guardian. If we learn that we have inadvertently collected personal information from a minor, we will delete it within a reasonable time.

11. Security Measures

We use reasonable technical and organizational measures to protect personal information, including access controls, encrypted transmission, log auditing, risk controls, and least-privilege access. No internet service can be guaranteed to be absolutely secure.

12. Data Breach Notification

In the event of a personal data breach, we will initiate incident response and provide notifications to relevant regulators, affected users, or the public within the timeframes required by applicable law (for example, the prompt notification required by China's PIPL, or notification to the competent supervisory authority generally within 72 hours under the EU GDPR), describing the nature of the incident, its possible impact, the measures we have taken in response, and the protective steps you may take.

13. Policy Updates

We may update this Policy from time to time. Updated versions will be posted on this page and become effective upon posting or on the specified date.

14. Contact Us

If you have questions about this Privacy Policy or our personal information handling, contact us at [email protected].

Operating entity: Cubence LLC