Privacy policy

Last updated: 23 March 2025

1. Data controller

The controller of your personal data is CUBEWEB (“Cubecast” brand). For privacy enquiries: support@cubecast.fr.

2. Data we process

• User account: email address, password (never stored in plain text; stored using a strong one-way derivation), account settings (including display language preferences).
• Podcast content: metadata (title, description, artwork, RSS settings), audio files and related assets we host for distribution.
• Listen analytics: when someone uses a listen URL, we record aggregated technical data: hashed IP address and browser fingerprint (hash), country or region inferred from the IP using locally hosted geo databases, device type, player and OS family derived from the user agent. We do not store raw IP addresses in these listen logs.
• Collaboration: email addresses used for team invitations and access management.
• Payments: if you subscribe to a paid plan, Stripe processes payment data. We do not store full card numbers on our servers.
• Technical logs: limited security and operational logs (e.g. abuse prevention) kept for a short time.

3. Purposes and legal bases

• Contract (GDPR Art. 6(1)(b)): provide podcast hosting, the admin panel, RSS feeds and analytics included in your plan.
• Legitimate interests (GDPR Art. 6(1)(f)): secure the service, prevent fraud, measure audience in aggregate, improve reliability and performance.
• Legal obligation (GDPR Art. 6(1)(c)): accounting and tax requirements where applicable, using data from our payment provider.
• Consent where required by law (e.g. certain non-essential cookies) — see our cookie policy.

4. Recipients and processors

Data is processed by Cubecast and, where necessary, by service providers such as:

• hosting for the application and database;
• object storage for podcast audio with Backblaze (B2) in the European Union;
• audio delivery via a CDN — base URL: https://cdn.cubecast.fr;
• Stripe for subscriptions and billing.

Processors act on our instructions and under GDPR-compliant terms (including EU Standard Contractual Clauses where processing occurs outside the EEA).

5. Retention

• Account and content data: for the life of the account and workspaces, then deleted or anonymised after closure, subject to legal requirements. If we enable an inactivity programme, we may email you after a long period without sign-in or API use and delete abandoned accounts after notice; paying workspaces with an active subscription are excluded.
• Detailed listen data: kept up to the history window allowed by your plan, then purged or aggregated.
• Billing records: kept as long as the law requires.

6. International transfers

Where providers are outside the EEA (e.g. Stripe, Inc. in the United States), we rely on GDPR-approved mechanisms such as Standard Contractual Clauses and, where relevant, supplementary measures.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, object to processing on legitimate grounds and, where applicable, data portability. You may withdraw consent at any time without affecting prior lawful processing.

You may lodge a complaint with your supervisory authority. In France: CNIL (cnil.fr).

To exercise your rights: support@cubecast.fr. We may ask for reasonable identity verification.

8. Illegal content and abuse reports

Anyone may report content or behaviour that appears unlawful or contrary to our rules to abuse@cubecast.fr, including where possible the feed or page URL and a short description. We review good-faith reports within a reasonable time, without prejudice to action by authorities or courts. Further detail is in our terms of service.

9. Security

We apply appropriate technical and organisational measures (encryption in transit, access controls, password hashing, least-privilege access, backups). No online service is risk-free; please report suspected vulnerabilities to support@cubecast.fr.

10. Children

The service is intended for users who can enter into a contract. If you believe a child has provided personal data, contact us so we can delete it.

11. Changes

We may update this policy to reflect product or legal changes. The date at the top will change; for material updates we may also notify you via the site or email.

Website: https://cubecast.fr · Cookies · Terms of service · Report abuse