Legal

Privacy Policy

Last updated: September 29, 2026

This Privacy Policy explains how Cubista, Inc. (“Cubista,” “we,” “us”) collects, uses, and discloses personal information through our website at cubista.io (the “Site”) and our relationship intelligence platform (the “Platform,” and together with the Site, the “Services”). It also describes the choices and rights available to you, including under the California Consumer Privacy Act, as amended (the “CCPA”).

1. Our Role

Cubista provides the Platform to businesses, primarily financial-services firms (“Customers”). How we handle personal information depends on our role:

• As a service provider. When a Customer uses the Platform, it may upload or connect data about its employees, clients, prospects, and contacts (“Customer Data”). We process Customer Data on the Customer’s behalf and under its instructions and our agreement with it. The Customer’s own privacy notice governs Customer Data. If your information is in Customer Data and you have questions or want to exercise your rights, please contact that Customer; we will assist it as required.
• As a business. For Site visitors, prospective customers, and Platform account holders, we decide how personal information is used, and this Policy governs.

2. Information We Collect

Information you provide

• Contact and business information: name, email, phone, company, job title, and messages when you request a demo, contact us, or sign up.
• Account information: login credentials, user profile, role, and preferences.
• Support and feedback: communications with us and feedback about the Services.

Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, pages viewed, features used, timestamps, and referring URLs.
• Cookies and similar technologies: used to operate the Site, keep you signed in, remember preferences, and understand usage. See Section 7.

Customer Data processed on the Platform

Depending on the Customer’s configuration, Customer Data may include:

• CRM records: contact, account, and activity data from systems such as Salesforce or Microsoft Dynamics.
• Email and calendar data: from connected Google Workspace or Microsoft 365 accounts, which may include message and event metadata (senders, recipients, dates, subjects) and, where the Customer enables it, content.
• Call and meeting notes: transcripts, notes, and summaries the Customer uploads or connects.
• Public and third-party data: professional and business information from public sources and licensed data providers used to enrich relationship insights.

3. How We Use Information

• Provide, operate, secure, and support the Services, including generating relationship insights for Customers.
• Create and manage accounts, authenticate users, and communicate about the Services.
• Respond to inquiries, provide demos, and send marketing communications (you may opt out at any time).
• Monitor, maintain, and improve the Services, including through aggregated or de-identified usage analytics.
• Detect, prevent, and respond to fraud, abuse, security incidents, and legal violations.
• Comply with legal obligations and enforce our agreements.

Customer Data. We use Customer Data only to provide the Services to that Customer, as instructed by the Customer, and as otherwise permitted for service providers under the CCPA. We do not sell Customer Data, and we do not use Customer Data to train AI models made available to other customers.

4. AI Processing

The Platform uses machine learning and large language models, including models provided by third-party AI vendors acting as our subprocessors, to analyze Customer Data and generate insights. These vendors are contractually restricted from using Customer Data to train their models and from retaining it beyond what is needed to provide their service.

5. Google and Microsoft Integrations

When a user connects a Google or Microsoft account, we access only the data covered by the permissions the user grants, and only to provide the features they enable. Cubista’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data to develop, improve, or train generalized AI or machine-learning models; we do not transfer it to others except as needed to provide or improve user-facing features, for security, or to comply with law; and humans do not read it except with the user’s consent, for security purposes, or as required by law. Users may revoke access at any time in their Google or Microsoft account settings.

6. How We Disclose Information

• Service providers and subprocessors that host, secure, and support the Services (such as cloud hosting, AI model providers, analytics, and customer support tools), under contracts that limit their use of personal information.
• Customers: information within a Customer’s workspace is available to that Customer and its authorized users.
• Legal and safety: to comply with law, legal process, or regulatory requests, or to protect the rights, property, or safety of Cubista, our Customers, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With consent or at your direction.

No sale or sharing. We do not sell personal information and do not “share” it for cross-context behavioral advertising, as those terms are defined in the CCPA, and have not done so in the past 12 months.

7. Cookies

The Site uses strictly necessary cookies and analytics cookies, such as Google Analytics. You can control cookies through your browser settings; blocking some cookies may affect functionality. We honor Global Privacy Control (GPC) signals as a request to opt out of any sale or sharing. Our Site does not respond to other “Do Not Track” signals.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and logging. We are pursuing a SOC 2 audit. No system is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy, including to provide the Services, meet legal and accounting obligations, resolve disputes, and enforce agreements. Customer Data is retained according to the Customer’s agreement and instructions and is deleted or returned after the agreement ends, subject to routine backup cycles.

10. Your California Privacy Rights

If you are a California resident, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (we do not sell or share).
• Limit the use of sensitive personal information (we use it only for purposes permitted without offering this right, such as account login credentials for security).
• Non-discrimination for exercising these rights.

To make a request, email privacy@cubista.io. We will verify your identity by matching information you provide with information we hold. You may use an authorized agent, who must provide proof of authorization. We will respond within 45 days, extendable once by 45 days with notice. For information in Customer Data, we will refer you to the relevant Customer.

Categories of personal information collected in the past 12 months

• Identifiers (name, email, IP address, account ID) — from you, your device, and Customers.
• Professional or employment information (company, title, business relationships) — from you, Customers, and public or licensed sources.
• Internet or network activity (usage and device data) — from your device.
• Commercial information (products or services considered or purchased) — from you.
• Inferences (relationship strength and engagement insights generated for Customers) — derived from Customer Data.
• Sensitive personal information (account login credentials) — from you, used only for authentication and security.

We collect these categories for the purposes in Section 3 and disclose them for business purposes to the recipients in Section 6.

11. Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children.

12. International Users

We are based in the United States and process information in the U.S. If you access the Services from elsewhere, your information will be transferred to and processed in the U.S.

13. Changes

We may update this Policy. We will post the updated version with a new “Last updated” date and, for material changes, give notice through the Services or by email.

14. Contact Us

Cubista, Inc. · team@cubista.io