Cubli B.V.
Privacy
Version 21 October 2026
Cubli B.V. (Vroede Vrouwenlaan 20, 5422 EH Gemert, the Netherlands, KvK 42138976, info@cubli.io) is responsible for the personal data we process about you as a customer, visitor or applicant.
For the data in your sites and apps (for example the visitors or customers of your web shop) we are the processor and you are the controller. The data processing agreement applies to that.
Which data and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email address, password (encrypted), two-factor details | your account and signing in | contract | as long as your account exists |
| Billing details: name, address, KvK, VAT number, payment method (last digits, through Mollie) | invoices and payments | contract, legal obligation | 7 years (tax law) |
| Details of domain holders | registering domain names | contract; the registry’s terms | as long as the domain exists, then as the registry requires |
| What you do in the dashboard (activity log), IP address when signing in | security, support | legitimate interest | 12 months |
| Support conversations and email | helping you | contract | 24 months |
| Your application: CV, contact details and what you email us | assessing your application; only the people at Cubli who decide on the role see it | steps before a contract | 4 weeks after the procedure ends; with your consent 1 year |
| Connected AI tools and API tokens | doing what you let them do | contract | until you disconnect them |
| The ad that brought you here (click id from Google, Microsoft, Meta or LinkedIn, campaign name), the first page and your cookie choice | measuring which ads bring customers | consent | 90 days in your browser; 13 months after sign-up with your account |
We do not sell data. Only if you say yes on cubli.io do we measure through Google which ad brought you to Cubli. If you then become a customer, we tell Google that the ad led to something. Your name, email address and other details never go to Google.
Who we share data with
Only what is needed, with parties that work for us:
| Party | What | Where |
|---|---|---|
| Hetzner Online GmbH | servers and storage | Germany (Nuremberg) |
| A storage service for backups | backups of sites, apps and databases | Amsterdam, the Netherlands |
| Mollie B.V. | payments | the Netherlands |
| Amazon Web Services (SES) | Cubli’s own mail (invoices, notices) and email sent by your sites | EU (Frankfurt) |
| Resend | backup for Cubli’s own mail when SES refuses a message | EU |
| Anthropic | abuse checks: the public text of live sites, read to spot phishing, malware and fraud | US |
| Cloudflare, Inc. | DNS for domains with us | global network |
| Openprovider | registering domain names | the Netherlands |
| The registry of the extension (for example SIDN) | details of the domain holder | per extension |
| GitHub | only when you connect a repository | US |
| Google Ireland Ltd. (Google Ads) | only with your consent: the click id, the time and value of a first payment, and your consent choice | EU; Google is a US company |
| Google Ireland Ltd. (Google Analytics) | only with your consent: which pages you view on cubli.io | EU; Google is a US company |
When data goes to a party outside the EU, this happens under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
Cookies
Always, because the site does not work without them. The dashboard (app.cubli.io) uses a cookie to keep you signed in. On cubli.io we remember your language (cubli_lang, 1 year) and your cookie choice (cubli_consent, 1 year).
Only if you say yes. On your first visit we ask whether we may measure. Without a yes, nothing from Google loads.
- Statistics: Google Analytics counts which pages people view. Cookies
_gaand_ga_…, up to 2 years. We do not share this data with Google for other purposes. - Advertising: Google Ads sees which ad brought you to Cubli. Google cookies (
_gcl_auand related), 90 days. We also keep the ad click in your browser (cubli_attribution, 90 days) and pass it on to app.cubli.io, so we can store it with a new account and report a first payment to Google, without your name or email address.
You can change your choice at any time through "Cookies" at the bottom of every page. If you withdraw your consent, we delete cubli_attribution at once. Without a yes, only the campaign name of the page itself (utm) goes along to the app, and nothing is kept.
We count how often people answer yes, no or their own choice to the cookie question. That is a plain request to our own server, without a cookie and without anything going to Google; we only look at the number per choice.
Your rights
You may see your data, have it corrected or deleted, object, withdraw your consent and take your data with you. Email info@cubli.io; we answer within a month. If you disagree with us, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Two-factor authentication for every account, encrypted connections, secrets stored encrypted, separate environments per project, and backups in another EU country than the servers (the Netherlands).
Changes
This statement may change. The latest version is always at cubli.io/privacy.
