Who this covers
This policy applies to Metacube Digital's own business: the files and information we handle when we work with a client, including anything sent to us through the upload service at metacube.digital.
It does not cover Pepper, our volleyball app, which has its own policy describing how that product handles player data.
Visitors to this site
We measure how this website is used, so we can tell which pages people read and whether the contact form actually works. This is separate from anything a client sends us.
It sets no cookies and shows no banner, because there is nothing to consent to. Visitors are counted using a hash of the incoming request that resets every 24 hours, so the same person is not recognised from one day to the next, is not followed to any other website, and is not linked to an IP address. We see totals — pages, referrers, countries, browsers — and never an individual.
We also record a small number of events: which pricing option a visitor clicks, and whether a contact form submission succeeded or failed. The failure count exists so a form that quietly stops working does not look the same as nobody writing in. No field you type is ever sent with these events.
This runs on Vercel, already named below as our host, so no additional company receives this data.
The contact form's human check
The contact form is checked by Cloudflare Turnstile, which confirms that a submission is coming from a person rather than an automated script. This is separate from the measurement described above, and unlike that measurement it does involve a company not otherwise named in this policy.
Most visitors never see anything. The check runs quietly in the background, and a checkbox appears only if Cloudflare decides a further test is needed. To reach that decision, Cloudflare receives your network address and technical signals about your browser and device.
What you type does not go to Cloudflare. Cloudflare states that Turnstile processes only the data necessary for this security function, and does not access, store or transmit form entries or other page inputs. Its handling of what it does receive is described in Cloudflare's Turnstile Privacy Addendum.
We do not enable Pre-clearance, the Turnstile feature that places a clearance cookie in your browser.
Your files do not pass through our servers
This is the most important thing to understand about how the upload service works, and it is unusual enough to be worth stating plainly.
When you upload a file, it travels directly from your browser to the storage provider. It does not go through an application server we operate. Our server's only role is to check your access link and issue a short-lived, single-purpose permission to write to one folder. We never receive, inspect, copy or scan the contents of what you send.
What our systems do see is the file's name, its size, and the time it arrived.
Where your files are stored
Uploaded files are held in a private storage bucket located in Montréal, Canada. Private means every read requires authentication — there is no public link to a file, and no URL that can be guessed or shared to reach one.
Region selection is a data-location control, not by itself proof of regulatory compliance. We chose Canada because a good deal of our client work involves Canadian organisations, some handling sensitive personal information, and keeping their material in Canada is the more defensible default.
Files are deleted after 30 days
The upload service is for transferring material to us, not for storing it. A scheduled job deletes uploaded files once they are more than 30 days old, and this runs automatically rather than when someone remembers.
Please keep your own copy of anything you send. We are not a backup, and we cannot recover a file once the retention window has passed.
What we keep about a project
Separately from the files themselves, we keep a small amount of information so we know whose material is whose. This is stored in a database located in Canada.
- Project records: the client organisation's name, a project name, and the date it was created
- Access links: a one-way cryptographic hash of each link we issue, never the link itself, along with its expiry date and whether it has been revoked
- An upload log: the name, size and arrival time of each file, so we can tell you what we received
- For the studio's own administrator account, the email address of the Google account used to sign in
Access links
We give you a link containing a long random access code. Anyone holding that link can upload to your project's folder, so treat it like a password rather than a URL — it is worth sending it the way you would send a credential, and worth telling us if it ends up somewhere it should not.
Links expire by default, and we can revoke one at any time. We store only a hash of each link, which means that if our database were ever exposed, the links themselves could not be reconstructed from it. It also means we genuinely cannot tell you what an existing link is — we can only issue a new one.
Abuse prevention
When someone submits an invalid access code, we briefly hold their network address in memory to slow down repeated guessing. This is not written to a database, is not connected to any project, and does not persist beyond the running server process.
Who else can touch this data
We use a small number of service providers to run the system. We do not sell personal information, and we do not use client material to train machine learning models.
- Vercel — website hosting, the file storage bucket described above, and the visitor measurement described earlier
- Supabase — the project database and administrator sign-in, hosted in Canada
- Cloudflare — the contact form's human check described above
- Resend — sends us an internal notification email when an upload arrives, and the enquiry itself when someone uses the contact form
- Google — used only to authenticate the studio's own administrator account; no client signs in with Google
How long we keep things
- Uploaded files: deleted automatically after 30 days
- Project records and upload logs: kept for the life of the engagement and a reasonable period afterwards, so we can answer questions about work we did
- Access links: kept as hashes until the project is closed, so a revoked link stays revoked
Your rights
If you are in Canada, provincial and federal privacy law gives you rights to ask what personal information an organisation holds about you, to have inaccurate information corrected, and to ask for it to be deleted. Similar rights exist in many other places.
Write to hello@metacube.digital and we will respond. If the material in question was sent to us by an organisation you work for, we may need to involve them, since it is usually their information rather than ours to release.
Children
The upload service is intended for the people we work with professionally, and is not directed at children. Some of our clients work with children, and material they send us may contain information about them. We treat everything sent to us as confidential regardless, and the client organisation remains responsible for that information under its own privacy obligations.
Changes
We will post updates to this page and change the effective date above. Where a change materially affects how we handle client material, we will tell affected clients directly rather than relying on anyone noticing this page.