Privacy Policy

1. Who this policy applies to

This policy applies to authorized users of the Service (staff of Rubik and client prop firms), administrators, and any person whose data is processed through the Service in the course of risk, compliance, and operational workflows.

The Service is a business B2B platform. It is not directed at children under 16, and we do not knowingly collect data from children.

2. Information we collect

Depending on how you and your organization use the Service, we may process the following categories of data:

• Account and authentication data: name, email address, organization/role metadata, and session identifiers provided via our identity provider (Clerk).
• Operational business data you or your firm enter into the Service (e.g. customer/trader profiles, accounts, cases, interviews, notes, risk flags, documents metadata).
• Technical data: IP address, browser/device type, timestamps, and security logs necessary to operate and protect the Service.
• Google account data when you explicitly connect Google: email address, profile name, OAuth tokens, and Google Calendar event data required to create, update, list, or cancel interview/calendar events you authorize.

3. Google user data (Calendar & profile)

If you choose to connect Google Calendar, Rubik requests limited OAuth scopes to sync interview-related calendar events and to identify your Google account (email/profile).

We use Google user data only to provide and improve calendar synchronization features you request inside the Service: creating, updating, reading, and canceling calendar events linked to interviews or related scheduling workflows, and associating the connection with your Rubik user account.

We do not sell Google user data. We do not use Google user data for advertising. We do not use Google user data to train generalized AI/ML models. Access is limited to users and systems that need it to operate the connected calendar feature.

Rubik’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

We process personal information to:

• Provide, maintain, and secure the Service for authorized organizations.
• Authenticate users and manage access control.
• Support risk management, compliance reviews, case handling, interviews, and related operational features.
• Sync authorized Google Calendar events when a user connects their Google account.
• Monitor reliability, prevent abuse, and improve product quality.
• Comply with legal obligations and enforce our Terms of Service.

5. Legal bases (where applicable)

Where data protection laws such as the GDPR apply, we rely on one or more of the following bases: performance of a contract with your organization, legitimate interests in operating a secure B2B platform, consent (for optional connections such as Google Calendar), and legal obligations.

6. Sharing of information

We share personal information only as needed to run the Service:

• Service providers acting on our instructions (e.g. hosting, database, authentication, observability), under appropriate confidentiality and security obligations.
• Your organization administrators and authorized colleagues according to roles configured in the Service.
• Authorities when required by law or to protect rights, safety, and security.
• Google, when you authorize Google OAuth / Calendar API access, subject to Google’s terms and policies.

7. International transfers

We may process data in countries other than your own, including where our infrastructure or subprocessors operate. Where required, we use appropriate safeguards (such as contractual protections) for international transfers.

8. Retention

We retain personal information for as long as necessary to provide the Service, fulfill contractual obligations to client firms, resolve disputes, and meet legal or audit requirements. Google OAuth tokens and calendar linkage data are retained while the Google connection remains active and deleted or revoked when you disconnect or when retention is no longer needed for the feature or legal compliance.

9. Security

We implement technical and organizational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, secret management for OAuth credentials, and least-privilege access to production systems. No method of transmission or storage is completely secure; we continuously improve controls as the Service evolves.

10. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, or export personal data, and to object to certain processing. You may also withdraw consent for optional integrations (for example by disconnecting Google Calendar).

To exercise rights, contact us at the details below. If you use the Service through an employer or client firm, we may redirect your request to that organization as the primary controller of workspace data.

You can revoke Google access at any time in your Google Account permissions (https://myaccount.google.com/permissions) and/or from within the Service when disconnect is available.

11. Cookies and similar technologies

We use essential cookies and similar storage required for authentication, session continuity, security, and locale/preferences. We do not use third-party advertising cookies on the Service.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be communicated through the Service or other reasonable means when appropriate.

13. Contact

Controller: Rubik Prop Firm Consulting

Address: HaGavish 4, Netanya, Israel

Website: https://www.rubikpropfirm.com

App: https://app.rubikpropfirm.com

Privacy contact: privacy@rubikpropfirm.com