Privacy Policy

1. Identity of the controller

The controller of the personal data is SOFTWARECUBO (hereinafter, “SOFTWARECUBO”, “we” or the “Controller”), a commercial brand operated in Mexico that provides the software-as-a-service (SaaS) product CuboPOS, a cloud point-of-sale system.

Any matter related to personal data may be addressed to hola@softwarecubo.com, the sole official contact channel for data subjects.

2. Personal data we collect

To operate the service, SOFTWARECUBO collects the following categories of personal data:

Account data: full name, email address, password (stored as a bcrypt hash and unreadable by us), authentication tokens, and usage logs (session records, IP address, browser and device).

Business tax data: legal name, RFC (Mexican tax ID), tax regime, postal code and fiscal address of the Client, as well as the Digital Seal Certificate (CSD) issued by the SAT, which is stored encrypted and used solely to issue CFDI e-invoices.

End-customer data: when the Client registers its own customers in CuboPOS, SOFTWARECUBO acts as Processor; the Client is the Controller vis-à-vis those third parties.

Payment data: SOFTWARECUBO does not store card data. Subscription billing is processed directly by Stripe, Inc.; SOFTWARECUBO only receives opaque identifiers and invoice metadata.

SOFTWARECUBO does not collect sensitive personal data (LFPDPPP, art. 9).

3. Purposes of processing

Primary purposes (necessary to deliver the service): create and manage the data subject's account; authenticate and authorize access; process subscription billing through Stripe; issue CFDI 4.0 invoices through FacturAPI; store the catalog, customers, inventory and transactions of the business; send transactional and operational emails (account verification, receipts, payment reminders, technical and security notifications) through a specialized email-sending provider; comply with applicable tax obligations; and protect the security of the service.

Secondary purposes (optional): sending promotional communications about new features or plans, satisfaction surveys and anonymized statistical analysis for product improvement. The data subject may object to any secondary purpose at any time without affecting the provision of the service, by writing to hola@softwarecubo.com or using the preferences panel inside the application.

4. Data transfers and processors

SOFTWARECUBO transfers personal data only to the following processors and only to the extent strictly necessary to operate the service:

Infrastructure and storage provider: hosting of the application, databases and encrypted backups.

Email-sending provider: delivery of transactional email (verification, receipts, reminders, technical alerts) and, where applicable, opt-in communications for which the data subject has provided consent, including processing of bounces and complaints.

Stripe, Inc.: subscription payment processing.

FacturAPI México: CFDI 4.0 issuance before the SAT.

Sentry (Functional Software, Inc.): monitoring of technical errors in the service.

WebArtisans (webartisans.com.mx): operator of the live support chat service, when used by the data subject.

Cloudflare Turnstile: bot protection on the sign-up form.

All processors are bound by contractual clauses requiring them to maintain confidentiality and to handle personal data only on SOFTWARECUBO's instructions. SOFTWARECUBO does not sell, rent or trade personal data for purposes other than those described herein.

5. ARCO rights and withdrawal of consent

As the data subject, the user is entitled to access, rectify, cancel or object to the processing of personal data (ARCO rights), as well as to limit their use or disclosure and to withdraw any consent granted.

To exercise these rights, send a request to hola@softwarecubo.com indicating: (i) full name and registered email; (ii) a clear description of the right being exercised; (iii) a copy of an official identification document; and (iv) the means to receive a response. SOFTWARECUBO will respond within twenty (20) business days from receipt, as required by article 32 of the LFPDPPP. Cancellations will be executed within thirty (30) days, except for data that Mexican tax law requires to be retained (for example, issued CFDI must be kept for five years, art. 30 of the Federal Tax Code).

6. Cookies and similar technologies

The website and the application use only strictly necessary cookies (session, CSRF, language and theme preference). No advertising or cross-site tracking cookies are used. Authentication tokens are stored in the user's browser localStorage and are not transmitted to third parties.

7. Security measures

SOFTWARECUBO implements reasonable technical and organizational measures to protect personal data: TLS 1.2+ encryption in transit; AES-256 encryption at rest for sensitive data (SAT digital seals, FacturAPI API keys); bcrypt-hashed passwords; multi-factor authentication available; strict multi-tenant isolation between businesses; encrypted backups with staggered retention; and continuous security monitoring. In the event of an incident that compromises personal data, SOFTWARECUBO will notify the data subject and, where applicable, the competent authorities under article 20 of the LFPDPPP.

8. Email-sending policy

SOFTWARECUBO operates its email program in line with industry best practices designed to protect recipients and preserve the platform's reputation. The messages we send are limited to: (i) transactional emails necessary to operate the service (account verification, receipts, payment reminders, technical alerts, password resets, security notices and legal notifications) and (ii) optional communications for which the data subject has provided explicit consent.

Consent and opt-in: transactional emails are sent exclusively to users who created a CuboPOS account and accepted this Policy. Optional emails are sent only to recipients who have given explicit consent at sign-up or from the in-app preferences panel. SOFTWARECUBO does not purchase or rent contact lists.

Unsubscribe (opt-out): every optional communication includes a one-click unsubscribe link in the footer and a List-Unsubscribe header consistent with current best practices (RFC 2369 and RFC 8058). The data subject may also request removal at any time by writing to hola@softwarecubo.com; requests are processed immediately.

Bounce and complaint handling: SOFTWARECUBO automatically processes bounce and complaint (spam report) events reported by the email-sending provider. Affected recipients are automatically suppressed from all sending lists and do not receive further communications unless verifiably reinstated by the data subject.

List hygiene and reputation: SOFTWARECUBO authenticates every message with SPF, DKIM and DMARC aligned to the sending domain, continuously monitors bounce and complaint rates, removes inactive addresses and prioritizes content quality over volume.

Anti-abuse policy: SOFTWARECUBO does not send unsolicited email (spam) and does not allow Clients to use the platform or any of its sending providers to deliver unsolicited bulk communications. Any abuse detected results in immediate suspension of the account involved, without prejudice to applicable legal action.

9. Changes to this Policy

SOFTWARECUBO reserves the right to update this Policy. Any material change will be notified to the data subject by email at least fifteen (15) days before its effective date. The current version is always available at https://www.softwarecubo.com/en/legal/privacy.

10. Supervisory authority

If the data subject considers that SOFTWARECUBO has not addressed their request properly or that their right to the protection of personal data has been violated, a complaint may be filed with Mexico's National Institute for Transparency, Access to Information and Personal Data Protection (INAI), https://www.inai.org.mx.