Privacy Policy

The controller of your personal data is VIRTWE di Alessandro Mastrolonardo, a sole proprietorship established in Italy, VAT number (P.IVA) 09492701215. For any privacy question or request, write to [email protected].

• Business: VIRTWE di Alessandro Mastrolonardo (sole proprietorship)
• VAT number (P.IVA): 09492701215
• Country: Italy
• Contact: [email protected]

We collect only what we need to run the Service:

• Account data. Your email address, your name and profile picture if you sign in with a social provider, and the identifiers Clerk (our authentication provider) and that provider assign to you. Clerk holds your password and two-factor settings; we never receive them.
• Technical and security data. The IP address and time of your most recent activity, the browser and device information your requests carry, and records of when you accepted our Terms and changed your marketing choices (time, IP address and browser). We use them to keep the Service secure, prevent fraud and answer payment disputes. An approximate location (country and city) can be derived from an IP address with a database kept on our own servers.
• Game accounts and client settings. The game usernames you add, the sign-in tokens obtained when you link an account through Microsoft’s sign-in page, the server addresses, versions and flows you configure, and any secrets you store for your clients, such as server passwords. Tokens and secrets are encrypted with AES-256-GCM before they are stored and are never shown back or written to logs.
• Dedicated IP data. The dedicated IPs you add (address, port, username and password) and, if you connect one, the API key of your dedicated IP provider. Passwords and keys are encrypted with AES-256-GCM.
• Client logs and activity. The console output of your clients, which can include in-game chat and the names of other players your clients meet, records of when each client ran, and counts of flow runs.
• Payment data. Payments are handled by Stripe, PayPal and Google Play. We receive customer and transaction identifiers, the plan or pack bought, amounts, dates and status. We never receive or store full card numbers.
• Credits and Library data. Your credit ledger, purchases, licences, listings, earned credits, likes, reports and disputes, including the messages written in a dispute, and the public handle shown next to flows you publish.
• Referrals. Your referral code and which account invited you.
• Offers. If you open the offer panel, which needs your consent to offer cookies, the offer partner receives your IP address, browser details and a pseudonymous identifier. We receive a record of each completed offer and the credits it paid. We never send partners your email address or anything about your clients.
• Usage statistics. If you allow analytics cookies, Google Analytics receives the pages you visit, how you reached them, your browser and device type, an approximate location and a pseudonymous identifier stored in a cookie. Google Analytics does not store your IP address. We see only aggregated reports, which Google keeps for at most 14 months.
• Notifications. Your notification preferences, web push subscriptions, the device token used for push notifications in the Android app and the Discord or webhook addresses you choose to send alerts to. Webhook addresses are encrypted.
• AI access. The access keys you create (shown to you only once), their name, permissions, daily spend cap and expiry, and a record of the changes made through each key. When you connect an AI assistant, the data it requests on your behalf, such as client state, console lines and flows, is sent to that assistant.
• Communications. The emails you send us and our replies.
• Game server information. When your clients join a server, we record facts about the server itself, such as its address, version, player count and whether it could be joined. These records do not include player names and are not linked to you or your account.

Data about other players. The console of your clients can show the usernames and chat messages of other players on the servers your clients join. We process them only to show you your clients’ console, on the basis of our legitimate interest in providing the Service (Art. 6(1)(f) GDPR), keep them for 7 days with the client logs and use them for nothing else. Because we cannot identify or contact those players, we inform them through this policy (Art. 14(5)(b) GDPR). They can exercise their rights by writing to [email protected].

• To provide the Service you signed up for: your account, your clients, flows, dedicated IPs, sharing, the Library, credits and support (performance of a contract, Art. 6(1)(b) GDPR).
• To take payments, issue invoices and keep accounting records (performance of a contract and legal obligation, Art. 6(1)(b) and (c)).
• To keep the Service secure, prevent fraud and abuse of rewards and referrals, and answer chargebacks and disputes (legitimate interest, Art. 6(1)(f)).
• To establish, exercise or defend legal claims (legitimate interest, Art. 6(1)(f)).
• To send you news about CubeMind as an existing customer, which you can refuse at any time (legitimate interest and Art. 130(4) of the Italian Privacy Code).
• To measure how the site is used with Google Analytics, to send you partner offers by email, to show the offer panel with its cookies and to send push notifications, only with your consent, which you can withdraw at any time (consent, Art. 6(1)(a)).
• To improve the Service using aggregated statistics and game server information that do not identify you (legitimate interest, Art. 6(1)(f)).

The data needed for your account, your clients and your payments is required to provide the Service; without it we cannot open the account or process the purchase. Everything based on consent is optional, and refusing it does not limit the Service.

We do not sell your personal data and do not use it to build advertising profiles.

We send service emails about your account, security, payments and your clients; these are part of the Service. We may also send news about CubeMind, and every such email has an unsubscribe link. Emails with offers from partners are sent only if you opt in, and you can change both choices in Settings at any time.

We share data only as far as each recipient needs it.

Providers that process data on our behalf and on our instructions (processors):

• Clerk (United States): sign-in, sessions and two-factor authentication.
• OVHcloud (European Union): the servers that host the Service and its database.
• Cloudflare (United States): network delivery and protection, and the automated human check shown during sign-up.
• Email delivery (Resend, United States, or an SMTP relay): sending our emails.
• Google (Ireland and United States): Google Analytics and Google Tag Manager for usage statistics on the website, only if you allow analytics cookies, and Firebase Cloud Messaging for push notifications in the Android app.
• Geonix: the provider of the dedicated IPs you can rent. We send it orders, not your personal details.

Recipients that process data for their own purposes, under their own privacy policies (independent controllers):

• Stripe (Ireland and United States): card payments and subscriptions on the website.
• PayPal (Luxembourg): PayPal payments and subscriptions on the website.
• Google Play (Ireland): purchases in the Android app, with Google as the merchant of record.
• Microsoft (Ireland and United States): the sign-in page you use to link a game account. Microsoft issues the tokens that let your clients sign in.
• Geonix, for your own dedicated IPs, if you connect your Geonix account with your key.
• AdGem (United States) and ayeT-Studios (Germany): offer partners shown on the Overview page, only after you allow offer cookies.
• Browser push services (provided by your browser maker, such as Google, Mozilla, Apple or Microsoft): delivering web push notifications, if you turn them on.
• Your AI assistant (for example Anthropic, OpenAI, Google or Cursor), if you connect one with an access key: it receives the data it requests on your behalf, under its own terms and privacy policy.
• Discord and your webhooks: alerts go to the Discord channels and web addresses you set up yourself.
• mc-heads.net: player avatar images in the dashboard are loaded from this service, which sees your IP address when your browser requests them.

Other users see what you choose to show them: your public handle on flows you publish, and the resources you share with them. We may also disclose data to professional advisers bound by confidentiality and to authorities when the law requires it. IP geolocation uses a MaxMind GeoLite database stored on our own servers, so no data is sent to MaxMind.

Some of the providers above are based in, or use sub-processors in, countries outside the European Economic Area, mainly the United States. Those transfers are protected by an adequacy decision such as the EU-US Data Privacy Framework, where the provider is certified, or by the Standard Contractual Clauses approved by the European Commission.

• Account data: for as long as your account exists. When you close your account, it is erased after a 7-day grace period.
• Client logs and client run records: 7 days.
• Flow run statistics: 10 days.
• Payment provider event records: 90 days.
• Withheld console lines of sealed flows: for the earning hold plus the dispute window, then deleted.
• Phone relay devices and their daily usage: 90 days after the device was last seen.
• Push notification tokens: until you sign out, turn notifications off or the token stops working.
• Invoices and accounting records: 10 years, as required by Italian law (Art. 2220 of the Civil Code), even after the rest of your account is erased.
• Consent records: for as long as your account exists, so that we can show what you agreed to and when.

Game server information is not linked to any account and is kept only as long as it is useful for compatibility statistics.

We use HTTPS everywhere, delegate sign-in and two-factor authentication to Clerk (two-factor is required for administrator accounts), encrypt game account tokens, client secrets, dedicated IP passwords, provider keys and webhook addresses with AES-256-GCM, rate-limit the API and restrict every resource to the accounts allowed to see it. No system is perfectly secure; if a breach affects your data, we will tell you and the authority as the law requires.

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, except what we must keep by law, such as invoices;
• restrict how we process your data;
• receive your data in a portable format;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw a consent at any time, without affecting what was done before.

You can export your data or close your account yourself from Account settings → Privacy & data on the web or in the Android app. For anything else, write to [email protected]. We answer within one month.

If you cannot sign in, follow the steps on the account deletion page.

If you think we handle your data unlawfully, you can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

The Service is not meant for children under 14. We do not knowingly collect their data. If you believe a child under 14 has created an account, write to [email protected] and we will delete it.

We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks, such as the safety scan of published flows or the rules that decide which installs count towards rankings, can be reviewed by a person on request.

We use necessary cookies to run the site and optional cookies only with your consent. The details and how to change your choice are in the Cookie Policy.

The Android app runs the same dashboard and the same account as the website, so the data described here is the same. Signing in with Google or Apple opens in the system browser, so CubeMind never sees those credentials. The session token is kept in the device’s encrypted storage. The app carries no advertising, analytics or tracking software and shows no offer panel.

If you turn on push notifications, we store the device token issued by Firebase Cloud Messaging, the platform, the app build and when the device was registered and last seen. Notifications carry the same content you would otherwise get by email or in the app. The token is deleted when you sign out, turn notifications off or it stops working.

Purchases in the app are processed by Google Play Billing, with Google as the merchant of record. We receive a purchase token, an order identifier and the product bought, never your payment details.

If you turn on the optional phone relay, your clients’ connections are routed through your Android device and its network. We store the device identifier, the name you gave it, its platform, how many bytes it relayed each day and when it was last seen. The device’s IP address and the servers your clients connect to pass through the relay but are never written to our database. The servers your clients reach this way see the IP address of your device. The relay carries only the connections of the clients of your own account and is never used for the traffic of other users.

We may update this policy when the Service or the law changes. We publish the new version with its date and tell you about material changes by email or in the app.

For any question about this policy or your data, write to VIRTWE di Alessandro Mastrolonardo at [email protected].

Last updated: 26 October 2026