CubeOne

GDPR overview

There is no mention of the GDPR anywhere on the site. Neither the terms, the privacy policy nor any other page refers to the regulation or to any European text. No legal basis for processing is stated, no right of access, rectification, erasure or portability is described, no Data Protection Officer is appointed and no Article 27 EU representative is designated. No Data Processing Agreement is published or offered on request, and no subprocessor list exists. The privacy policy, last updated on 26 May 2025, does cover collection, purposes, retention and security, but in generic terms outside any European framework. The single channel offered is hi@getcube.one, for questions or concerns about that policy. A European user therefore has no documented basis on which to exercise their rights.

Who owns the data?

The terms draw a clean line: you keep intellectual property rights over the inputs you bring, while CubeOne retains rights over its AI models and systems. AI-generated content is supplied "as is", with no guarantee of accuracy, completeness or appropriateness, and reviewing it before use is your responsibility. The company also reserves the right to monitor AI interactions to prevent abuse. On the privacy side, the personal data collected is limited to name, email address and usage data; unnamed "Service Providers" may process it on the company's behalf, and it may pass to a third party in a merger, restructuring or sale of assets. Ownership of the generated slides themselves is never addressed.

Reuse rights

You retain the rights to everything you bring in, so nothing you upload needs permission to be reused elsewhere. Decks download as fully editable PPTX files and can be carried into PowerPoint or Canva; the terms impose no attribution requirement and set no limit on commercial use. The restrictions sit on conduct rather than reuse. Community guidelines prohibit NSFW, violent, hateful or discriminatory content, anything promoting illegal activity, and anything infringing third-party intellectual property. Using the service to generate harmful, illegal or malicious content, or attempting to manipulate or exploit the AI systems, is equally forbidden, and a breach can trigger immediate suspension or permanent termination depending on severity. Reviewing and validating AI output before you rely on it remains your obligation.

Data retention & training

Hosting summary

No hosting jurisdiction is published. Neither the privacy policy nor the terms names a country or region where user data is stored or processed, and the site has no trust or security page. No subprocessor list exists either: the privacy policy refers to Service Providers that process data on the company's behalf, but names none of them. The only third party identified in a processing role is Stripe, which handles payments, is certified to PCI DSS Level 1, and receives card details directly so that they never reach CubeOne's servers. The security commitment itself is general, namely commercially acceptable means, with an explicit acknowledgement that no method of transmission or storage is completely secure. One element sits outside the site and should be read as such: a DNS lookup performed on 24 August 2026 resolves the domain to an anycast address belonging to Amazon. That is a network measurement, not a statement by the vendor, and it says nothing about where user files are actually stored.