Privacy Policy

Last updated: 27 October 2026

1. Data controller

Next Step L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates — privacy@cubrik.ai.

This policy applies to the website cubrik.ai, the Cubrik web application and the Cubrik mobile application. For users located in the European Economic Area, the United Kingdom or Switzerland, we apply the principles of the GDPR / UK GDPR.

2. What Cubrik does with your money — nothing

Cubrik holds no funds, takes no custody of any asset, and is not a broker. It has no trading account of its own, simulated or otherwise: it drafts strategies, tests them against historical market data, and runs agents that report to you — and that act only through a service of your own that you connected and allowed them to use.

You may connect your own accounts and tools to Cubrik through an MCP connector — your broker's, your exchange's, or one you run yourself. When you do, you authorise that service directly, in its own screen, and we store the access token it issues so that your agent can use it. That token is the only credential of yours we ever hold: never a password, and never your card details. You choose which of the connected service's tools your agent may use; none of them are available to it until you switch them on, and you can disconnect at any moment, which deletes the token there and then rather than thirty days later.

Where money moves as a result, it moves on the connected service, under the agreement you have with that service and on instructions you approved. Cubrik never touches it.

3. Data we collect

Account data: your e-mail address, and the display name and form of address you choose. There are no passwords. You sign in with a single-use code we e-mail you, or with Sign in with Apple or Sign in with Google; where you use one of those, we receive the e-mail address you agreed to share and, if the provider sends it, your name.

Billing data: the plan you subscribe to, the credits you buy, payment history, and country and tax identifier where applicable. Plans and credits are bought on our website or, in the mobile application, through the App Store or Google Play. Card details are collected and processed directly by our payment provider — or by Apple or Google for a purchase made in the application — and we never see or store them. For a purchase made in the application, Apple or Google send us a record of it: the product, the dates, the transaction identifiers and whether it is in force, renewed, refunded or cancelled.

Configuration data: the strategies you write, the instructions you give your agents, their triggers and their limits, the standing instruction you may set for the chat, and your preferences.

Agent activity: what your agents did on each run — the market data they read, the tools they called, what they did or were refused on a service you connected, and the reports they wrote. This is what the run history and your notifications are built from.

Analyses: where you analyse a service you connected, the trades read from it and the figures computed from them.

Connector data: for each connector you add — the name you gave it, the address of the server, and the access token that server issued, which is encrypted before it is written and is never shown again: not to you, not to our support, not in our administration tools. We also keep the list of tools that server offers, which of them you enabled, and a line for each call your agent makes through it — which connector, which tool, when, and whether it worked. What the call contained is not recorded: those are your trading instructions, and one copy of them is enough.

Conversations: what you write to the agent, the files and images you attach to a message, and what it replies.

Skills: the playbooks you write or import — each one's name, its description and its instructions — and whether the chat and which of your agents use it.

AI applications you connect to Cubrik: if you connect an artificial intelligence application such as Claude, ChatGPT, Cursor or Claude Code to your account through Cubrik's MCP server — the application's name and the address it signs in from, the permissions you gave it, when you connected it and when it last called, the access and refresh tokens issued to it (stored only as a one-way fingerprint, never as the token itself), and a line for each call it makes: which tool, when, whether it worked and how long it took. What the call contained is not recorded; what it changed in your account is recorded as it would be had you made the change yourself, with the application's name.

AI consent: in the mobile application, whether you allowed your data to be sent to the artificial intelligence services it names (section 5), the version of that notice you agreed to and when — and when you withdrew it, if you did.

Technical data: IP address and the approximate country, city and time zone derived from it, device and browser type, timestamps, session identifiers. The approximate location is shown back to you in your list of sessions so that you can recognise a sign-in that is not yours; it comes from the network address of the request and never from your device's location services, which the Service does not use and does not ask for.

Mobile notifications: if you turn them on, the notification token your device issues, so that an alert can reach that device.

Messages we send you: a record of the transactional e-mails sent to you — the recipient, the kind of message and the time. The content of a message carrying a one-time code is never stored.

Support: the content of your exchanges with our support team.

Affiliate programme: if you join it — the Whop account we found for you (its identifier and username), the affiliate record created for it at Whop, the codes of your links and the names you gave them, the number of visitors, sign-ups and customers each link brought, your count of active paying referrals and the rate it gives you, the figures Whop reports for your affiliate account (referrals, revenue and commissions), and the version of the Affiliate Terms you accepted and when. We never show an affiliate who their referrals are.

Referral: if you arrive through an affiliate's link or enter an affiliate's code, that code is kept with your account; Whop receives it with your first purchase of a plan on our website so that it can pay that affiliate, and we record the bonus credits your first plan payment gave you.

4. Purposes and legal bases

Purpose	Legal basis
Providing the Service: answering you in the chat, running your agents and your backtests, producing your analyses	Performance of the contract
Sending your data from the mobile application to the artificial intelligence services named in section 5	Your consent, asked in the application before anything is sent and withdrawable at any time in Settings
Billing, accounting	Legal obligation / contract
Running the affiliate programme: attributing referrals, counting them, setting each affiliate's rate, giving bonus credits	Performance of the contract (the Terms of Service and the Affiliate Terms)
Security, fraud and abuse prevention	Legitimate interest
Support and service communications	Contract / legitimate interest
Improving the Service (aggregated statistics)	Legitimate interest
Marketing e-mails	Consent (withdrawable at any time)

5. Processors and recipients

We share data only with the providers needed to operate the Service. Those that process your data on our behalf are bound by contract to use it only to provide their service to us, and to protect it to a standard at least equal to this policy:

• Amazon Web Services (Frankfurt, eu-central-1): hosting and transactional e-mail.

• Artificial intelligence. The answers in the chat, the work of your agents, the scores of your strategies and the summary on your Analyses page are written by artificial intelligence models that other companies run. Each request sends the model what that request needs: your messages and the files or photos you attach, the name or form of address you asked to be called by, your standing instruction, the strategies and agents concerned, what the agent read from a service you connected, and — for the Analyses summary — the figures of the trades you closed. The model uses it to write the answer, and we use what comes back only to show it to you. These are the companies that receive it:

  • OpenRouter, Inc. (United States), through which the chat, the agents, the strategy scores and the summary on your Analyses page reach their models; that summary is written by a model made by Anthropic. OpenRouter passes each request to the company that runs the model concerned — its maker, or a provider that hosts it — which writes the answer and returns it to us. The models we offer are made by DeepSeek, Alibaba (Qwen), Z.ai, Google, OpenAI, xAI and Anthropic; the mobile application uses DeepSeek's by default.
  • TypeSafe, through OpenRouter: its model reads a message to choose which model answers it, where the application makes that choice for you, and scores the strategies you ask it to score.

  These companies process what they receive under their own terms and data-protection commitments, to write the answer. We never sell your data, and we let none of them use it for advertising.

  • In the mobile application, nothing is sent to an artificial intelligence service until you have been told which ones receive what, and have allowed it. The application asks on a screen of its own, before the first request, naming each company and what is sent to it. You can withdraw that permission at any time in Settings, under AI data sharing; doing so also pauses your running agents, since their work is your data going to the same services.

• MongoDB Atlas (Frankfurt): the database in which the data described above is stored.

• Cloudflare: serves the website and the applications and terminates the connection; it processes request metadata, including your IP address.

• Whop, Inc. (United States), our payment provider: processes the plans and credits bought on our website (subscriptions taken before October 2026 were processed by Stripe). For the affiliate programme, Whop holds the affiliates' accounts, receives an affiliate's code with a referred purchase, calculates and pays the commissions, and tells us the figures of each affiliate's account.

• Apple: where you turn on notifications on an iPhone, your device token and the notification pass through Apple's Push Notification service. Where you use Sign in with Apple, Apple tells us the address you chose to share. Where you buy a plan or credits in the application on an iPhone, the App Store takes the payment and tells us what was bought.

• Google: where you turn on notifications on an Android phone, your device token and the notification pass through Google's Firebase Cloud Messaging. Where you use Sign in with Google, Google tells us your e-mail address and your name. Where you buy a plan or credits in the application on Android, Google Play takes the payment and tells us what was bought.

• The AI applications you connect yourself: where you connect an AI application to your account, it receives what its tools return when it calls them — depending on the permissions you gave it, your plan and credits, your agents and their runs, your strategies, backtests and analyses, your skills, market data and, on the services you connected, your balances, positions and orders. That application is not our subcontractor: it is yours, under the terms you accepted with its provider (for example Anthropic for Claude, or OpenAI for ChatGPT). We do not choose it, we do not control the model behind it, and we cannot see what it does with what it receives. You can disconnect it at any time in Settings, under AI apps, which ends its access immediately.

• The services you connect yourself: where you add a connector, the requests your agent makes go to that server and what it returns comes back to us. That service is not our subcontractor — it is yours, under the terms you accepted with it. We do not choose it, we do not control which tools it offers, and we cannot see what it does with a request once it has one.

We use no advertising, analytics, attribution or crash-reporting service, and apart from the cookies strictly necessary to keep you signed in and to remember your language, we set only a referral cookie: when you arrive through an affiliate's or a member's link, it keeps that link's code for 60 days so that the person who referred you is credited if you sign up later (see the Cookie Policy). We do not sell your data and we do not share it for anyone else's purposes. We may disclose data to authorities where the law requires it.

6. International transfers

Our providers may be located outside your country, notably in the United States and the United Arab Emirates. A request that goes through OpenRouter is processed in the United States and in the country of the company that runs the model, which can be outside the European Union. For data of persons located in the EEA, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses or an equivalent mechanism.

7. Retention periods

• Account, configuration and conversations: for the duration of the relationship, then 30 days after closure.
• Agent run logs and analyses: 24 months, then anonymised.
• AI consent record: for the duration of the relationship, then 30 days after closure.
• Record of e-mails sent to you: 12 months.
• Billing: 10 years (accounting obligations).
• Affiliate programme: for as long as you take part, then 30 days after you leave it or close your account; the payments and commissions concerned are kept with billing data.
• Technical and security logs: 12 months.
• Connector access tokens: until you disconnect that connector or close your account, whichever comes first — deleted immediately in either case, not after a delay.
• AI application connections: until you disconnect the application or close your account; its tokens are deleted immediately in either case. The record of its calls is kept for 90 days.
• Skills: until you delete them or close your account.
• Sessions: expire within 7 days of their last use.

8. Your rights

You may access your data, rectify it, erase it, request its portability, restrict or object to its processing, and withdraw your consent. In the mobile application, you can withdraw your consent to sending your data to the artificial intelligence services named in section 5 at any time in Settings, under AI data sharing. You can delete your account, and everything listed above with it, from inside the application at any time — Settings, then Delete account. Other requests go to privacy@cubrik.ai and are answered within 30 days. You may lodge a complaint with the data protection authority of your country of residence.

9. Security

Encryption in transit (TLS) and at rest, secret isolation, least-privilege access control, access logging, encrypted backups.

A connector's access token is encrypted with a key of its own before it is written, and that key is itself stored encrypted, apart from the database holding the token. It is never written to a log, never returned by any of our interfaces and never visible in our administration tools. No system is infallible; in the event of a breach affecting your data, we will notify you within the timeframes the law requires.

10. Minors

The Service is not available to anyone under 18, or under the age of majority where they live. We do not knowingly collect data relating to them.

11. Changes

Any material change will be notified by e-mail or in the application.