Your data, and your customers' data, well looked after

1. Who we are

cubobase is a business run by Diego Maciel (sole proprietorship, registration in progress), domiciled in Montevideo, Uruguay. We make online stores, the Manager (an artificial intelligence assistant that answers a business's WhatsApp) and the app each owner uses to control everything.

For anything about your data: contacto@cubobase.com.

This policy follows Uruguay's Ley 18.331 (Uruguay's personal data protection law) and its implementing decrees.

2. What data we keep and what for

It depends on who you are. There are three cases.

If you have a business on cubobase

In this case, we are the controller of your data.

• Your data: name, mobile number and, if you give it to us, your email. They're used so you can log in to the app, to notify you of orders and to invoice you if you pay for a plan.
• Your business's data: name, logo, pickup address, products, photos, prices, opening hours and the details for receiving transfers (bank and account). If you sell digital products, also their files, links or codes: only the person who paid for them can download them.
• Your connections: if you connect Mercado Pago, Stripe or WhatsApp, we store the keys they give us (for Stripe, the restricted key you paste yourself) to collect payments and send messages on your behalf. We never store your Mercado Pago, Stripe or Meta password.
• What you write to your Manager and the changes you confirm to it (for example, a new price), so they can be undone.
• Your devices: which ones you turned notifications on for (the type of device, not its location).
• When you log in: to stop anyone trying to guess codes, we record for 2 days the email or device and the internet address (IP) of each attempt.
• Invoices and payments for what you pay cubobase.

If you bought from or wrote to a business that uses cubobase

Here, the controller of your data is that business. We store and use it only on the business's behalf and for what it needs: preparing your order, confirming your booking or answering you. (The law calls this role "encargado del tratamiento", that is, data processor.)

• If you place an order or a booking: your name, your mobile number, the address if you asked for delivery, what you ordered, how you're paying, the day you want it and whatever you write under "Anything else?". Also the internet address (IP) it was placed from, to stop fake orders.
• Your email, if you leave it: to send you updates on your order. If you buy something digital it's required, because that's where what you bought is sent.
• If you buy something digital (a file, a link, a code): we record how many times you downloaded each file (up to 10 times, and the business can give you more). If the business chose this option, PDFs are downloaded with your email and the order number at the foot of each page, so they aren't shared.
• If you pay with Mercado Pago: you enter your card on Mercado Pago, never on cubobase. We only find out whether the payment was approved.
• If you pay by card at a store in Spain or the United States: you enter your card on Stripe, never on cubobase. We send Stripe what you bought, the amount and, if you left it, your email; we only find out whether the payment went through.
• If you write on WhatsApp to a business with a Manager: your number, your WhatsApp profile name and the text of the messages. Voice messages are stored, so the business can listen to them, and are transcribed to text on our own server (they're not sent to another company for that). The photos and videos you send are not stored: the Manager only sees that you sent one (for a location, the address is kept; for a document, its name).

• If you only browse the store: we count the visit so the business knows how many people look at it, where they come from (for example, from Instagram) and which products get added to the cart most. Just like on cubobase.com: no cookies and without storing your internet address, using a marker that changes every day. The business sees only numbers, never who you are.

The business sees your orders, bookings and conversations in its app, and we notify it of each new order through the app and by email.

If you visit cubobase.com

• We count visits without cookies and without storing your internet address (IP). We record the page, where you came from (for example, a link from a promotion), the approximate country (taken from your device's time zone) and whether it's a phone or a computer.
• To avoid counting the same person twice we use a marker that changes every day: the key used to build it is deleted after 2 days, so afterwards there's no way to know who it was.
• If you write to Neo in the chat: we store what you write and what it replies. Your browser stores a random key so the conversation can continue if you come back; we don't know who you are unless you tell us. If you give it your name, your mobile number or your email (for example, to open your store or so we can write to you), they stay in the conversation. To stop bots, we record the internet address (IP) of each message and delete it after 2 days. Neo answers using the artificial intelligence described in section 3.
• For a few weeks, while we compare numbers, visits are also counted by GoatCounter, a cookie-free counter.
• The page loads its fonts from Google Fonts and, in the demo, the dollar exchange rate from open.er-api.com: those services receive your device's internet address, as happens with any page that uses them.

3. Artificial intelligence

The Manager and Neo, cubobase's assistant, answer using Claude, an artificial intelligence model from the company Anthropic (United States).

• What we send it: what the business entered (products, prices, opening hours, the Manager's personality), the latest messages in the conversation and, to serve you better, your mobile number, your WhatsApp name and your recent orders and bookings with that business. In the cubobase.com chat, the latest messages in the conversation and the stores you opened in it.
• What Anthropic does with it: it uses it only to write the reply. It doesn't use it to train its models and deletes it from its systems after 30 days.
• It doesn't pretend to be a person: if you ask whether it's human, it tells you no.
• It doesn't decide important things on its own: whatever it doesn't know, it asks the owner, and changes to prices, stock or whether the business is open are made by the program only once the owner confirms them.

"Improve photo", on the other hand, runs on our own server: product photos aren't sent to anyone.

4. Who we share it with

We don't sell or rent data to anyone. We only share it with the companies needed for the service to work, and each one receives just what it needs:

We may also have to hand over data if a judge or an authority requires it under a law.

5. Data that leaves Uruguay

Some of those companies are outside the country. Uruguayan law allows data to be sent to places that protect data as well as Uruguay does:

• Hetzner is in the European Union, which Uruguay considers adequate.
• Meta, Google and Stripe participate in the United States Data Privacy Framework, which the Unidad Reguladora y de Control de Datos Personales (URCDP, Uruguay's data protection authority) also considers adequate.
• With Anthropic (the artificial intelligence) and with our email provider, we rely on consent: the owner gives it by accepting these terms and activating the Manager, and whoever writes to Neo on cubobase.com gives it by using the chat, which states that an artificial intelligence answers. In addition, we send Anthropic only what's needed for each reply, and it deletes it after 30 days.

6. How long we keep it

• As long as the business uses cubobase: the store's data, orders, bookings and conversations (with their voice messages), because the owner needs them for their accounts and to serve their customers. The same goes for the files of its digital products: if the owner removes one, it's deleted.
• When a business cancels: we delete its data and its customers' data within 30 days. It disappears from the backups automatically within the following 30 days.
• Invoices and payments to cubobase: for as long as tax and commercial laws require.
• Attempts to log in to the app: 2 days.
• Conversations with Neo on cubobase.com: one year from the last message (if you opened a store, its data follows the rules above).
• Visits to cubobase.com and to the stores: with nothing that identifies a person, so they're kept as statistics.

If you're a store's customer and want us to delete your data sooner, just ask (see section 9).

7. Cookies and what's stored on your device

• In the owner's app: one cookie so you don't have to log in every time (it lasts a year and renews each time you log in) and another that remembers your email for the next code. It also remembers small things, like whether you've already seen a notice.
• In the stores: the cart stays saved on your device until you place the order. No cookies.
• On cubobase.com: no cookies. If you use the Neo chat, your device stores the key to your conversation (it can't be used to follow you across other sites); if you clear your browser data, the conversation starts over.

We don't use advertising cookies or cross-site tracking cookies.

8. How we protect it

• Everything travels encrypted (https).
• Login codes aren't stored as they are: we store a fingerprint from which the code can't be recovered. Mercado Pago, Stripe and WhatsApp keys are stored encrypted.
• cubobase's internal panel can't be opened from the internet: only from a private network.
• There are backups every day.
• We will never ask you for passwords or card details, by email or by WhatsApp. If someone does so in cubobase's name, they're not from us.

If there were ever a security problem affecting your data, we'll notify you and the URCDP, as the law requires.

9. Your rights

The law gives you the right to know what data of yours we have, to correct it, update it, add anything missing and to ask us to delete it. It's free.

• How: write to contacto@cubobase.com with your name and what you want. If you're a store's customer, tell us which store and the mobile number you ordered or wrote from, so we can find you.
• When: we reply within 5 business days.
• If you're a store's customer, you can also ask the business directly. If you write to us, we'll sort it out with the business.
• If something wasn't resolved properly, you can file a complaint with the Unidad Reguladora y de Control de Datos Personales: gub.uy/urcdp.

10. Minors

To open a business on cubobase you must be over 18. The stores aren't made for minors, and we don't seek to collect data from minors.

11. If we change this policy

The version that applies is always the one on this page, with its date at the top. If the change is important, we let owners know beforehand through the app or by email.