Privacy Policy
Last updated: 20 October 2026
This Privacy Policy explains how Epicube AB (“we”, “us”) processes personal data on our website epicube.com and in our product Epibrain at brain.epicube.com, including Epibrain’s connections to AI tools (MCP), its command-line tool and its plugin.
Contact: Epicube AB, Sankt Eriksplan 13, c/o Woxström, 113 20 Stockholm, Sweden.
Email: legal@epicube.com
1. Who is responsible for your data
For the website, and for Epibrain accounts, usage records and support, Epicube AB is the controller.
An organisation that uses Epibrain decides which sources to connect and who can use them. For the content in those sources and the content its members create in Epibrain, the organisation is the controller and Epicube AB is its processor. We process that content only to provide Epibrain to the organisation, under our agreement with it. If you are a member of such an organisation, or your emails or documents are in its sources, send questions about that content to the organisation. We help it answer.
2. The website
What we collect
When you submit a form, we collect the information you enter. Depending on the form, this is your name, job title, work email address, phone number, company name, a description of what you need and proposed meeting times. We also record when you submitted the form.
For a careers application, we collect your name, email address, your answers to the application questions and any CV you upload, with its file name, type and size.
For the AI Value Roadmap, we collect your name, email address, company name or website, industry, your answers to the placement questions, your language and, if you give it, your phone number. We store the stage your answers place you at. The link to your guide in our email is personal: we record when it is first opened and how many times it is opened.
When you join the Epibrain waitlist, we collect your company name and work email address. We also add them to the Epibrain waitlist in WorkOS, the service that runs sign-in to Epibrain, so that we can give you access later.
You are not legally required to provide form data. Fields marked as required are necessary for us to handle the request; without them, we may be unable to respond, prepare the benchmark, or assess the application.
The website offers tools to AI agents that run in your browser (WebMCP). If you ask such an agent to send us your contact details, it sends them before you confirm the form. We store them as an unconfirmed draft and notify our team. The request is complete only when you send the form yourself.
When you use Cubie, the AI chat on the website, we collect your name, your company name, what you want help with and your follow-up messages. We create a random browser identifier to restore the chat, and store the company research result, the session status and the number of follow-up questions. We do not store your follow-up messages. The company name is searched in public web sources through Exa. Your name, company, the research and your messages are sent to an AI model through Vercel AI Gateway to write the answers.
Cubie is intended for general business enquiries. Do not enter confidential information, trade secrets, special-category personal data, or other sensitive or regulated information in the chat.
On the page with example deliverables, you can describe your work in your own words to find matching examples. Your text, up to 600 characters, is sent to an AI model through Vercel AI Gateway. We do not store the text. To limit the number of searches, we keep your IP address in memory for up to 10 minutes.
If we make a personal video page for you, it shows your first name and company name. The video plays in a Loom player, which receives your IP address and can set its own cookies.
Our hosting providers process technical data, such as IP address, browser type and the pages requested, to deliver the website and keep it secure. To stop misuse of our forms, we store a code derived from the email address you enter (a hash) and count how often it is used.
If you allow analytics, PostHog assigns a random browser identifier and collects the full address of each page you visit (including parameters such as campaign tags), referring pages, browser and device information, an approximate location (city and country) derived from your IP address, interactions with selected buttons and forms, clicks, mouse movements and scroll depth for heatmaps, page performance measurements and technical error reports. PostHog does not store your IP address. We do not identify you by name or email in PostHog, and we do not send the text you enter in forms or searches to PostHog. Session recording, autocapture and marketing tracking are off.
Our hosting provider Vercel also collects aggregated visitor statistics (page views, referring pages, and coarse device and location data) through Vercel Web Analytics. These statistics use no cookies and no browser storage, and are not linked to an individual visitor. We combine them in an internal daily report for our team, which an AI model helps write.
Why we process it and on what legal basis
| Activity | Purpose | Legal basis |
|---|---|---|
| Contact form (“Talk to us”) and Company Brain meeting requests | To respond to your message or request | Our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR) |
| Benchmark request | To prepare your free company benchmark, email it to you, and arrange the consultation | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| Meeting-time proposal | To review your proposed times and confirm a meeting with you | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| AI Value Roadmap | To place your company on the roadmap, email you the guide for your stage, see whether the guide was opened, and contact you about it by email or phone | Steps taken at your request (Art. 6(1)(b)) to send the guide, and our legitimate interest in following up on business enquiries (Art. 6(1)(f)) |
| Careers application | To assess your application and contact you about it | Steps taken at your request before a possible employment contract (Art. 6(1)(b)) and our legitimate interest in recruitment (Art. 6(1)(f)) |
| Epibrain waitlist | To contact your company when there is a place in Epibrain’s early access, and to give you access | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| Contact details sent by an AI agent | To prepare for your request before you confirm it | Our legitimate interest in responding quickly to a request you asked your agent to send (Art. 6(1)(f)) |
| Cubie AI chat and company research | To provide the requested chat, research public company information, suggest relevant AI opportunities, restore the session, and enforce usage limits | Our legitimate interest in providing and securing an interactive business-information service requested by the visitor (Art. 6(1)(f)) |
| Example search | To find examples that match your description, and to prevent misuse | Our legitimate interest in providing a search you request (Art. 6(1)(f)) |
| Personal video pages | To show you a video we made for you and let you book a meeting | Our legitimate interest in following up on business contacts (Art. 6(1)(f)) |
| Website analytics (PostHog) | To understand which pages and calls to action are useful and improve the website | Consent (Art. 6(1)(a)); analytics remains disabled unless you allow it |
| Cookie-free visitor statistics and internal reports | To measure overall use of the website | Our legitimate interest in understanding how the website is used, without identifying visitors (Art. 6(1)(f)) |
| Hosting and security | To deliver the website and protect it from misuse | Our legitimate interest in operating a secure website (Art. 6(1)(f)) |
Where a form has a required checkbox, it records that you have read this notice and asked us to handle your submission; it is not the legal basis for the processing. Analytics consent is separate and can be refused without affecting access to the site. We do not sell personal data or use it for automated decisions that produce legal or similarly significant effects.
3. Epibrain
Account and usage data
When you use Epibrain, we process your name, email address, your organisation, your role and when you were last active. WorkOS handles sign-in and sends sign-in codes; we send invitations and a welcome email. A person with a verified email address at an organisation’s domain can join that organisation.
Epibrain is in early access. When you join the waitlist, on our website or on the Epibrain sign-up page, WorkOS stores your email address on the waitlist, with your company name if you joined on the website. We tell our team about the new entry. When we approve you, we email you a link to create your account. The link is valid for 7 days.
We record how Epibrain is used: who used which feature, source and AI model, with the number of tokens and the cost; the searches made, with their results; the actions Cubie takes (the audit log); and when AI used each item. We use these records to provide and secure Epibrain, to follow its costs, and to give organisations an overview of their own use.
Content we process for your organisation
When an organisation connects a source, Epibrain reads its content without changing it: from Google Workspace, Gmail, Google Drive, Google Chat and Google Calendar; from Microsoft 365, Outlook mail and calendars, OneDrive and SharePoint files, and Teams chats and channel messages; from Linear, issues and their comments; from GitHub, the code in the repositories it is given access to. Members can also upload files, including mailbox archives (.mbox and .pst).
To make the content searchable, Epibrain stores its text, a short summary, keywords, the people named in each item with their role (for example who wrote, decided or asked), and search vectors. Mail that is not work, such as newsletters and private mail, can be skipped, and mail marked as confidential gets stricter handling.
Epibrain also stores what members create: chats with Cubie and the files Cubie makes, agents and their schedules, notes Cubie keeps about how you like to work, tables, simulations, answers to handover interviews and to open questions, and shared MCPs.
Epibrain uses the people named in items to show who knows about a topic, to suggest a colleague who can answer a question that nobody has found an answer to, and to show the topics each person works on. A person who searches sees only results from items they can already read. These features do not make decisions with legal or similarly significant effects.
When a member leaves the organisation, Epibrain suspends their access and their personal sources. Before they leave, they can be asked handover questions about their work. The organisation’s admins can then hand over the work content to colleagues or export it. Before a handover, mail is checked to separate work from private mail.
Who can see what
Epibrain follows the access rights in each source. Content from a personal mailbox, a personal drive, a calendar or direct messages is visible only to its owner. Content that is shared with the organisation in the source is visible to its members.
An organisation’s admins can see each member’s usage and cost, and the actions Cubie took for each member, but not the titles or content of other members’ chats.
An organisation can share selected content with people outside it through a shared MCP. Mail and chats can never be shared. We store each guest’s name, email address and the questions they ask, and show them to the people who manage the share.
When you connect Epibrain to an AI tool such as Claude, ChatGPT or Cursor, the content Epibrain returns is sent to that tool. Its provider processes the content under your or your organisation’s own agreement with them. When you connect another app to Cubie, such as Linear or Notion, Cubie sends data to that app when it uses the app’s tools. These tools and apps are not our service providers.
Cubie can open public web pages for you in an isolated browser and search the web through Exa. Search queries can contain words from your chat.
How Epibrain uses AI
Epibrain sends content to AI models to index it, to search it and to answer you. These requests go through Vercel AI Gateway with zero data retention: the model provider processes the content only to return the result, does not keep it after the request and does not use it for training.
Members choose the model that Cubie uses. The default models are from Anthropic. Other models can run with the other providers listed in section 4.
To build search vectors, Epibrain sends text and search queries to the Google Gemini API. Google does not use this data to improve its products, but logs it for a limited time to detect misuse. Scanned PDF pages and spoken answers in handover interviews are processed by Google Vertex AI in the EU.
We do not use your content to train AI models, ours or anyone else’s.
Google user data
Epibrain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Epibrain asks Google for your name, email address and profile picture, and for read-only access to Gmail, Google Drive, Google Chat and Google Calendar. It uses this data only to provide and improve features you use in Epibrain: search, answers, agents and handovers within your organisation.
We do not use Google user data for advertising, we do not sell it, and we do not use data from Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine-learning models. We transfer it only to the service providers in section 4 that we need to provide Epibrain, when the law requires it, or as part of a merger or acquisition, with notice to you.
Our staff do not read Google user data unless you give us permission for specific content, it is necessary for security, such as investigating misuse, or the law requires it.
You can disconnect Google in Epibrain at any time. We then revoke Epibrain’s access at Google and delete the content Epibrain indexed from that connection.
Access by Epicube staff
Epicube staff can join an organisation’s workspace with a support role to solve a problem. We do this only when the organisation asks us for help, to investigate a security issue, or when the law requires it. While staff are in the workspace, members see them marked as Epibrain support, and an admin can remove them at any time.
Our administration console shows our staff each organisation’s members, sources, API keys and usage, but not its content.
Why we process it and on what legal basis
| Activity | Purpose | Legal basis |
|---|---|---|
| Waitlist | To decide when to give you access, and to send you the link to create your account | Steps taken at your request before entering a possible contract (Art. 6(1)(b)) |
| Accounts, sign-in and emails | To give you access to your organisation’s workspace, and to send invitations and sign-in codes | Our contract with you or your organisation (Art. 6(1)(b)), or our legitimate interest in providing the service to the organisation’s members (Art. 6(1)(f)) |
| Usage, cost and audit records | To follow costs, show organisations their own use, and secure the service | Our legitimate interest in running and securing Epibrain and following its costs (Art. 6(1)(f)) |
| Support | To answer your questions and solve problems | Our legitimate interest in supporting our customers (Art. 6(1)(f)) |
| Workspace content | To provide Epibrain to your organisation | We process it as a processor on your organisation’s instructions; your organisation decides the legal basis |
4. Service providers
We use these service providers. They process personal data for us under data-processing terms:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc.Website, Epibrain | Hosting; AI Gateway, which sends requests to AI models; isolated sandboxes that run code and browse the web; storage of Epibrain chat sessions; cookie-free visitor statistics | USA; Epibrain runs in the EU (Frankfurt), its sandboxes in the USA |
| AI model providers through Vercel AI GatewayWebsite, Epibrain | Answers, summaries and search. Only providers with zero data retention are used: Anthropic, Amazon Web Services (Bedrock), Google Cloud (Vertex AI), Microsoft Azure, OpenAI, Meta, TypeSafe AI, and hosts of open models such as Baseten, DeepInfra, Fireworks AI and Together AI | USA, EU and other countries |
| Convex, Inc.Website | Website backend and database for form submissions, Cubie sessions and outgoing email | USA |
| Neon (Databricks, Inc.)Epibrain | Epibrain database | EU (Frankfurt) |
| Cloudflare, Inc.Website, Epibrain | File storage: CVs and roadmap guides; files uploaded to Epibrain, Cubie’s notes and chat files | Storage region not fixed to the EU |
| Upstash, Inc.Epibrain | Starts scheduled agents at the set time | EU (Frankfurt) |
| WorkOS, Inc.Epibrain, Website | Sign-in, accounts and organisations, the Epibrain waitlist, and sign-in emails; staff sign-in on the website | USA |
| Resend, Inc.Website, Epibrain | Sending email | EU (Ireland); logs in the USA |
| Google (Google Ireland Ltd / Google LLC)Website, Epibrain | Google Workspace for our email, documents and customer records; Gemini API for search vectors in Epibrain | EU and USA |
| Exa Labs, Inc.Website, Epibrain | Web search for Cubie | USA |
| PostHog, Inc.Website | Website analytics, only with consent | EU (Germany) |
| Loom, Inc. (Atlassian)Website | Video player on personal video pages | USA |
The AI model providers process data as sub-processors of Vercel. The sources your organisation connects, and the AI tools and apps you connect Epibrain to, are not our service providers. We do not share personal data with other parties unless the law requires it.
5. Transfers outside the EU/EEA
Several providers are based in the USA or process data there, including Vercel, Convex, WorkOS, Cloudflare, Exa, Loom and Google, and Resend keeps its logs there. AI model providers can process data in the USA and in other countries. Where data is transferred outside the EU/EEA, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses. Epibrain’s servers and database are in the EU (Frankfurt), and PostHog stores website analytics in Germany. You may request a copy of the safeguards from us at legal@epicube.com.
6. How long we keep data
Website
| Data | How long |
|---|---|
| Form submissions: contact, benchmark, Company Brain meetings, meeting times, waitlist, AI Value Roadmap and careers, including CVs | Deleted automatically 24 months after submission |
| A CV uploaded without a completed application | 24 hours |
| Contact details sent by an AI agent and not confirmed | 30 days |
| Cubie sessions | 30 days after the last activity, or at once when you clear the chat |
| Text entered in the example search | Not stored; the IP address is kept in memory for up to 10 minutes |
| Hashed email address used to limit form submissions | Not deleted automatically. We delete it when you ask |
| Copies of sent emails in our email service | 30 days |
| Emails in our team’s mailboxes | As long as needed for your request and any business relationship that follows |
| PostHog analytics events | 1 year |
Epibrain
| Data | How long |
|---|---|
| Waitlist entries in WorkOS | Until you get access, at most 24 months. You can ask us to remove you earlier. The link to create an account is valid for 7 days |
| Content from a connected source | While the source is connected. When a source or app is disconnected, its indexed content and search vectors are deleted, and uploaded files are removed from storage |
| Content of a member who leaves | Deleted 30 days after they leave. If an admin starts a handover, up to 12 months; if an admin archives it, until an admin deletes it |
| Answers to handover interviews | Deleted when the interview is cancelled or the person leaves; notes they publish stay as workspace content |
| Search query text | 90 days |
| Audit log | Descriptions of actions: 90 days. The record that an action took place: while the organisation uses Epibrain |
| Records of AI use per item | 180 days |
| Account data, usage and cost records, chats, agents, tables and simulations | While the organisation uses Epibrain. A chat you delete is removed from your list at once |
| All data of an organisation that closes its account | Deleted within 30 days, unless the law requires us to keep it |
You can ask us to delete your data sooner at any time. We delete or anonymise data when it is no longer needed for these purposes. Withdrawing analytics consent stops future collection; it does not make earlier lawful processing unlawful.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted (“right to be forgotten”)
- Restrict or object to our processing
- Receive your data in a portable format where applicable
- Withdraw consent at any time (for processing based on consent), without affecting processing before withdrawal
If your data is in an organisation’s Epibrain workspace, the organisation decides on requests to access or delete that content. Send your request to the organisation; if you send it to us, we forward it and help the organisation answer.
To exercise any of these rights, email us at legal@epicube.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, www.imy.se); you may also complain to the authority in your own EU country.
9. Security
We use appropriate technical and organisational measures to protect personal data. Data is encrypted in transit and at rest. In Epibrain, access tokens for connected sources and apps are encrypted, API keys are stored only as hashes, and access to content follows the permissions in each source. We use established infrastructure providers and limit staff access as described above.
10. Changes to this policy
We may update this policy. The current version is always on this page, with the date of the last revision at the top. Before we change how Epibrain uses Google user data or other workspace content, we update this page and tell the organisations that use Epibrain.