Data security
This page covers the handling of data in our custody: where it sits, who else can touch it, how long we keep it and how it leaves. Our privacy policy covers your rights over personal information; this page covers the mechanics.
Data we process and why
| Data | Why we hold it | Source |
|---|---|---|
| Contact details | To correspond about the engagement | You |
| Website and analytics data | To audit and report on performance | Your accounts, via delegated access |
| Ad account data | To manage campaigns and report cost per lead | Your accounts, via delegated access |
| Audit results | The deliverable itself and your baseline | Produced by us |
| Form submissions | To respond to an enquiry | This website |
Subprocessors
A subprocessor is a third party that processes data on our behalf. The ones inherent to how this site and our service operate:
| Provider | Purpose | Data involved |
|---|---|---|
| Web3Forms | Delivers contact form submissions to our inbox | Everything you type into the form |
| Our website host | Serves this site | Standard server request logs, including IP address |
| Google Analytics (Google LLC) | Measures how this website is used, where visitors allow it | Pages viewed, referrer, device and browser details, approximate location. No IP addresses are stored. See the cookie section of the privacy policy |
| Google and Meta | The ad and analytics platforms we manage for you | Held in your accounts, not ours |
This list is not yet complete. The email and document storage providers our team uses day to day must be added before this page is published. We would rather show an unfinished list than a reassuring one that omits a processor.
The contact form specifically
Submissions from this site are transmitted over HTTPS to Web3Forms, which forwards them to our inbox. That means your submission passes through a third party before it reaches us.
Please do not send passwords, card details or anything confidential through this form. If you need to send something sensitive, email us and we will arrange a secure method.
Retention
Our working position, pending confirmation of the exact periods:
- Enquiries that do not become clients: deleted when they are clearly not proceeding.
- Client records: kept for the engagement and a defined period afterwards, for tax and contractual reasons.
- Audit reports and baselines: kept while you are a client so trends remain readable.
You can ask us to delete what we hold at any time, subject to anything we are legally required to retain. Email contact@cubicgrowth.com.
When an engagement ends
- You revoke our delegated access, or ask us to remove ourselves. Either works.
- Everything built inside your accounts stays in your accounts, including history.
- Content and reports we produced are yours outright, including work in progress.
- We delete our working copies on request.
There is no exit fee and no step in this process requires our cooperation to complete. That is deliberate.
Data location
We operate in the United States. Some subprocessors above may process data outside it. The specific locations must be confirmed and listed here before this page is published, particularly if you have clients or staff in regions with transfer restrictions.
Breach notification
If we become aware of a breach affecting your data, we will tell you without undue delay, describe what we know and say what we are doing about it. We will not wait until the picture is complete before telling you something happened.
Data processing agreements
If your procurement process requires a signed DPA, ask. We will tell you plainly whether we can sign yours rather than leaving it ambiguous.