Privacy Policy
Last updated: October 4, 2026
This policy explains how WEDO4U LTD, trading as QubeHub (“QubeHub”, “we”, “us”), handles personal data. It covers our websites at qubehub.ai and qubehub.io, our sales and marketing activity, and the QubeHub platform.
1. Who we are
WEDO4U LTD is a private limited company registered in the Republic of Cyprus.
- Registration number: HE 435380
- VAT number: CY10435380V
- Registered office: Office 3A, Sardeon 29, Limassol, Cyprus
- Privacy contact: [email protected]
We have not appointed a Data Protection Officer because the law does not require us to. Every privacy question goes to [email protected] and is answered by a director of the company.
2. Two different roles
What happens to your data depends on who you are.
We are the controller for data about:
- visitors to our websites;
- people who contact us, book a demo or ask for pricing;
- business contacts we reach out to;
- our customers’ account holders and billing contacts;
- how users use the platform.
This policy describes that processing in full.
We are a processor for the data our customers put into the QubeHub platform. That includes their leads, buyers, tenants and agents, their unit inventories, and the conversations their AI assistants hold with prospects. For that data, the developer who uses QubeHub decides what is collected and why, and their own privacy notice applies. We process it only on their instructions, under a data processing agreement (qubehub.ai/dpa).
If you are a buyer, tenant, agent or lead of a developer that uses QubeHub, please contact that developer about your data. If you contact us instead, we will pass your request to them.
3. What we collect, why, and on what legal basis
| Who | What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Website visitors | Pages viewed, device and browser data, approximate location from your IP address, referrer, cookie identifiers | Run and secure the site; understand how it is used; measure our marketing | Strictly necessary cookies: legitimate interest. Analytics and marketing: your consent, which you can withdraw at any time (see the Cookie Policy) |
| Visitors from companies | Your company, inferred from your IP address by our website visitor tool | Understand which organisations are interested in QubeHub | Your consent, given through the cookie banner (marketing category) |
| People who contact us or book a demo | Name, work email, company, phone (if you give it), portfolio size, your message, meeting details | Reply to you, run the demo, send you a proposal | Steps you ask us to take before a contract; our legitimate interest in answering business enquiries |
| Business contacts we approach | Name, role, company, work email, work phone, public professional profile | Contact developers and their teams about QubeHub, one business to another | Our legitimate interest in B2B marketing. You can object at any time, and we will stop |
| Customers’ account holders and platform users | Name, work email, phone, role, login and security events, support conversations | Provide the account, secure it, support you | Performance of our contract with your organisation; our legitimate interest in security |
| Billing contacts | Name, email, company details, invoices, payment status. Card data is handled by Stripe; we never see full card numbers | Invoicing, collecting payment, tax records | Contract; legal obligation (tax and accounting law) |
| Platform usage | Features used, clicks and events, device and session identifiers | Keep the platform working, fix problems, improve the product | Our legitimate interest in running and improving the service. We use this data in aggregated form for product improvement, never customers’ Client Data |
We do not intentionally collect special categories of data, such as health, religion or biometric data. We do not knowingly collect data from anyone under 18.
4. Where the data comes from
Most of it comes from you, through forms, email, calls and your use of the platform.
Some comes from:
- cookies and similar technologies (see the Cookie Policy);
- your company, when it sets you up as a user;
- for business contacts, B2B data providers such as Apollo.io and public professional sources such as company websites and LinkedIn.
If we contact you based on such data, our first message says where we got it and how to opt out.
5. AI and your data
- No training. We do not use personal data or customer data to train, fine-tune or improve any artificial intelligence model. We require our AI providers not to do so either.
- Inference only. When a QubeHub feature uses an AI model, the relevant input is sent to the model provider (OpenAI or Anthropic) to produce an answer. That provider may keep it for no more than 30 days, for service delivery and abuse monitoring only, and deletes it sooner where zero-data-retention applies to our account.
- Knowledge bases. Materials a customer uploads to its knowledge base, such as brochures, are stored in a retrieval index so the assistant can answer from them. They stay there until the customer removes them or the subscription ends.
- Decisions about you. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Where a customer uses AI pre-qualification, the customer configures it and reviews the results. That customer is responsible for that processing.
6. Who we share data with
We do not sell personal data. We share it only with:
- Service providers that process data for us. This includes hosting and infrastructure (DigitalOcean, Amazon Web Services, Cloudflare), email and productivity tools (Google), CRM and scheduling (HubSpot), sales tooling (Apollo.io), analytics (Amplitude, Google), payments (Stripe), and AI model providers (OpenAI, Anthropic). Each is bound by a data processing agreement. The providers that process customers’ platform data are listed at qubehub.ai/subprocessors.
- Advertising and review platforms, only with your consent. Meta (Meta Pixel), Google (advertising measurement), LinkedIn (LinkedIn Insight Tag) and Gartner Digital Markets (Capterra) receive data through marketing cookies. See the Cookie Policy.
- Integrations a customer switches on. For example WhatsApp, Telegram, telephony or e-signature providers. That data goes where the customer directs it.
- Professional advisers, auditors, authorities and courts, where the law requires it or where it is needed to establish or defend legal claims.
- A buyer or successor of all or part of our business. They would be bound by this policy.
7. International transfers
Customer platform data is hosted in the EU (DigitalOcean, Germany). Some service providers, including OpenAI, Anthropic, Google, Stripe, HubSpot, Apollo.io, Amplitude and Meta, may process data in the United States or other countries outside the European Economic Area.
When they do, we rely on one of these safeguards:
- an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified;
- the European Commission’s Standard Contractual Clauses.
You can ask us for a copy of the relevant safeguard.
8. How long we keep data
| Data | Retention |
|---|---|
| Enquiries and demo requests that do not become customers | 24 months after our last contact, then deleted or anonymised |
| Business contacts | Until you object, or 24 months without engagement, whichever is sooner |
| Customer account and contract records | For the relationship, then as long as Cyprus tax, accounting and limitation laws require |
| Platform data processed for customers | As set out in the customer’s agreement. By default, 90 days of export access after the subscription ends, then deletion within 60 days, and from backups in the ordinary rotation |
| Platform usage and security logs | Up to 12 months, unless we need them longer to investigate an incident |
| Cookies | As listed in the Cookie Policy |
9. How we protect data
Security measures include:
- a separate database instance for each customer, hosted in the EU;
- encryption in transit and at rest;
- one-time-password sign-in;
- restricted, logged administrative access;
- confidentiality undertakings from our team.
Details are on our Security page. If a personal data breach puts your rights at risk, we will notify the supervisory authority, and you where required, within the time limits set by law.
10. Your rights
Under the GDPR and Cyprus Law 125(I)/2018 you can ask us to:
- give you access to your data;
- correct it;
- delete it;
- restrict its use;
- give it to you in a portable format.
You can also object to processing based on legitimate interest, including direct marketing, and withdraw consent at any time. Withdrawing consent does not affect processing that took place before you withdrew it.
To exercise a right, email [email protected]. We reply within one month, and may need to confirm your identity first. Every marketing email includes an unsubscribe link. Cookie choices can be changed at any time through “Cookie settings” in the site footer, or the cookie icon in the corner on pages without one.
You also have the right to complain to the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy), or to the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
11. Changes
When we change this policy we update the date at the top. If a change materially affects how we use data we already hold, we will tell affected customers and contacts before it takes effect.