cubic

GDPR overview

cubic never claims GDPR compliance in so many words, but its privacy policy carries a dedicated European Union section. It sets out the legal bases relied upon, namely consent, performance of a contract, legal obligation, public interest and legitimate interest, and enumerates the rights available to data subjects: withdrawal of consent, objection, access, rectification, restriction, erasure, portability and the right to lodge a complaint. Requests go to contact@cubic.dev and are answered free of charge within one month. Beyond that the implementation is thin. No data protection officer is named, no Article 27 representative is designated, no transfer mechanism such as standard contractual clauses is mentioned, and no hosting country is disclosed. A data processing agreement exists only in the Enterprise plan, negotiated case by case.

Who owns the data?

Under the terms of service you keep every right in the content you submit and in the code the service generates from your prompts. cubic nonetheless grants itself a worldwide, royalty-free licence to use, process, copy, analyse and create derivative works from your content, pull request data, review results, prompts and metadata, in order to operate and to train, fine-tune and improve its own products. It may exercise those rights through its affiliates, service providers, subprocessors and assignees. It states that it does not sell customer code and does not let third-party AI providers train their own models on it. A separate written agreement, such as an enterprise contract, can override all of this.

Reuse rights

You may reuse whatever the service produces without asking permission: the terms state that you retain all right, title and interest in the code generated from your prompts, as well as in the content you submit. Nothing requires attribution or a licence back for that reuse. Three limits apply. The service and its AI outputs are supplied as is, with no warranty that any particular result will be obtained, so verification remains your responsibility. cubic's own intellectual property, meaning its brand, interface and software, is excluded, and reverse engineering, redistribution of service material and circumvention of security controls are all prohibited. Finally, liability is capped at the greater of twelve months of fees paid or one hundred US dollars.

Data retention & training

Hosting summary

No hosting country or region is disclosed. The privacy policy states only that data is processed at the owner's operating offices and wherever the parties involved in the processing are located, and that a transfer abroad may occur depending on where the user is; no transfer mechanism such as standard contractual clauses is named. What is documented is the pipeline rather than the geography. Reviews run in an isolated container with no network egress, only the code snippets needed for the requested analysis leave it, and the named AI subprocessors are OpenAI and Anthropic. Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256, including database records and object storage. The publisher is a Delaware corporation and the terms are governed by Californian law, which points to the United States without confirming where anything is actually stored. The domain resolves to a United States anycast node, which is a content delivery address and says nothing about storage.