Cubio Workflow

Privacy Policy

Last updated: 21 October 2026

This policy explains how Cubio AS (Fridtjof Nansens veg 43, 2816 Gjøvik, Norway, org.nr 925 322 504 MVA) processes personal data in Workflow.

Roles

For the content our customers put into Workflow — jobs, answers, photos, their customers' contact details — the customer organisation is the controller and Cubio is the processor. For account and billing administration (who the account's users are, sign-in, subscription) Cubio is the controller.

What we process

  • Users: name, email address, role and organisation; sign-in links and sessions.
  • Devices: paired glasses/phones, a device token and when it was last seen.
  • Work: checklists, jobs, answers, deviations, photos, times, and who carried out each job.
  • Customers of our customers: names, addresses, contact persons, phone numbers, and details given in booking requests (including the contact email address for confirmations).
  • Technical data: IP addresses and request logs, used for security and rate limiting.
  • Billing: plan, number of seats and subscription status. Payment details are handled by Paddle and never reach us.

Why

To provide the service under the agreement with the customer, to send sign-in links and booking confirmations, to keep the service secure, and to administer subscriptions. We do not sell personal data, use it for advertising, or build profiles.

Sub-processors

  • Amazon Web Services (Lightsail), Frankfurt, EU — hosting and database.
  • One.com Group — sending email (sign-in links, booking confirmations).
  • Paddle.com — payment and subscription handling as Merchant of Record; Paddle is controller for the payment data it collects.

The Workflow app on the glasses talks only to our servers; the Even Realities app on the phone hosts it.

Storage and deletion

Data is kept while the account is active, with these exceptions:

  • When a customer closes the account, we delete its data within 30 days.
  • On the Free plan, photos older than 12 months are deleted, and an account that nobody has signed in to or used glasses with for 6 months is deleted with all its data, after warnings by email 30 and 7 days before. This starts 30 days after a trial or paid subscription ends.
  • Sign-ups whose email address is never confirmed are deleted after 7 days.
  • Expired sign-in links, sessions and pairing codes are deleted 30 days after they expire.
  • Backups are kept for 14 days, so deleted data is gone from them 14 days later.
  • Request logs are kept for a short time for operations and security.

Cookies

Workflow uses no tracking or advertising cookies. The sign-in session is kept in your browser's local storage. Paddle's checkout sets its own cookies when it is opened.

Your rights

You can ask for access to, correction or deletion of your personal data, restriction of processing, data portability, or object to processing. If your data is in Workflow as part of a customer's account, we will forward your request to that customer. You can complain to the Norwegian Data Protection Authority (Datatilsynet).

Contact

support@cubio.no · +47 901 50 293