This Data Processing Addendum ("DPA") forms part of the agreement between CubHub, LLC. ("CubHub," "Processor") and the childcare center or organization using CubHub (the "Center," "Controller"). It governs the processing of Personal Data that CubHub performs on behalf of the Center in connection with the CubHub Service.
1. Roles of the parties
The Center is the data controller of information about children, families, and staff. CubHub acts as the data processor, processing Personal Data solely on the Center's documented instructions and as required to provide the Service.
2. Scope of processing
CubHub processes the categories of Personal Data described in the Privacy Policy for the purposes of (a) providing attendance, billing, messaging, and recordkeeping functionality, (b) platform security and abuse prevention, and (c) compliance with legal obligations. Processing continues for the term of the subscription plus any retention window the Center selects.
3. Sub-processors
CubHub uses the following sub-processors: Supabase (database, authentication, file storage), Stripe (payments), Mailgun (transactional email), and an infrastructure provider for hosting. A current list is available on request. CubHub will provide prior notice of new sub-processors and allow the Center to object on reasonable grounds.
4. Security measures
CubHub maintains industry-standard technical and organizational measures including encryption of data in transit (TLS 1.2+) and at rest, role-based access control, Row Level Security policies, audit logging of sensitive actions (including super-admin impersonation), and least-privilege secrets management for payment and email providers. Incident response procedures are documented internally.
5. Data subject rights
CubHub will assist the Center in responding to verified data subject requests for access, rectification, deletion, or portability. For requests directed to CubHub about information CubHub controls (e.g., account-level data), contact privacy@cubhub.ai.
6. Breach notification
CubHub will notify the Center without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data breach affecting the Center's data, with the information reasonably required to meet the Center's own notification obligations.
7. International transfers
CubHub primarily stores Personal Data in data centers located in the United States. Where data transfer mechanisms are required for cross-border transfers, CubHub relies on Standard Contractual Clauses or equivalent safeguards.
8. Return and deletion
Upon termination, CubHub will delete or return Personal Data in accordance with the retention settings the Center has chosen, subject to legal retention obligations. Soft-deleted centers are preserved for a 30-day recovery window before purge.
9. Contact
Questions about this DPA? Email privacy@cubhub.ai. Centers may also request a countersigned copy of this DPA for their records.