Privacy policy

This policy is issued by Cube Systems Limited, a company registered in England and Wales under number 17220899, with its registered office at Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. CubeSites is a trading name of Cube Systems Limited, which is part of Crushed Ice Group. In this policy, “we”, “us” and “our” mean Cube Systems Limited.

For the processing this policy describes we are the controller. That means we decide how and why the data is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office under registration number ZC216972.

We are not required to appoint a data protection officer. Questions about this policy or your personal data go to hello@cubesites.co.uk, by telephone on 01234 672 617, or by post to the address above, marked for the attention of the data protection lead.

We handle personal data in two different capacities, and it matters which one applies to you.

Where we are the controller

This policy covers personal data we collect for our own purposes, about:

• people who visit this website;
• people who contact us;
• contacts at our customers, prospective customers and suppliers; and
• people who sign in to CubeSites, on the web or in the phone app, in respect of their account, sign-in and security records, the notification token their phone registers, and any support request they raise with us.

Where we are a processor

Organisations use CubeSites to build and run their websites. The personal data in them, such as staff names and photos on a team page, enquiries sent through a contact form, and the orders and details of people who buy from its shop, belongs to that organisation. The organisation is its controller and its own privacy notice applies. We process that data only on its instructions and under our customer terms.

If a website has a product catalogue, the searches its visitors make there are kept for its owner: the words searched for, what they found, the page the search was made from, and the type of device and browser. The visitor is a code that changes every day, made on our server from the IP address and browser without storing either, so a visitor cannot be followed from one day to the next. If that visitor sends an enquiry the same day, the searches are linked to it. Visitors whose browsers ask not to be tracked (Do Not Track or Global Privacy Control) are left out. Searches are kept for as long as the website’s plan keeps visitor statistics.

A website’s owner can list addresses whose visits are not counted in its statistics, such as their own office. Those addresses are kept with the website’s settings in their account and are never shown on the website.

When you visit this website

Pages, fonts, icons and images are served from our own servers. The website sets no cookies unless you allow analytics, and it carries no advertising or social media tags.

Like any web server, ours keeps a log of each request: your IP address, the date and time, the page requested, the page that linked to it, and the browser and operating system your device reports. We use these logs only to keep the site secure and working.

Your browser also keeps a short note of your visit in its session storage, under the name visit_journey: the page you arrived on and when, the site that sent you, any campaign tags or ad click IDs in that first link, the previous page, and how many pages you have viewed. It stays in that browser tab, is deleted when you close it, and only reaches us if you send the enquiry form.

If you allow analytics

When analytics is in use, a banner asks whether you allow it. If you choose “Accept”, Google Analytics 4 sets its _ga and _ga_<container-id> cookies and records which pages you view, how you arrived, the type of device, browser and screen you use, your approximate location (worked out by Google from your IP address), and interactions such as following a link, clicking a phone number or email address, and sending the enquiry form. GA4 does not log or store IP addresses. We see the results as reports about visits in general, and we do not use them to identify anyone. Advertising features are switched off.

The Google Analytics script only loads after you allow analytics, so if you choose “Essential only” nothing is sent to Google. If you withdraw your consent through Cookie settings, Google Analytics stops and its _ga cookies are removed.

When you get in touch

If you use the contact form we collect your name and email address, your company name and telephone number if you give them, the type of enquiry, your message, and the page you sent it from.

With the form, your browser also sends details about your visit. They help us route your enquiry, spot misuse of the form, and understand which pages lead people to get in touch. They are:

• your IP address;
• your browser, operating system and type of device, read from the user agent your browser reports;
• your language, time zone and local time, your screen and window size, whether your device has a touch screen, and whether cookies are enabled;
• the note of your visit described above; and
• if you allowed analytics, your Google Analytics client ID.

The enquiry is sent by email through Amazon Simple Email Service (Amazon SES) to the Cube Systems enquiries mailbox. If you email or call us, we keep what you tell us and the details you contact us from.

Please do not send passwords, API keys or personal data about other people through the contact form.

When you become a customer

We hold names and business contact details for the people we deal with at your organisation, including account, billing and technical contacts, together with billing records and the history of our support conversations. Card payments are taken by Stripe on its own secure pages: we receive the billing name, address, VAT number and the status of each subscription, invoice and payment, but never a full card number.

When you use CubeSites

• Account details: your name, email address, profile settings, and your role in each workspace you belong to.
• Sign-in data: the details needed to sign you in, including a password hashed with Argon2id and, if you turn on two-step sign-in, the secret your authenticator app uses.
• Security records: sign-in times and the IP address and browser used, which we use to protect accounts and investigate misuse.
• Activity records: which user created, changed or published a site, a page or a setting, and when.
• Support requests: anything you send us when you ask for help.
• Shop payments: if you connect a Stripe account to sell through a website, Stripe collects the identity, business and bank details it needs directly, in its own forms shown inside CubeSites. We keep the account’s identifier and whether it can take payments and receive payouts.

When you use the phone app

The phone app shows the same account and the same website data as the web, on a small screen. On top of what the application already holds, it keeps the following.

• Session token: held in the phone’s secure storage, the iOS keychain or Android Keystore, so you are not asked for your password every time. It is deleted when you sign out.
• Installation identifier: a random ID for this installation of the app, kept in secure storage so the API can tell one phone from another. It is not a device serial number and it is not used for advertising.
• Notification token: the push token issued by Apple or Google, the phone’s platform and app version, the workspace you belong to, and which kinds of notification you want, so that an enquiry reaches the right phones. Expo and Google’s Firebase Cloud Messaging carry them.
• Actions on a notification: anything you do from the notification itself, such as marking an enquiry read or archiving it.
• Photos: only the photos you choose to add to your website, taken with the camera or picked from your photo library. The app asks for access the first time you use either.
• App lock: checked by the phone, using your face, fingerprint or passcode. We never receive a face, a fingerprint or a passcode, only whether the check passed.
• Offline copies: recent enquiries and figures kept on the phone so the app opens instantly and works on a poor signal. Removed when you sign out, or after seven days.

The app carries no advertising and no analytics or crash-reporting software. It cannot do anything the web cannot: the same permissions apply to each person, and every change is recorded in the activity history.

We do not ask for special category data, such as health information, and CubeSites is built for businesses, so we do not knowingly collect information about children.

Data protection law requires a lawful basis for every use of personal data. These are ours.

Where we rely on legitimate interests, we have weighed them against your rights and you can ask us for that assessment. You can object at any time, as explained under your rights.

We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

CubeSites offers AI drafts of pages, text and images. When a user asks for one, the request and the relevant site content are sent to Anthropic (text) or OpenAI (images) to produce the draft. They process it under their API terms, which do not allow them to train models on it. Nothing generated is used until a person accepts it, and an organisation can turn AI off for its workspace.

In the phone app, asking for a draft reply to an enquiry sends that enquiry, including the visitor’s name, email address and message, to Anthropic for the draft. The app explains this and asks before the first draft is requested.

If an organisation connects its own AI assistant, such as ChatGPT or Claude, to CubeSites, the assistant reads and changes that organisation’s websites through our API, under the organisation’s own account with the assistant’s provider. That provider is chosen by the organisation and is not our sub-processor.

Businesses use CubeSites to sell from their own websites. When you buy from one of those shops, the business is the seller and the controller of your personal data, and its own privacy notice applies. We process the data for the business as its processor, only on its instructions.

For each shop, we hold the following for the business:

• Orders, including ones that were not paid for: the items, prices, discount codes, delivery method and charges, your name, email address, phone number if you give it, delivery address and any note you leave, the payment and refund status, the order’s history, and any notes or tags the business adds.
• Order documents and emails: invoices, receipts, packing slips and despatch notes made from the order, and a record of the order emails sent to you.
• Back-in-stock requests: the email address you leave against a sold-out product, used to send you one email when it is back, with a link to cancel the request. Nothing else is sent to that address because of the request.
• Mailing list sign-ups: your email address and, where the business offers one, a welcome email and a discount code made for you.
• Anonymous basket records: what is in a basket, its value, the type of device and the first page of the visit, held against a random key kept in your browser. Only a hashed form of the key is stored, never your name, email address or IP address. If you place an order, the basket record is linked to that order.

Card payments are made with Stripe, on the business’s own Stripe account. You enter your card details with Stripe, and neither we nor the business receive them. Stripe receives your email address, the items and the amounts for the payment. Stripe processes payment data under its agreement with the business, and as a controller in its own right for purposes such as preventing fraud, as its privacy policy explains.

Order, back-in-stock and welcome emails are sent for the business through our email service, Amazon SES. The business can see its orders, its customer list (built from paid orders) and its back-in-stock requests in the app, and can download the customer list.

A website marked as a demo takes no real payments: its checkout uses Stripe’s test mode, and the website says it is a demo.

This data is kept while the business’s workspace exists, and is permanently deleted 30 days after the workspace is deleted. To use your rights over it, such as asking for a copy or a correction, contact the business. If you contact us instead, we will pass your request on.

We do not sell personal data, and we do not share it with anyone for their own marketing. We share it only with:

• Crushed Ice Group companies, where one of them helps deliver or support the service.
• Service providers who process data for us under written contracts: Amazon Web Services, which hosts CubeSites and delivers our email; Stripe, which takes card payments for our invoices and, for shops, on each shop’s own Stripe account; Google, for website analytics if you allow it and for carrying push notifications to Android phones; Expo, which delivers push notifications to the phone app; and our business email and accounting providers.
• Professional advisers, such as lawyers, accountants and insurers, who owe us a duty of confidentiality.
• Authorities, such as the police, HMRC or a regulator, where the law requires it. We check that a request is lawful before acting on it and, where the data belongs to a customer, we tell the customer unless the law forbids us to.
• A buyer or successor, if all or part of our business is sold or reorganised, on condition that they honour this policy.

These are the sub-processors that handle data held in CubeSites:

CubeSites is hosted in the UK on Amazon Web Services (AWS). Our servers, databases and backups are in the UK. Card payments, for our own invoices and for our customers’ shops, are handled by Stripe, which may process payment details in Ireland and the United States under its own safeguards.

Google Analytics runs only if you allow it. It is provided by Google Ireland Limited, with Google LLC, and the data may be processed in the United States under the UK Extension to the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to any transfer.

Push notifications for the phone app are delivered through Expo (650 Industries, Inc.) in the United States and through Google’s Firebase Cloud Messaging. Both may process the notification token and the text of the notification outside the UK, under their own safeguards. The text can name the person who sent the enquiry.

We keep personal data only for as long as we need it for the purpose it was collected for, then delete or anonymise it.

Where a legal claim or investigation is under way, we may keep the relevant records until it is resolved.

Core security features are part of CubeSites on every plan. The measures that protect personal data include:

• HTTPS on every page and every API call;
• passwords hashed with Argon2id, and two-step sign-in by authenticator app;
• a session token in the phone app held in the phone’s secure storage, and an optional app lock, so a lost phone does not hand over the account;
• roles and project-level permissions, checked on the server for every request;
• every workspace kept separate on the server, with automated tests that check one workspace cannot reach another;
• viewers who can look but not change anything;
• personal API tokens that act with their creator’s permissions and can be revoked at any time; and
• staff access limited to the people who need it to run and support the service.

If a personal data breach is likely to put people’s rights at risk, we will report it to the ICO within 72 hours of becoming aware of it and, where the risk is high, tell the people affected without undue delay.

Under UK GDPR you have the right to:

• be informed about how your data is used, which is what this policy is for;
• access a copy of the personal data we hold about you;
• rectification of data that is inaccurate or incomplete;
• erasure of your data where there is no good reason for us to keep it;
• restrict how we use it, for example while a question about its accuracy is resolved;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability, receiving data you gave us in a machine-readable format; and
• withdraw consent, where we rely on it, without affecting anything done before. For analytics, use Cookie settings in the footer of any page.

To use any of these rights, email hello@cubesites.co.uk. You do not need a form or any particular wording. We may ask you to confirm your identity before we act, so that we never hand your data to someone else. We respond within one month, and there is normally no charge.

If your request concerns data an organisation holds in its CubeSites workspace, we will pass it to that organisation, which is responsible for answering it, and help it do so.

If you are unhappy with how we have handled your data, please tell us first at hello@cubesites.co.uk and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection:

• online at ico.org.uk/make-a-complaint;
• by telephone on 0303 123 1113; or
• by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

This website sets no cookies unless you allow Google Analytics, which then sets two. CubeSites itself uses one cookie to keep you signed in on the web, and the phone app sets none at all: it keeps a session token in the phone’s secure storage instead. Websites built with CubeSites set no cookies of their own; a shop keeps its basket in the browser’s storage. Everything is listed in our cookie policy.

We review this policy at least once a year, and whenever the way we handle personal data changes. The date at the top shows when it was last updated. If a change materially affects customers, we will email their account owners before it takes effect.