Privacy Policy

Last updated: 11 September 2026

1. Data controller

Next Step L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates — privacy@cubrik.ai.

This policy applies to the website cubrik.ai and the Cubrik service. For users located in the European Economic Area, the United Kingdom or Switzerland, we apply the principles of the GDPR / UK GDPR.

2. Data we collect

Account data: e-mail address, display name, password (hashed), preferences.

Billing data: subscribed plan, payment history, country and tax identifier where applicable. Card details are collected and processed directly by our payment provider; we do not have access to them.

Configuration data: instructions given to agents, triggers, limits, selected model.

API keys and connection tokens to your third-party services, encrypted at rest (AES-256), never logged in clear text, accessible only to the Service components that run your agents.

Execution data: actions performed by your agents, generated reasoning, market data consulted, technical logs. This data is necessary for the traceability we provide to you.

Technical data: IP address, browser type, pages viewed, timestamps, session identifiers.

Support: content of your exchanges with our support team.

3. Purposes and legal bases

Purpose	Legal basis
Providing the Service, running agents	Performance of the contract
Billing, accounting	Legal obligation / contract
Security, fraud and abuse prevention	Legitimate interest
Support and service communications	Contract / legitimate interest
Improving the Service (aggregated statistics)	Legitimate interest
Marketing e-mails	Consent (withdrawable at any time)

4. Processors and recipients

We share data only with the providers needed to operate the Service, bound by contract:

• AI model providers (e.g. Anthropic, OpenAI, Google): receive your instructions and the market data required for analysis. We do not send them your API keys or credentials. These providers contractually undertake not to train their models on data submitted via API.
• Third-party services you connect (exchanges, etc.): receive the orders issued by your agents, using your own credentials.
• Payment provider: subscription processing.
• Hosting and infrastructure, transactional e-mail, support tooling, analytics.

We do not sell your data. We may disclose it to authorities where required by law.

5. International transfers

Our providers may be located outside your country, notably in the United States and the United Arab Emirates. For data of persons located in the EEA/UK, we rely on the European Commission's standard contractual clauses or equivalent mechanisms.

6. Retention periods

• Account and configuration: duration of the relationship, then 30 days after closure.
• API keys: deleted within 30 days after closure or immediately upon revocation.
• Execution logs: 24 months, then anonymised.
• Billing: 10 years (accounting obligations).
• Technical security logs: 12 months.

7. Your rights

You may access your data, rectify it, erase it, request its portability, restrict or object to its processing, and withdraw your consent. Requests to privacy@cubrik.ai; response within 30 days. You may lodge a complaint with the data protection authority of your country of residence.

8. Security

Encryption in transit (TLS) and at rest, secret isolation, least-privilege access control, access logging, encrypted backups. No system is infallible; in the event of a breach affecting your data, we will notify you within the legally required timeframes.

9. Minors

The Service is not available to minors. We do not knowingly collect data relating to them.

10. Changes

Any material change will be notified by e-mail or in the application.