Privacy Policy
Last updated: 17 July 2026
This Privacy Policy explains how Epicube AB (“we”, “us”) collects and processes personal data when you use our website, its forms, and the Cubie AI chat. We are the data controller for this processing.
Contact: Epicube AB, Sankt Eriksplan 13, c/o Woxström, 113 20 Stockholm, Sweden.
Email: legal@epicube.com
1. What data we collect
When you submit a form on our website, we collect the information you provide. Depending on the form, this includes your name, job title, work email address, phone number, company name, and proposed meeting times. For a careers application, we instead collect your email address and the free-text answers you give (why you want to join us, and evidence of your ability), together with any CV you choose to upload. We also record when you submitted the form and acknowledged this notice.
You are not legally required to provide form data. Fields marked as required are necessary for us to handle the request; without them, we may be unable to respond, prepare the benchmark, or assess the application.
When you use Cubie, we collect the first and last name, company name, and follow-up messages you provide. We also create a random browser identifier to restore the chat, and store the company-research result, session status, and number of follow-up questions. The company name is used to search public web sources through Exa; Cubie’s prompts, public research evidence, and chat messages are processed through the OpenAI API to generate responses.
Cubie is intended for general business enquiries. Do not enter confidential information, trade secrets, special-category personal data, or other sensitive or regulated information in the chat.
We may also automatically collect limited technical data necessary to operate the website, such as IP address and browser type, through our hosting and infrastructure providers.
If you allow analytics, PostHog assigns a random browser identifier and collects page URLs, referring pages, campaign parameters, browser and device information, interactions with selected calls to action and forms, page performance measurements, and technical error reports. We do not identify you by name or email in PostHog, and we do not send form-field contents to PostHog. Session replay, autocapture, and marketing tracking are currently disabled.
Our hosting provider Vercel also collects aggregated visitor statistics (page views, referrers, and coarse device and geography data) through Vercel Web Analytics. These statistics use no cookies and no browser storage, and are not linked to an individual visitor profile.
2. Why we process your data and on what legal basis
| Activity | Purpose | Legal basis |
|---|---|---|
| Contact form (“Talk to us”) | To respond to your message or request | Our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR) |
| Benchmark request | To prepare your free company benchmark, email it to you, and arrange the consultation | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| Meeting-time proposal | To review your proposed times and confirm a meeting with you | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| Careers application | To assess your application and contact you about it | Steps taken at your request before a possible employment contract (Art. 6(1)(b)) and our legitimate interest in recruitment (Art. 6(1)(f)) |
| Cubie AI chat and company research | To provide the requested chat, research public company information, suggest relevant AI opportunities, restore the session, and enforce usage limits | Our legitimate interest in providing and securing an interactive business-information service requested by the visitor (Art. 6(1)(f) GDPR) |
| Website analytics | To understand which pages and calls to action are useful and improve the website | Consent (Art. 6(1)(a)); analytics remains disabled unless you allow it |
The required checkbox on a form records that you acknowledged this notice and asked us to handle your submission; it is not the legal basis for processing the request. Analytics consent is separate and can be refused without affecting access to the site. We do not sell personal data or use it for automated decisions that produce legal or similarly significant effects.
3. Who we share your data with
We use the following service providers to operate our website, handle submissions, provide Cubie, and provide analytics:
- Convex, Inc. — website backend and database where submissions are stored
- Resend (Resend, Inc.) — sending notification and confirmation emails
- Attio (Attio Ltd) — CRM for storing and managing contact requests
- Google Workspace (Google Ireland Ltd / Google LLC) — email and internal documents
- Vercel Inc. — website hosting and delivery, and aggregated cookie-free visitor statistics (Vercel Web Analytics)
- OpenAI Ireland Ltd. — generating Cubie’s company-research summaries and chat responses through the OpenAI API
- Exa Labs Inc. — searching public web sources about the company entered in Cubie
- PostHog, Inc. — consent-based website analytics, using PostHog Cloud EU with primary hosting in Germany
Where they act as our processors, these providers process data under the applicable service agreement and data-processing terms. We do not share your data with other third parties unless required by law.
4. Transfers outside the EU/EEA
Some of our providers, including providers used for Cubie, are based in or may process data in the United States. Where data is transferred outside the EU/EEA, we rely on applicable safeguards such as the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. PostHog Cloud EU stores primary customer data in Germany, although PostHog and its subprocessors may conduct limited processing from other countries. You may request a copy of the applicable safeguards from us at legal@epicube.com.
5. How long we keep your data
Form submissions (contact, benchmark, meeting requests, and careers) are kept for up to 24 months after submission, after which they are automatically deleted, unless a business relationship follows.
Cubie session records—including the browser identifier, name, company, research result, status, and question count—are deleted after 30 days without activity. Follow-up chat messages are not stored in Epicube’s Convex database. OpenAI states that API inputs and outputs are not used to train its models by default, but may be retained for up to 30 days by default for service delivery and abuse monitoring, unless a different eligible retention setting applies.
PostHog analytics events are kept for no more than 24 months. The browser identifier in local storage remains until you clear your browser storage or the site storage is otherwise removed. Withdrawing consent stops future analytics collection; it does not make earlier lawful processing unlawful.
You can ask us to delete your data sooner at any time. We delete or anonymize data when it is no longer needed for these purposes.
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted (“right to be forgotten”)
- Restrict or object to our processing
- Receive your data in a portable format where applicable
- Withdraw consent at any time (for processing based on consent), without affecting processing before withdrawal
To exercise any of these rights, email us at legal@epicube.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, www.imy.se); you may also complain to the authority in your own EU country.
7. Cookies and similar technologies
We use cookies and similar browser-storage technologies as follows:
- epicube_consent — a strictly necessary, first-party cookie that stores your category choices, consent version, and choice timestamp for 180 days.
- epicube:cube-chat:visitor-id:v1 — strictly necessary first-party local storage containing a random Cubie visitor identifier. It is created only when you open the chat, lets us restore the session, and remains until you clear this site’s browser data.
- ph_<project-token>_posthog — first-party local storage created only after analytics consent. It stores a random browser identifier and PostHog SDK state so visits can be measured together. It does not expire automatically; collection stops when consent is withdrawn, and you can remove the stored value by clearing this site’s browser data.
We do not currently activate any marketing tracker, even if the marketing category is selected. We will update this notice before introducing one.
You choose when you first visit, and you can change or withdraw your choice at any time via the “Manage cookies” link in the footer.
8. Security
We use appropriate technical and organizational measures to protect your data, including access controls, encryption in transit, and reputable infrastructure providers.
9. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date of the last revision shown at the top.