Privacy Policy

Last updated: 7 November 2026

1. Data controller

Cubrik Inc., a Delaware corporation (United States) — privacy@cubrik.ai.

This policy applies to the website cubrik.ai, the Cubrik web application and the Cubrik mobile application. For users located in the European Economic Area, the United Kingdom or Switzerland, we apply the principles of the GDPR / UK GDPR.

2. What Cubrik does with your money — nothing

Cubrik holds no funds, takes no custody of any asset, and is not a broker. It has no trading account of its own, simulated or otherwise: it drafts strategies, tests them against historical market data, and runs agents that report to you — and that act only through a service of your own that you connected and allowed them to use.

You may connect your own accounts and tools to Cubrik through an MCP connector — your broker's, your exchange's, or one you run yourself. When you do, you authorise that service directly, in its own screen, and we store the access token it issues so that your agent can use it. That token is the only credential of yours we ever hold: never a password, and never your card details. You choose which of the connected service's tools your agent may use; none of them are available to it until you switch them on, and you can disconnect at any moment, which deletes the token there and then rather than thirty days later.

Where money moves as a result, it moves on the connected service, under the agreement you have with that service and on instructions you approved. Cubrik never touches it.

3. Data we collect

Account data: your e-mail address, and the display name and form of address you choose. There are no passwords. You sign in with a single-use code we e-mail you, or with Sign in with Apple or Sign in with Google; where you use one of those, we receive the e-mail address you agreed to share and, if the provider sends it, your name.

Billing data: the plan you subscribe to, the credits you buy, payment history, and country and tax identifier where applicable. Plans and credits are bought on our website or, in the mobile application, through the App Store or Google Play. Card details are collected and processed directly by our payment provider — or by Apple or Google for a purchase made in the application — and we never see or store them. For a purchase made in the application, Apple or Google send us a record of it: the product, the dates, the transaction identifiers and whether it is in force, renewed, refunded or cancelled.

Configuration data: the strategies you write, the instructions you give your agents, their triggers and their limits, the standing instruction you may set for the chat, and your preferences.

Agent activity: what your agents did on each run — the market data they read, the tools they called, what they did or were refused on a service you connected, and the reports they wrote. This is what the run history and your notifications are built from.

Analyses: where you analyse a service you connected, the trades read from it and the figures computed from them.

Connector data: for each connector you add — the name you gave it, the address of the server, and the access token that server issued, which is encrypted before it is written and is never shown again: not to you, not to our support, not in our administration tools. We also keep the list of tools that server offers, which of them you enabled, and a line for each call your agent makes through it — which connector, which tool, when, and whether it worked. What the call contained is not recorded: those are your trading instructions, and one copy of them is enough.

Conversations: what you write to the agent, the files and images you attach to a message, and what it replies.

Skills: the playbooks you write or import — each one's name, its description and its instructions — and whether the chat and which of your agents use it.

AI applications you connect to Cubrik: if you connect an artificial intelligence application such as Claude, ChatGPT, Cursor or Claude Code to your account through Cubrik's MCP server — the application's name and the address it signs in from, the permissions you gave it, when you connected it and when it last called, the access and refresh tokens issued to it (stored only as a one-way fingerprint, never as the token itself), and a line for each call it makes: which tool, when, whether it worked and how long it took. What the call contained is not recorded; what it changed in your account is recorded as it would be had you made the change yourself, with the application's name.

AI consent: in the mobile application, whether you allowed your data to be sent to the artificial intelligence services it names (section 5), the version of that notice you agreed to and when — and when you withdrew it, if you did.

Technical data: IP address and the approximate country, city and time zone derived from it, device and browser type, timestamps, session identifiers. The approximate location is shown back to you in your list of sessions so that you can recognise a sign-in that is not yours; it comes from the network address of the request and never from your device's location services, which the Service does not use and does not ask for.

Mobile notifications: if you turn them on, the notification token your device issues, so that an alert can reach that device.

Messages we send you: a record of the transactional e-mails sent to you — the recipient, the kind of message and the time. The content of a message carrying a one-time code is never stored.

Support: the content of your exchanges with our support team.

Affiliate programme: if you join it — the Whop account we found for you (its identifier and username), the affiliate record created for it at Whop, the codes of your links and the names you gave them, the number of visitors, sign-ups and customers each link brought, your count of active paying referrals and the rate it gives you, the figures Whop reports for your affiliate account (referrals, revenue and commissions), and the version of the Affiliate Terms you accepted and when. We never show an affiliate who their referrals are.

Referral: if you arrive through an affiliate's link or enter an affiliate's code, that code is kept with your account; Whop receives it with your first purchase of a plan on our website so that it can pay that affiliate, and we record the bonus credits your first plan payment gave you.

Creator Marketplace, if you sell: your public name, your country, whether you sell as a private person or as a business, and the version of the Creator Terms you accepted and when; the identifier of the seller account Whop opened for you, and what Whop tells us of it — whether it can take payments and pay out, and what Whop still needs from you; the strategies you put on sale, each version of them as you sent it for review — its instruction, schedule, model and limits — and our reviews of them, with their reasons; and the subscriptions sold to your strategies, with the payments, refunds, disputes and fees Whop reports for them. Your identity documents and payout details are collected by Whop, on its own pages; we do not ask for them and keep none of them. Your public name, whether you sell as a private person or as a business, and the figures we measure of the agent you sell — from its trades with real money on your own account: the trades it opened and closed, how many it won, its net result and its return on margin — are shown on its listing to every member.

Creator Marketplace, if you subscribe: each strategy subscription you buy — the strategy, its creator, the period, the price, its dates and whether it is in force, ending or ended — with the payments, refunds and disputes Whop reports for it. The agent a subscription runs is yours, and its activity is recorded as any agent's. Its results count, with those of the strategy's other subscribers, in the figures the strategy's listing shows: only together, as rates, and only once at least three subscribers have traded it.

Ad measurement: only if you accept the advertising measurement cookies in the banner on our website or in the web application — and never in the mobile application. Meta's and Whop's pixels then record the pages you open on cubrik.ai and the web application's sign-in, welcome and plans pages, with the identifiers their cookies keep on your device (see the Cookie Policy). Our servers also tell Meta when your account was created, when you opened a checkout, when a payment for a plan or for credits went through — its amount, its currency and what it bought — and when you sent an enterprise request, so that each is counted once even when a browser blocks the pixel. With each of them Meta receives your e-mail address and your account's identifier, both hashed (SHA-256), the identifiers its own cookies hold, and the IP address and browser of the request. Neither pixel runs on the pages that carry a sign-in link.

4. Purposes and legal bases

Purpose	Legal basis
Providing the Service: answering you in the chat, running your agents and your backtests, producing your analyses	Performance of the contract
Sending your data from the mobile application to the artificial intelligence services named in section 5	Your consent, asked in the application before anything is sent and withdrawable at any time in Settings
Billing, accounting	Legal obligation / contract
Running the affiliate programme: attributing referrals, counting them, setting each affiliate's rate, giving bonus credits	Performance of the contract (the Terms of Service and the Affiliate Terms)
Running the Creator Marketplace: opening creators' seller accounts with Whop, reviewing strategies, selling subscriptions and matching each to the subscriber's account, running subscribers' agents, showing the figures we measure	Performance of the contract (the Terms of Service and the Creator Terms)
Reporting creators and their sales to tax or other authorities, where the law requires it	Legal obligation
Security, fraud and abuse prevention	Legitimate interest
Support and service communications	Contract / legitimate interest
Improving the Service (aggregated statistics)	Legitimate interest
Measuring which advertisements bring visitors, sign-ups and purchases (Meta Pixel and Conversions API, Whop's pixel)	Your consent, asked in a banner before anything is loaded and withdrawable at any time
Marketing e-mails	Consent (withdrawable at any time)

5. Processors and recipients

We share data only with the providers needed to operate the Service. Those that process your data on our behalf are bound by contract to use it only to provide their service to us, and to protect it to a standard at least equal to this policy:

• Amazon Web Services (Frankfurt, eu-central-1): hosting and transactional e-mail.

• Artificial intelligence. The answers in the chat, the work of your agents, the scores of your strategies and the summary on your Analyses page are written by artificial intelligence models that other companies run. Each request sends the model what that request needs: your messages and the files or photos you attach, the name or form of address you asked to be called by, your standing instruction, the strategies and agents concerned, what the agent read from a service you connected, and — for the Analyses summary — the figures of the trades you closed. The model uses it to write the answer, and we use what comes back only to show it to you. These are the companies that receive it:

  • OpenRouter, Inc. (United States), through which the chat, the agents, the strategy scores and the summary on your Analyses page reach their models; that summary is written by a model made by Anthropic. OpenRouter passes each request to the company that runs the model concerned — its maker, or a provider that hosts it — which writes the answer and returns it to us. The models we offer are made by DeepSeek, Alibaba (Qwen), Z.ai, Google, OpenAI, xAI and Anthropic; the mobile application uses DeepSeek's by default.
  • TypeSafe, through OpenRouter: its model reads a message to choose which model answers it, where the application makes that choice for you, and scores the strategies you ask it to score.

  These companies process what they receive under their own terms and data-protection commitments, to write the answer. We never sell your data, and we let none of them use it for advertising.

  • In the mobile application, nothing is sent to an artificial intelligence service until you have been told which ones receive what, and have allowed it. The application asks on a screen of its own, before the first request, naming each company and what is sent to it. You can withdraw that permission at any time in Settings, under AI data sharing; doing so also pauses your running agents, since their work is your data going to the same services.

• MongoDB Atlas (Frankfurt): the database in which the data described above is stored.

• Cloudflare: serves the website and the applications and terminates the connection; it processes request metadata, including your IP address.

• Whop, Inc. (United States), our payment provider: processes the plans and credits bought on our website (subscriptions taken before October 2026 were processed by Stripe). For the affiliate programme, Whop holds the affiliates' accounts, receives an affiliate's code with a referred purchase, calculates and pays the commissions, and tells us the figures of each affiliate's account. With your consent, Whop's pixel also tells Whop which visits to our website and web application end in a purchase on its checkout. For the Creator Marketplace, Whop opens a seller account for each creator, connected to ours, verifies the creator's identity, takes subscribers' payments on that account, deducts our fee and pays the creator out; it handles the creator's identity and payout details under its own terms and tells us only the state of the account. When a creator joins, we send Whop the e-mail address and the identifier of their account with us, their public name and their country. When a subscriber opens a checkout, we send Whop the identifier of their account with us, so that the subscription can be matched to it.

• The creator of a strategy you subscribe to: as its seller, the creator can see on Whop the details of their buyers that Whop shows sellers, which can include your name, your e-mail address and the payments you made for the subscription. The creator is not our subcontractor: they receive these details as the seller, and the Creator Terms allow them to use them only for the subscription. We do not give creators your account, your agents, your connected accounts or your own results.

• Meta Platforms Ireland Ltd (Ireland), with Meta Platforms, Inc. (United States): only with your consent, it receives the pages, events and identifiers described under Ad measurement in section 3. Meta uses them under its Business Tools Terms to measure our advertisements and to show them to people likely to be interested, and for that use it decides itself how the data is used.

• Apple: where you turn on notifications on an iPhone, your device token and the notification pass through Apple's Push Notification service. Where you use Sign in with Apple, Apple tells us the address you chose to share. Where you buy a plan or credits in the application on an iPhone, the App Store takes the payment and tells us what was bought.

• Google: where you turn on notifications on an Android phone, your device token and the notification pass through Google's Firebase Cloud Messaging. Where you use Sign in with Google, Google tells us your e-mail address and your name. Where you buy a plan or credits in the application on Android, Google Play takes the payment and tells us what was bought.

• The AI applications you connect yourself: where you connect an AI application to your account, it receives what its tools return when it calls them — depending on the permissions you gave it, your plan and credits, your agents and their runs, your strategies, backtests and analyses, your skills, market data and, on the services you connected, your balances, positions and orders. That application is not our subcontractor: it is yours, under the terms you accepted with its provider (for example Anthropic for Claude, or OpenAI for ChatGPT). We do not choose it, we do not control the model behind it, and we cannot see what it does with what it receives. You can disconnect it at any time in Settings, under AI apps, which ends its access immediately.

• The services you connect yourself: where you add a connector, the requests your agent makes go to that server and what it returns comes back to us. That service is not our subcontractor — it is yours, under the terms you accepted with it. We do not choose it, we do not control which tools it offers, and we cannot see what it does with a request once it has one.

Apart from the ad measurement you may accept (Meta and Whop, above), we use no advertising, analytics, attribution or crash-reporting service. Apart from the cookies strictly necessary to keep you signed in, to remember your language and to remember your answer to the banner, we set only a referral cookie: when you arrive through an affiliate's or a member's link, it keeps that link's code for 60 days so that the person who referred you is credited if you sign up later (see the Cookie Policy). We do not sell your data, and apart from Meta's own use of the ad-measurement events you allowed, we do not share it for anyone else's purposes. We may disclose data to authorities where the law requires it.

6. International transfers

Our providers may be located outside your country, notably in the United States. A request that goes through OpenRouter is processed in the United States and in the country of the company that runs the model, which can be outside the European Union. The ad-measurement events you allowed can be processed by Meta in the United States. For data of persons located in the EEA, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses or an equivalent mechanism.

7. Retention periods

• Account, configuration and conversations: for the duration of the relationship, then 30 days after closure.
• Agent run logs and analyses: 24 months, then anonymised.
• AI consent record: for the duration of the relationship, then 30 days after closure.
• Record of e-mails sent to you: 12 months.
• Billing: 10 years (accounting obligations).
• Affiliate programme: for as long as you take part, then 30 days after you leave it or close your account; the payments and commissions concerned are kept with billing data.
• Creator Marketplace: a creator's seller record, listings, versions and our reviews of them, until the creator's account is closed and the last subscription to their strategies has ended, then 30 days; strategy subscriptions, payments, refunds and fees, with billing data.
• Technical and security logs: 12 months.
• Connector access tokens: until you disconnect that connector or close your account, whichever comes first — deleted immediately in either case, not after a delay.
• AI application connections: until you disconnect the application or close your account; its tokens are deleted immediately in either case. The record of its calls is kept for 90 days.
• Skills: until you delete them or close your account.
• Sessions: expire within 7 days of their last use.
• Ad measurement: each event sent to Meta, 30 days on our side; the identifiers of the browser that accepted, 30 days after its last visit. What Meta and Whop keep is governed by their own terms.

8. Your rights

You may access your data, rectify it, erase it, request its portability, restrict or object to its processing, and withdraw your consent. You can withdraw your consent to ad measurement at any time through "Cookie settings" in the website's footer, or in the web application under Settings, then General. In the mobile application, you can withdraw your consent to sending your data to the artificial intelligence services named in section 5 at any time in Settings, under AI data sharing. You can delete your account, and everything listed above with it, from inside the application at any time — Settings, then Delete account. Other requests go to privacy@cubrik.ai and are answered within 30 days. You may lodge a complaint with the data protection authority of your country of residence.

9. Security

Encryption in transit (TLS) and at rest, secret isolation, least-privilege access control, access logging, encrypted backups.

A connector's access token is encrypted with a key of its own before it is written, and that key is itself stored encrypted, apart from the database holding the token. It is never written to a log, never returned by any of our interfaces and never visible in our administration tools. No system is infallible; in the event of a breach affecting your data, we will notify you within the timeframes the law requires.

10. Minors

The Service is not available to anyone under 18, or under the age of majority where they live. We do not knowingly collect data relating to them.

11. Changes

Any material change will be notified by e-mail or in the application.