Privacy Policy

The categories of personal information we collect, organized by the categories defined under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). For each category we list the typical examples, where we get it, and what we use it for. We do not collect any category not listed here.

We collect personal information in three ways:

• Directly from you when you create an account, edit your profile, list a product, place an order, message another user, file a support ticket, or sign up for our email list.
• Automatically when you use the Service - server logs (IP, browser, requested URL, timestamp), aggregated Plausible analytics, and the cookies described in §07 below.
• From a small set of third parties, only as needed to run the Service:
  • Payment processors (Stripe, PayPal, Klarna, Afterpay, Coinbase Business) confirm whether your payment succeeded and pass us transaction metadata. They handle your card or wallet directly; we do not see the full numbers.
  • Sign-in providers (Google, Facebook), only if you choose to sign in with one of them. We receive your name and email; nothing more is requested.
  • Cloud-storage delivery providers (Dropbox, Google Drive), only if you connect them to deliver purchased Goods to your own cloud storage. Cubebrush receives a scoped, revocable access token; we use it only to write the files you bought and do not read or retain anything else from your storage. You can revoke the token at any time from the third party's settings.
  • Rights holders may submit information about you in the course of a DMCA notice or platform-policy report. This is processed under §10 (Your rights) and the Terms §18.

Under EU/UK GDPR, every use of personal data must have a lawful basis. For each purpose below, we name the basis we rely on. Categories of personal information are referenced by letter from §01.

Performance of a contract (GDPR Art. 6(1)(b)):

• Creating and operating your account; signing you in. (A, B)
• Processing your purchases and payouts; delivering purchased files. (B, C, G)
• Running messaging, comments, wishlists, library, and the resolution process between Buyers and Sellers. (A, C, F)
• Sending Service-related notices (receipts, payout confirmations, security alerts, policy changes). (A)

Legitimate interests (GDPR Art. 6(1)(f)):

• Security, fraud detection, abuse prevention, and rate limiting. (A, D, E)
• Aggregate, non-identifying analytics for capacity planning, debugging, and product improvement. We use Plausible Analytics; see §07. (D)
• Tax, accounting, and financial reporting (e.g. issuing 1099s). (B, C, G)
• Defending or enforcing our rights, responding to legal requests, and managing risk. (any)

Compliance with a legal obligation (GDPR Art. 6(1)(c)):

• Tax filing and record retention (US, plus your local rules where applicable). (B, C, G)
• Sanctions screening - we do not transact with persons or regions on OFAC or equivalent restricted-party lists. (A, E, G)
• Responding to valid subpoenas, court orders, regulator requests, and DMCA / EU DSA notices. (any)
• Honoring data-rights requests under GDPR, CCPA/CPRA, and equivalent laws. (any)

Consent (GDPR Art. 6(1)(a)), only when you've explicitly opted in:

• Marketing emails about new features, drops, and promotions. You can opt out at any time from Settings → Notifications or via the unsubscribe link in every marketing email. (A)
• Any future SMS program. We do not currently run one; if we ever do, we will obtain separate, specific opt-in consent before sending you any text.

Personalized discovery. We use first-party account activity and inferred product interests to help you find relevant products. Where the law permits, we rely on our legitimate interest in providing useful recommendations after considering your rights and expectations. Where consent is required for tracking or the resulting profiling, we obtain it before that processing begins. You may withdraw consent or object to processing based on legitimate interests by contacting us using the details in §14. Refusing optional personalization does not prevent you from browsing or buying. (A, C, D, H)

We do not use your personal information, or your User Content, to train AI. We have never used any of it as training, fine-tuning, or evaluation data for any artificial-intelligence or machine-learning model, ours, a third party's, or an open-source model, and we will not do so.

We do not sell, license, or otherwise transfer your data to any third party for AI/ML training purposes, and we do not enter into bulk data-licensing arrangements that would expose your data to AI training.

AI-assisted features. We may use AI to help with search and product recommendations, listing organization, seller-requested descriptions or translations, support triage, and abuse review. These features process limited information for a specific task; they do not authorize training on your work. Sellers review assisted listing text before publication. We do not use these tools to generate the artwork sold in the public marketplace.

We limit inputs to the information needed for the feature, such as product metadata, a question submitted to support, or material you select for assistance. We do not send payment credentials, tax documents or complete purchased asset archives to general-purpose AI services. Before a feature sends information to an AI provider, we identify the relevant provider and processing purpose and provide any required notice or choice. Provider contracts and settings must prohibit using that information for model training; retention and international transfers are covered by our provider disclosures.

See Terms §09 for the distinction between operational assistance and the public marketplace content policy.

We do not sell, rent, or share your personal information for monetization or for cross-context behavioral advertising. We have never done so.

The only third parties who see your personal information are the service providers we use to run the Service - sometimes called “sub-processors.” Each is contractually bound to use your data only for the purpose listed, and only on our instructions.

We may also disclose personal information to:

• Our professional advisers (lawyers, accountants, auditors) under confidentiality, where necessary for managing the company.
• Regulators and government authorities, in response to lawful requests (subpoenas, court orders, regulator inquiries, DMCA notices, EU DSA notices). We review every request for validity and scope; we push back on overbroad demands.
• A purchaser or prospective purchaser of all or part of our business, under confidentiality, if Cubebrush is sold or merged. We will notify users in advance of any such transfer of their data.
• The other party to a dispute, where we are required to do so to enforce or defend our rights or yours, for example, sharing a Buyer's order details with a Seller during a refund dispute.

Cubebrush is established in the United States and our primary data processing happens here. When you use the Service from outside the US, your personal information will be transferred to and processed in the US, which may not have the same data-protection laws as your jurisdiction.

For users in the European Economic Area, Switzerland, and Liechtenstein, we transfer personal information out of the EEA under the European Commission's Standard Contractual Clauses (SCCs) (Decision 2021/914), supplemented where necessary by technical and organizational safeguards.

For users in the United Kingdom, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs, as appropriate.

You may request a copy of the safeguards in place for your transfers by emailing [email protected].

Our full cookies disclosure lives in Terms §16 and is summarized here. In short: we use a deliberately small set of cookies, and our analytics provider does not use cookies at all.

Cubebrush uses cookies for:

• Authentication: keeping you signed in. First-party; limited to the requested function.
• Functionality: remembering your cart, wishlist, theme, language. First-party; limited to the requested function.
• Security: CSRF tokens; bot detection via Cloudflare. Limited to security and abuse prevention.
• Payment: Stripe, PayPal, Klarna, Afterpay, and Coinbase Business each set the cookies required to run their checkout flow when you choose them. Third-party; set only when you actually use that payment method.

For analytics we use Plausible for aggregate measurement without cookies or persistent visitor profiles. Request information such as IP address and browser information is processed to produce aggregate statistics; Plausible does not retain raw IP addresses or user-agent strings. We do not send account identifiers or personal profile data to Plausible. Plausible's full data-collection practices are published at plausible.io/data-policy.

We do not use:

• Google Analytics, the Meta Pixel, the TikTok pixel, or any other advertising or retargeting tag.
• Session-recording or screen-replay tools.
• Cross-site behavioral profiling, identity-graph, or data-broker cookies.
• Cookies that sell, rent, or share your personal information.

Attribution and optional features. Partner referrals use a 30-day attribution cookie as described in the Partner Agreement, subject to applicable consent requirements. Other optional features may involve personalization, embedded media or third-party storage. We explain the purpose and obtain consent before any storage, access or related processing that requires it. A first-party cookie, local storage or a server-side implementation is not automatically exempt. Declining optional processing keeps core browsing and purchasing available.

We do not track you across the web. Cubebrush does not deploy cross-site tracking pixels or trackers, and we do not authorize the collection of personally identifiable information from our visitors for third-party advertising use.

Browser privacy signals. Global Privacy Control (GPC) and Do Not Track (DNT) are different signals. We honor applicable legally recognized opt-out signals, including GPC where required. We do not sell personal information or use it for cross-context behavioral advertising. Optional first-party personalization and its controls are described in §03 and §07; the absence of advertising trackers does not remove applicable privacy rights.

This section serves as the disclosure required by the California Online Privacy Protection Act (CalOPPA).

Depending on where you live, you have legal rights with respect to your personal information under the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). Other US state privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA) do not currently apply to Cubebrush at our volume. Regardless of statutory applicability, Cubebrush extends every right listed below to all Users worldwide as a matter of policy.

You have the right to:

• Be informed about how we collect and use your personal information - which is what this Policy is for.
• Access the personal information we hold about you and receive a copy in a structured, portable format.
• Correct personal information that is inaccurate or incomplete.
• Delete your account and the personal information associated with it, subject to limited legal or operational retention obligations (see §12).
• Restrict or object to certain processing of your personal information, for example, processing we base on legitimate interest.
• Withdraw consent at any time where we rely on consent (marketing emails; any future SMS program). Withdrawing does not affect the lawfulness of processing done before the withdrawal.
• Opt out of the sale or sharing of your personal information. As stated throughout, we do not sell or share for cross-context behavioral advertising - so this right is preserved by default.
• Not be discriminated against for exercising any of these rights.
• Lodge a complaint with your local data-protection authority. In the EU, that's the supervisory authority of your country of residence, place of work, or place of the alleged infringement. In the UK, the Information Commissioner's Office (ICO). In California, the California Privacy Protection Agency (CPPA) or the Attorney General.

How to exercise these rights:

• Most rights can be exercised self-serve from Settings → Privacy: access, download, delete account, opt out of marketing, etc.
• For everything else, or if a self-serve action fails, email [email protected]. We will verify your identity (so we don't hand your data to someone else pretending to be you) and respond within 30 days for GDPR / UK GDPR requests and 45 days for CCPA/CPRA requests. Either window may be extended by up to 2 additional months / 45 days for complex or voluminous requests; we'll tell you within the original window if we need the extension.
• You may authorize an agent to make a request on your behalf. We will require proof of the agent's authorization and may contact you to verify.
• Exercising any of these rights is free.

The Service is not directed to children. The minimum age to use Cubebrush is 13, or such higher minimum age as is required by your local jurisdiction, for example, 16 in much of the European Union under GDPR Article 8, or the corresponding age set by your EU Member State or the United Kingdom. We do not knowingly collect personal information from children under the applicable minimum age.

If you are under the applicable minimum age, please do not send any information about yourself to us. If you believe a child has provided us personal information, contact [email protected] and we will delete it promptly.

We use industry-standard safeguards to protect your personal information: encryption in transit (TLS) and at rest; scoped access controls; logging and review of administrative access; regular security review; and the option of two-factor authentication and passkeys for every account. We strongly recommend enabling 2FA on your account.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you and, where applicable, the relevant regulators in accordance with applicable law (GDPR Art. 33–34, and US state breach-notification statutes).

We retain personal information for as long as needed to provide the Service, and afterwards only to the extent required for the specific legal, accounting, or operational reasons listed below. We do not retain data indefinitely "just in case."

When the applicable retention period ends, we delete or irreversibly anonymize the data. Account deletion is immediate and irreversible: we do not maintain rolling backups, snapshots, or any other mechanism that could restore an account after you confirm deletion. The only records that survive are those listed above with longer mandatory retention (transactions, tax forms, fraud history); those live in a separate financial ledger keyed by order number, not by your account profile. If you later need a copy of a specific purchase, contact us with the order number and we can usually retrieve it.

We may update this Policy from time to time. When we make a material change, we will update the "last revised" date at the top of the page, and for significant changes we'll also notify you by email or in-product banner. Continued use of the Service after a change indicates your acceptance of the updated Policy.

For historical reference, the Policy was first published on May 1, 2015. Material revision history is available on request from [email protected].

We're a small team and we read every privacy email personally.

Entity

Cubebrush, LLC

Address

1968 S. Coast Hwy #1597
Laguna Beach, CA 92651

Privacy

[email protected]

General

[email protected]

DMCA

[email protected]

EU DSA

[email protected]

For EU and UK users: if you are not satisfied with our handling of a privacy concern, you have the right to lodge a complaint with your local data-protection authority. We hope you'll try us first.