Privacy Policy

This Privacy Policy explains how vaicat B.V. ("vaicat", "we", "us", "our") collects, uses, stores, and protects your personal data when you use the CUEBES platform ("Platform", "Service"). We are committed to safeguarding your privacy in compliance with the General Data Protection Regulation (GDPR), the Dutch Implementation Act (UAVG), and other applicable data protection legislation.

1. Introduction

CUEBES is a developer-focused platform providing code hosting (Codicles), social features (CUES, Cubes), video hosting (Wave), academic research tools, messaging, and integrated applications (EUnify, mEUvy, EUorigin). This Privacy Policy covers all data processing activities across these features.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

2. Data Controller

The data controller for your personal data is:

• vaicat B.V.
• Noordeinde 99B, 2514 GD The Hague, Netherlands
• KvK (Dutch Trade Register): 89360672
• Email: privacy@vaicat.com

vaicat B.V. determines the purposes and means of processing personal data on the Platform and is responsible for ensuring compliance with applicable data protection laws.

3. Data We Collect

3.1 Data You Provide

• Account data: Name, email address, username, profile photo, bio, and other profile information you choose to add.
• Authentication data: Apple sign-in tokens (if you use Apple to sign in), two-factor authentication configuration, and third-party connection tokens you explicitly authorize for a feature such as Google YouTube channel access.
• Content: Code repositories (Codicles), discussions (CUES), comments, Gists, videos, research publications, datasets, and any other content you upload or create.
• Communications: Messages sent through the Platform (E2EE-encrypted content is not accessible to us; see Section 11).
• Research profile: Academic affiliations, ORCID iD, research interests, publications, and citations.
• Professional profile: Company associations, job history, skills, Talent Bank profile data.
• Settings & preferences: Notification preferences, appearance settings, privacy settings, connected accounts.

3.2 Data Collected Automatically

• Connection and security data: IP address, user agent, and timestamps may appear in access, authentication, and security records when needed to operate and protect the Service. These necessary records are not reused as product-analytics identifiers.
• Feature records: We store actions that must persist to provide a feature you use, such as content you publish, saved preferences, account changes, and moderation or security events. These are necessary service records, not optional product analytics.
• Git operations: Clone, push, and pull metadata (timestamps, IP addresses, repository accessed) for access logs.
• Optional product analytics: Currently disabled. We do not collect product-analytics page views, feature-use events, referral URLs, or search-query telemetry.
• Performance telemetry: The former production request-timing baseline collector has been removed. Operational error and security records remain separate necessary service records.

3.3 Data from Third Parties

• Apple sign-in: When you sign in with Apple, we receive the account details Apple shares as authorized by you.
• Connected services: When you explicitly connect a third-party service, such as Google for YouTube channel access, we receive only the account and authorization data needed for that connection.
• ORCID: When you connect your ORCID iD, we receive your verified researcher identifier and the public data you have authorized us to access.
• SAML/SSO providers: If your organization uses SAML-based single sign-on, we receive identity attributes as configured by your organization's identity provider.

4. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery: To create and maintain your account, authenticate your identity, and provide Platform features.
• Content hosting: To store, display, and serve your repositories, publications, videos, and other content.
• Communication: To send you transactional emails (account verification, security alerts, password resets), and optional notifications about Platform activity.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues. This includes rate limiting, access logging, and automated threat detection.
• Optional product measurement: Currently disabled. Any future measurement for product improvement requires a new explicit choice, an anonymous aggregate-at-write design, and an updated notice before collection begins.
• Legal compliance: To comply with applicable laws, regulations, and legal processes, including the EU Digital Services Act.
• Content moderation: To review reported content and enforce our Terms of Service, in compliance with the DSA.

4.1 Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects (GDPR Article 22), and we do not profile you for advertising. Some features use automated processing only to assist people or to keep the service safe:

• Ranking, matching, and recommendations (search results, recruiter candidate matching, content suggestions) order or surface information. They are decision-support only — a human makes any consequential decision. Recruiter candidate matching runs only over profiles their owners have explicitly opted into the Talent Bank.
• Security, spam, fraud, and abuse detection may flag activity automatically to protect the Platform (legitimate interest); a human reviews any enforcement that materially affects you, and you can appeal it (see our Moderation Policy).

You can request human review of, or object to, automated processing that affects you at privacy@vaicat.com.

5. Legal Bases for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

6. Cookies & Tracking Technologies

We use cookies and similar technologies to operate the Platform. For detailed information about the cookies we use, please see our Cookie Policy.

The analytics preference is fixed to off. An older cookie that said analytics was enabled cannot reactivate collection.

6.1 Essential Cookies

These cookies are strictly necessary for the Platform to function and cannot be disabled:

• cuebes_token: Authentication token that identifies your session. HttpOnly, Secure, SameSite=Lax.
• cuebes_refresh: Refresh token used to renew your authentication. HttpOnly, Secure, SameSite=Lax.
• XSRF-TOKEN: Cross-site request forgery protection token.
• cuebes-session: Laravel session identifier used for CSRF validation and flash messages. HttpOnly, Secure, SameSite=Lax.

6.2 Functional Cookies

These cookies remember your preferences:

• cuebes_theme: Your selected appearance theme (dark/light/system).
• cuebes_locale: Your language preference.

6.3 No Third-Party Tracking

CUEBES does not use third-party analytics cookies, advertising trackers, or social media tracking pixels. We do not sell your data to advertisers or data brokers.

7. Data Sharing & Third Parties

We do not sell your personal data. We share data only in the following limited circumstances:

7.1 Service Providers

We engage trusted service providers to help operate the Platform, including:

• Cloud hosting and infrastructure (EU-based data centers)
• Cloud object storage for media files (EU-based)
• Email delivery services (transactional emails only)

All service providers are bound by data processing agreements (DPAs) that comply with GDPR requirements.

7.2 Legal Requirements

We may disclose personal data when required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. For E2EE content, we can only provide metadata — the exception being the content of a specific message a participant has reported to us, which their own device submitted (see Sections 11 and 16).

7.3 Public Content

Content you make public (public Codicles, public profiles, public CUES, public Gists, public Wave videos, public research profiles) is accessible to anyone, including search engines and other services that may index public web content.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to the applicable privacy policy.

8. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate safeguards are in place:

• EU adequacy decisions: Transfers to countries recognized by the European Commission as providing adequate data protection.
• Standard Contractual Clauses (SCCs): Where no adequacy decision exists, we use the European Commission's Standard Contractual Clauses (2021/914) supplemented by additional safeguards where necessary.
• Data Protection Impact Assessments: We conduct transfer impact assessments for data transferred to countries without adequacy decisions.

9. Data Retention

We retain your personal data only as long as necessary for the purposes described in this Policy. Specific retention periods:

After the retention period expires, data is securely deleted or anonymized. Legal requirements may require us to retain certain data for longer periods.

When you delete content or your account, we remove it from the Platform within a reasonable time. Two limits apply, consistent with our Terms: rolling backups may retain a copy for up to 30 days before they cycle out, and public content that other users have forked or referenced may persist in those users' own copies. We do not control copies others have made of content you chose to make public.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database backups are encrypted.
• Access controls: Role-based access controls, principle of least privilege, and multi-factor authentication for administrative access.
• Infrastructure security: Firewalls, intrusion detection, regular security audits, and vulnerability assessments.
• Incident response: We maintain an incident response plan and will notify affected users and supervisory authorities of personal data breaches within 72 hours as required by Article 33 GDPR.

10.1 Platform Support moderation visibility

CUEBES operates a platform-wide @Support account staffed by trusted personnel. To meet our legal obligations under the EU Digital Services Act, GDPR, and Dutch criminal law (and to keep the platform safe in cases where a cube's own moderators are unavailable, compromised, or themselves the source of harm), @Support has fail-safe moderation visibility into every Cube on the platform — public, private, and secret. This means:

• What @Support can see: CUEs (posts) and comments inside any Cube; group-chat messages within Cubes (which are not E2EE — see Section 16); cube moderation logs and member lists.
• What @Support cannot see: The plaintext of end-to-end-encrypted direct messages (other than a specific message you choose to report, which your own device submits — Section 11.2), or any other data we have explicitly designed to be cryptographically inaccessible to us (Section 11). The encryption keys for those live only on your device.
• What @Support can do: Remove or lock harmful CUEs; mute, ban, or kick members violating our policies; raise issues to a Cube's own moderators. They cannot change a Cube's settings, transfer ownership, or delete a Cube — those remain admin-level cube actions.
• Transparency: @Support appears in the member list of every Cube with a Platform Support badge so you know they are present. Every action @Support takes is recorded in both the platform admin audit log and the Cube's own moderation log, and is included in the data export available under Section 12.
• Last-resort posture: @Support's role is fail-safe, not first-line. Day-to-day moderation is owned by each Cube's elected moderators; @Support intervenes only when policy or law requires it.

11. Encryption & End-to-End Encryption

11.1 E2EE Messaging

Direct messages on CUEBES are end-to-end encrypted using a Signal Protocol-inspired implementation. The encryption works as follows:

• Key exchange uses X25519 (Curve25519 Diffie-Hellman).
• Messages are encrypted with XChaCha20-Poly1305.
• Encryption keys are generated and stored on your device.
• We store only encrypted ciphertext on our servers; we cannot decrypt your messages.

11.2 Data We Cannot Access

For E2EE content, we can only process and disclose metadata (sender/recipient identifiers, timestamps, message sizes). The content itself is cryptographically inaccessible to us. The only way the content of an E2EE message reaches us is if a participant reports it: in that case the reporting user's own device submits that message's content to our moderation team. We still do not hold the keys and never decrypt messages ourselves.

12. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you. You can export your data at any time from Settings > Data Export.
• Right to rectification (Art. 16): You may correct inaccurate personal data through your profile settings or by contacting us.
• Right to erasure (Art. 17): You may request deletion of your personal data by deleting your account via Settings. We will process the deletion within 30 days, subject to legal retention obligations.
• Right to restriction (Art. 18): You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format. Our data export feature provides this.
• Right to object (Art. 21): You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

To exercise any of these rights, contact us at privacy@vaicat.com or use the self-service tools available in your Settings. We will respond to requests within 30 days.

Requests without an account

If we hold personal data about you but you don't have a CUEBES account, you can still exercise your rights through our public privacy request portal at /privacy-request. To protect your data we verify every request before acting on it:

• Email confirmation — every request starts by confirming control of the email address.
• Identity verification — depending on the request, we confirm identity by signing in to a matching account, by a set of knowledge questions, or by manual review by our compliance team. Higher-risk requests (such as erasure) always go to manual review.
• Response within 30 days of a verified request, as required by GDPR Art. 12(3). Access and portability requests are answered with a secure, time-limited download link.

You can check the status of a request at /privacy-request/status using your reference number and email, and you can withdraw a pending request at any time using the link in the confirmation email.

13. Codicles & Code Data

When you use Codicles (Git repositories), we process:

• Repository content: Source code, files, commit history, branches, and tags you push to the Platform.
• Git metadata: Author name and email embedded in commits (as configured in your Git client).
• Access logs: Clone, push, and pull operations including timestamps and IP addresses.
• Collaborator data: Users you invite and their permission levels.

14. Research Platform Data

When you use CUEBES Research, we additionally process:

• Research profile: Academic affiliations, research interests, ORCID iD, h-index.
• Publications: Papers, preprints, and other research outputs you upload, including metadata (title, abstract, authors, DOI).
• Datasets: Research data files and their associated metadata and licensing information.
• Peer reviews: Reviews you submit or receive, including reviewer identity (for open peer review).
• Analytics: View counts, download counts, and citation metrics for your publications.

Public research profiles and publications are accessible to all users. You may control the visibility of your research content through your privacy settings.

15. Wave Video Data

When you use Wave, we process:

• Video content: Uploaded video files, thumbnails, and transcoded versions.
• Video metadata: Title, description, tags, visibility settings, upload date.
• Viewing data: View counts, watch time, and engagement metrics (aggregated).
• Creator data: Creator application details, channel information, analytics dashboard data.

We may transcode your videos into multiple formats and resolutions for optimized playback. Original uploads are retained.

16. Messaging Data

16.1 E2EE Direct Messages

For end-to-end encrypted direct messages:

• We store: Encrypted ciphertext, sender/recipient IDs, timestamps, public key material.
• We cannot access: Plaintext message content, attached files (encrypted client-side).
• You control: Your private encryption keys, stored in your browser. We recommend backing up your keys.

16.2 Group Chat Messages

Group chat messages within Cubes are stored server-side and are accessible to all members of the respective Cube or chat channel. Group chats are not end-to-end encrypted.

17. Integrated Apps (EUnify, mEUvy, EUorigin)

When you use integrated apps within CUEBES:

• EUnify: We store your saved items, preferences, quiz results, and engagement history. Content is sourced from public EU institutional data. Additional sub-sections below cover the EUnify community features (institution cubes).
• mEUvy: We store your saved places, relocation/reference preferences, and source preferences. Where mEUvy surfaces news, we do not share your reading activity with third-party publishers; news/article aggregation is covered in section 17.3. Where mEUvy surfaces jobs or recruitment features, the adult-only recruitment rules in section 19 and the Recruiter & Talent Bank Terms apply.
• EUorigin: We store your product scans and lookup history. Product data is sourced from public databases.

App data is included in your data export and is deleted when you delete your CUEBES account.

17.1 EUnify school-email verification

If you choose to join an institution's community cube on CUEBES (e.g. Aalto University, KU Leuven, TU Munich), we ask you to verify a school-affiliated email address that matches the institution's approved domain list. This is an opt-in feature; you can use the rest of CUEBES without ever providing a school email.

• What we collect: the school email address you submit, the institution it maps to, your declared role (student / alumni / faculty / staff), and timestamps for the verification, last confirmation, and (after acceptance) cube join.
• How we store it: the email address is encrypted at rest using authenticated symmetric encryption (XChaCha20-Poly1305 with a per-row nonce) before it touches the database. We also keep a SHA-256 hash of the lowercased address for collision detection. We never log school emails to disk in plaintext.
• Who sees it: only you and a small number of CUEBES platform admins acting on a documented support request. Cube moderators and other members do not see your school email — they only see that your institution affiliation is verified, the role you declared, and (if you provided one) your introduction post.
• Legal basis: consent under GDPR Article 6(1)(a). You can withdraw consent at any time by revoking the affiliation (your school email is deleted within 24 hours and your cube membership demoted), and the lawfulness of prior processing is unaffected.
• Reverification cycle: by default, your institution affiliation is valid for 12 months; some institution cubes may set a different cadence (3, 6, or 24 months — visible to you when you join). 30, 7, and 1 day before expiry we email you a renewal link; if you don't renew within a 30-day grace period your role in the cube is silently restricted, and after the grace window expires the verification record is deleted along with your school email. You can renew or revoke at any time from Settings → Affiliations.
• Right to revoke: visit Settings → Affiliations and click "Revoke" next to any affiliation. The revoke is immediate and audited; the school email is deleted within 24 hours. You will lose verified-member status in the corresponding cube but your existing CUEs and comments remain unless you also delete them.

17.2 Auto-syndicated content in institution cubes

Some institution cubes contain content that is auto-syndicated from the institution's own public channels — for example, a university's official news RSS feed, its Mastodon account, or its Bluesky account. These appear in the cube as posts authored by dedicated bot accounts (marked with a 🤖 indicator and a 📡 source chip on every auto-post).

• Sources: only public RSS / Atom feeds, public Mastodon timelines, and public Bluesky author feeds that the institution itself publishes. We do not ingest content that requires authentication, scrape behind paywalls, or aggregate hashtag/mention timelines about an institution.
• What we store: for each auto-syndicated post, the title, body excerpt, a link back to the original, the publish timestamp, and a one-time external identifier used purely for de-duplication. We do not store profile data of users who appear in those posts (e.g. people quoted in a press release).
• Legal basis: the content is published on the institution's official channels for public consumption; we re-display it with attribution and a link to the original. We rely on legitimate interests under GDPR Article 6(1)(f) — letting institution communities surface official news without anyone having to manually copy-paste — and we honour any source-side robots / removal signals.
• Your controls: visit Settings → Privacy → "Hide auto-syndicated posts everywhere" to suppress all bot CUEs across every cube you visit; the toggle takes effect on next page load and is reversible. Per-cube, the cube-show filter chips also let you switch to a "Members only" view for that cube only. Each cube's moderators can also mute a specific bot from posting to their cube; the moderation log records every such action.
• Source removal: if you are an institution that wants its content removed from the auto-content pipeline, email privacy@vaicat.com. We will disable the relevant bot account within 5 working days.

17.3 News & article aggregation (people named in articles)

Some CUEBES features aggregate and index news and articles from third-party publishers so users can discover and follow coverage. We ingest these via the publishers' own RSS / syndication feeds — their chosen public distribution channel — and link back to the original source. Where an article names or describes an individual, that person's personal data is processed by us as part of indexing the article.

Legal basis: legitimate interests (GDPR Article 6(1)(f)) — providing access to publicly published news and supporting freedom of information — read together with the protections for processing for journalistic and information purposes (GDPR Article 85 and Dutch implementing law). We do not enrich or build profiles of the individuals mentioned, and we do not present third-party article content as our own.

Transparency (Article 14) and your rights: this section is our Article 14 notice. If you are named in an aggregated article and want it delisted from CUEBES, or want to object to or restrict our processing, email privacy@vaicat.com. We assess each request, balancing your rights against the public interest in the information, and act without undue delay. Removal from CUEBES does not affect the original publisher.

Retention: aggregated items are kept while they remain available from the source and of ongoing relevance, refreshed from the feed, and removed when the source withdraws them or on a valid request.

18. Political & Public-Official Data (Politics module)

The CUEBES Politics module provides reference information about public officials and elected representatives — for example their names, roles, party affiliation, parliamentary activity, votes, and public statements. Because party affiliation and political positions can reveal political opinions, this is "special category" data under GDPR Article 9, so we describe it separately here.

Source

This information is drawn from official, publicly accessible institutional sources — primarily open-data APIs and registers published by EU and national parliamentary or government institutions (and datasets derived from them). It concerns individuals acting in a public, official capacity; we do not build political profiles of private individuals.

Legal basis

Special-category data requires two cumulative bases:

• Article 6(1)(f) — legitimate interests: the public interest in transparency about public officials and in an informed electorate.
• Article 9(2)(e) — to the extent the political opinions concerned have been manifestly made public by the officials themselves (their own public statements, declared party membership, and public votes). For official-record data where that test is not clearly met, we rely on a substantial-public-interest basis (Article 9(2)(g)) only where EU or Dutch (UAVG) law provides one — to be confirmed with counsel.

Safeguards and transparency (Article 14)

We index only what these official sources already publish; we do not infer political opinions, combine sources to enrich a person's profile, or use this data for advertising or automated decisions about individuals. Because this information is not collected from you directly, this section serves as our Article 14 notice to the public officials concerned, who keep all the GDPR rights in section 12 — including the right to object and to request rectification or erasure — by emailing privacy@vaicat.com.

Retention

Entries are kept while they remain accurate and of public-interest relevance, refreshed from the official source, and corrected or removed on a valid request or when the source no longer publishes them.

19. Minors

CUEBES is intended for users aged 18 and over; the one exception is mEUvy, and other CUEBES apps used without a CUEBES account, which may be used from age 16 (Terms of Service, section 3). We do not knowingly collect personal data from anyone under 18 through accounts, or from anyone under 16 through those apps, and we take active steps to avoid doing so (the limited exception is information that public sources themselves publish — see the politics & news point below). If we become aware that we have inadvertently collected a minor's personal data, we delete it promptly. If you believe a minor has provided us with personal data, contact privacy@vaicat.com.

Our role is to map and surface publicly available European reference information for adults making life decisions — studying, working, or moving within Europe. Concretely:

• Education: we provide reference information about institutions to inform prospective adult (18+) students. We do not process applications, nor any personal data of minor applicants, and we do not offer application services to minors.
• Jobs & recruitment: our recruitment features are for adults only; we do not process candidate data of minors.
• Politics & news: we index public information about public officials and publicly published articles. Where an official source or article itself mentions a minor, that is the source's own published content — we do not target minors or build data about them, and removal can be requested (sections 17 and 19).

CUEBES is designed for adults, and we do not knowingly build advertising profiles for minors or serve targeted ads to minors. For higher-risk account features such as direct messaging, group interaction, and video uploads, we may require proportionate age-assurance or feature-gating measures. Any age-assurance method must be limited to what is necessary for the feature, avoid storing full identity documents or exact dates of birth where a yes/no 18+ signal is enough, and include a way to challenge an incorrect result.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will:

• Post the updated Privacy Policy on the Platform with a revised "Last updated" date.
• Where required by law, obtain your consent before implementing material changes to how we process your data.

How a changed Privacy Policy reaches you depends on whether you have an account:

• Without an account, in mEUvy: a changed Privacy Policy reaches you only through an update of the app. The updated app shows it before anything else, and it stays closed on your device until you accept it. What you downloaded stays on your device, and you can delete it there.
• With an account: the same applies when you use mEUvy, and we also email you in advance, at least 30 days before material changes take effect.

21. Contact

For any privacy-related questions, requests, or complaints:

• Privacy inquiries: privacy@vaicat.com
• Postal address: vaicat B.V., Noordeinde 99B, 2514 GD The Hague, Netherlands
• KvK (Dutch Trade Register): 89360672
• Help Center: cuebes.eu/help

Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You may also contact your local data protection authority if you are located in another EU/EEA member state.