Privacy policy

• Retail staff — people at a retailer who sign in to Cube6 to import a catalogue, set promotions, scan products and print tags. The retailer is our customer; you use Cube6 on its behalf.
• Shoppers — anyone who scans a QR code on a printed tag. You never create an account and we do not know who you are.

• Your account. Your work email address and name, held by our sign-in provider, Clerk. We accept work addresses only; personal mailboxes are refused so that an organisation's data stays with the organisation.
• Your role and stores. Which organisation you belong to, which roles it has given you and which of its stores you work at. These decide what you can see and do.
• What you do in Cube6. An audit record of changes that matter — who approved a batch, who removed a print run, who changed a role — with your email address and the time. This exists so an organisation can answer “who printed this price” later.
• Technical logs. Our hosting provider records requests (address, time, page, browser) for a short period to keep the service running and to investigate faults.

We do not ask for, and do not want, anything else about you.

The catalogue, prices, promotions, store list and people list an organisation imports or types into Cube6 are the organisation's data. We hold them only to provide the service to that organisation and act on its instructions. Product data is commercial, not personal; the people list holds the names and work addresses of the organisation's own staff, which the organisation controls and can remove.

A tag's QR code points at a short address on our domain, which redirects to the retailer's own product page. At the moment of the redirect we record:

• the code that was scanned, and so which product and store it belongs to;
• the time;
• the browser's user-agent string, as sent by your phone;
• the country your request came from, as supplied by our hosting provider — not your address or precise location.

We do not set a cookie on your device, do not record your IP address in that log, do not identify you and do not follow you to the retailer's site. The record exists so a retailer can see which tags are scanned, and it is shown to the retailer only as counts. Once you land on the retailer's page, that site's own privacy policy applies.

The application uses cookies only to keep you signed in, set by Clerk, and a few settings stored in your own browser — which columns you resized, for instance — that never leave it. There is no advertising, no analytics tracker and no cookie on the QR redirect.

We use a small number of providers to run the service, each bound by its own data-processing terms:

• Clerk — sign-in and accounts. Holds your email address, name and sign-in sessions.
• Vercel — hosting, and the storage of uploaded files such as feature icons and rendered print files.
• Neon — the database that holds the organisation's catalogue, promotions, print runs and the scan records above.

We do not sell data, share it with advertisers, or give it to anyone else except where the law requires it. Within an organisation, what a person can see is decided by the roles that organisation sets.

Data is stored on the providers above, in the regions they operate. Account data is kept while the account exists. An organisation's catalogue, promotions and print records are kept while the organisation is a customer and removed within ninety days of it leaving, except audit records, which are kept for as long as the law or a dispute requires. Scan records are kept for two years. Hosting logs are kept for a matter of days.

You can ask us what we hold about you, ask us to correct it, or ask us to remove it, by writing to devesh@dosl.in. Retail staff can also ask their organisation's owner, who can remove a person from Cube6 at any time. Under India's Digital Personal Data Protection Act, 2023, you may also complain to the Data Protection Board of India if we do not answer you properly.

Cube6 is a tool for retail staff and is not directed at anyone under eighteen.

When this policy changes, the date at the top changes with it. A change that affects what we collect or why will be told to organisation owners by email before it takes effect.

Two Sixteen, a sole proprietorship, Bengaluru, Karnataka, India. devesh@dosl.in