Privacy Notice

RoleCube is operated by an individual, Mohammed Hamdan, trading as RoleCube (“RoleCube”, “we”, “us”, “our”). We are the controller of the personal data described in this notice: we decide what is collected and why. RoleCube is not a registered company, so there is no licence, registered address or tax number to list.

This notice is written against UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”), supervised by the UAE Data Office.

This notice covers:

• the RoleCube website at rolecube.com;
• the RoleCube product at app.rolecube.com, including sign-up, your profile, every simulation you run, the reports you submit and the evaluations you receive;
• the emails we send you; and
• support conversations you have with us.

It does not cover other websites we link to. If you follow a link out of RoleCube, that site’s own privacy notice applies.

Where you are does not change your protection

RoleCube is operated from the UAE, and UAE law is our home framework. We do not currently offer RoleCube to people in the European Economic Area, the United Kingdom or Switzerland (see section 16.1). For people elsewhere, such as the United States and the wider Gulf, other privacy laws may apply to us too. We apply the strictest standard we are subject to across all users, and set out the additional rights specific to your region in section 16.

We collect only what the product needs: to identify your account, to tailor the simulation, and to produce your evaluation.

4.1 Account and identity data

4.2 Profile data

Your profile is shown back to you, and helps us understand who uses RoleCube and which scenarios to build next. Today it does not change which scenarios you can open or how you are scored: your target role only decides which scenarios are listed first.

4.3 Simulation activity data

RoleCube records what you do inside a simulation. It is what lets you leave and resume, and it is the raw material your evaluation is built from.

• Run state: which scenario you started, the simulated day and clock, when you started, paused, worked overtime and submitted.
• Documents: which scenario documents you opened, when you first and last opened each, and how many times you went back to one while the attempt was in progress. We do not time how long a document is open.
• Data queries: the SQL you wrote against the fictional datasets, how many rows each returned, and when it ran. Queries that were rejected or failed are kept too, with the kind of error, so we can find and fix queries that should have worked.
• Meetings: which meetings you attended, how far you listened, your playback speed, the questions you asked (including ones you typed yourself) and the answers you received.
• Stakeholder messages: the full text of messages you write to fictional colleagues, and the replies generated in response.
• Hints: which hints you revealed and when. Hints do not cost points. The count is shown with your evaluation, and heavy use may be mentioned in your feedback.
• Objectives: which daily objectives you completed and when.
• Activity log: a timeline of your actions within the simulated working day.

4.4 Report and evaluation data

• Your report: the cause you selected, your confidence level, your written narrative and recommendation, the priority and owner you assigned, the evidence you attached, the next steps you chose, and who you sent it to.
• Report drafts, saved to your account as you write, with a backup copy in your own browser in case a save fails.
• Your evaluation: overall score and grade, the process score, the AI-assessed reasoning score, per-criterion scores with written reasons, short quotes from your own report used as evidence, outcome results, hint count, integrity flags, and whether the review was flagged for a human check.
• Technical details of the evaluation: which AI model version was used, how much text it processed, how long it took, and a fingerprint of your submission used to detect duplicates.

4.5 Technical and security data

• IP address, browser and device type, and request times, recorded in server logs by our hosting provider.
• Sign-in session records, each holding the IP address and browser the session was started from.
• Counters of how many AI-backed or data-heavy actions your account made recently, and how many access codes it has tried, used for fair-use limits and to stop codes being guessed, and deleted when they expire. Before you have an account, the same is kept per browser against a random identifier in a first-party cookie (no name or email address) and cleared once a valid code is entered.
• Counters of wrong access codes, wrong passwords and wrong email codes, and of verification and password-reset emails requested, from your network address. They are kept against a one-way scrambled form of the address (a keyed hash, so the address cannot be read back from it, and for a password or email code combined with the email you typed), never the address itself. They exist so that someone guessing codes or passwords, or making us email an address repeatedly, is slowed down and stopped, and they are deleted within two days. A correct code or password is not counted. We add no copy of your address for this: your hosting provider already records it in its server logs, as described above.
• Error reports when something in the product fails.

4.6 Product records and analytics

These are two different things, on two different legal bases:

• Records of the service: that you signed up, redeemed an access code, started an attempt, sent a message or received a reply, submitted a report, received an evaluation, downloaded your result card or changed a setting. We keep these in our own database because RoleCube cannot work without them. They do not depend on your consent.
• Analytics: how you moved through the website and the product: pages viewed, actions taken, where a flow lost you, whether you saw that a plan limit had been reached, the kind of device you used and where you arrived from. On the website and the main app pages this also includes heatmaps (where people click, move the pointer and scroll) and masked session replay, which reconstructs how a visit moved with every piece of text, form field and image blanked out in your browser before anything is sent. Neither runs inside a simulation or on the sign-in pages, and neither is used in your evaluation. If you agree to analytics, a stripped-down copy of some service records is sent as well. It holds counts, categories and the names of our own scenario content, never anything you wrote: for example which scenario and attempt it was, which fictional colleague or document was involved, how long a step took, which kind of plan a code gave you, the campaign or partner that brought you (never the code itself), and whether a colleague’s reply was written by the AI. All of this goes to PostHog, our analytics provider, only if you agree.
• Pre-account browsing: if you agree to analytics before you have an account, your visits are recorded against a random identifier, and joined to your account if you go on to sign up, so we can see which channels bring people to RoleCube.

Analytics uses a random identifier, never your name or email address. Section 8 says what that identifier is and how to decline or withdraw.

4.7 Communications data

• Emails you send us, our replies, and any support history.
• Problem reports: if you use Report a problem, what you write, the page you were on when you opened it and when you sent it, the scenario and attempt if it was about one, and your account email so we can reply. We add technical details to help us reproduce it: your browser, screen size, language and time zone, the pages you visited and any error messages the page raised in that session, and the names and times of your latest recorded actions in RoleCube. We never add what you typed elsewhere, such as messages, reports or form fields.
• Whether the emails we send you were delivered or bounced. We do not track opens or clicks.

4.8 Payment data

RoleCube does not currently take payments, so we hold no payment data. A plan is not a payment: every account is on a plan, even if that plan allows nothing, and a plan record says only what the account may do. If we introduce paid plans, we will update this notice before charging anyone.

4.9 Special category data

We do not ask for sensitive personal data (about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, or sex life or sexual orientation) and have no use for it.

Parts of RoleCube accept free text (messages, meeting questions, your report, emails to support), so it is possible to type such information. Please do not. If you do, we will not use it, and we will delete it when we become aware of it.

• From you: what you enter during sign-up, in your profile, and in simulations.
• From your device: IP address, browser and device characteristics, and, if you agree, the analytics described in section 8.
• From a link or code you were given: the partner named in a referral link you followed, and an access code you enter yourself.
• Generated by us: scores, grades, verdicts, integrity flags and progress.
• From our email provider: whether an email was delivered.

We do not buy personal data, enrich profiles from data brokers, or scrape social networks.

Under the UAE PDPL, and under the GDPR and UK GDPR where they apply, we need a lawful basis for each use of your data:

Our legitimate interests assessment

Where we rely on legitimate interests, we have weighed our interest against your rights. In each case the processing is limited to what is necessary, uses no sensitive data, has no legal or similarly significant effect on you, and is what a reasonable user would expect. You can object (see section 15) and ask us for a summary of our assessment.

We ask for your consent for one thing only: analytics. When we ask, it is:

• Specific and informed: one clear question about analytics, with what it involves and who receives it set out before you decide;
• Freely given: declining never blocks or degrades anything;
• Unambiguous: given only by clicking to accept. Nothing is pre-ticked, and browsing or scrolling is not consent;
• As easy to withdraw as to give: one click, in the same place;
• Recorded: what you chose, when, where you made the choice, and which version of this notice you were answering;
• Asked again: six months after you answer, and whenever what we collect changes. An answer to an earlier version counts as no answer until you give a new one.

Withdrawing consent

You can withdraw at any time from Profile → Preferences → Privacy, from Profile → Preferences → Privacy when signed in, or “Cookie settings” in the site footer, or by emailing us. Withdrawal takes effect immediately and does not affect anything done before you withdrew.

The full detail (every cookie and storage entry, its purpose and how long it lasts) is in the Cookie Policy. In short:

• Strictly necessary: the cookies that keep you signed in, and browser storage that backs up an unsubmitted report or keeps a half-finished sign-up. These cannot be switched off and do not track you.
• Up to three small cookies, set without asking: where you arrived from (one word), a campaign link’s two labels (only if the link carried them), and which partner sent you (only if one did). None is set if your browser sends a Global Privacy Control or Do Not Track signal.
• Analytics, only with your consent: PostHog, hosted in the European Union (Frankfurt). Not loaded at all until you agree. It runs only on the live site, and never for our own test or staff accounts.
• Advertising: none.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal of analytics. If you have an account and switch analytics on yourself in your profile, that explicit choice applies instead.

RoleCube uses generative AI, provided by Google (Gemini), in two places.

9.1 Replies from fictional colleagues

When you message a fictional colleague or ask a question in a meeting, what you typed is sent to the AI with that character’s authored description and the authored facts they can draw on, and the AI writes the reply in character. It is instructed to stay within the authored facts. If the AI is unavailable, you see the authored text instead, so the simulation never depends on it.

9.2 Evaluating your report

When you submit a report, your written narrative and recommendation are sent to the AI, together with your selections in the report, a summary of what you did in the simulation (such as the queries you attached as evidence and which colleagues you contacted), and the scenario’s authored answer key and marking rubric. The AI scores each criterion and writes the reasons. RoleCube combines those scores with its own rule-based score to produce your result, so the AI cannot set your total on its own. If the AI is unavailable, you receive a provisional, rule-based result flagged for a human check.

9.3 What the AI never receives

What you type into messages, meeting questions and your report is the one way personal information could reach the AI, and only if you write it there yourself. Write about the fictional business problem, not about yourself or real people.

9.4 Training, retention and review at the AI provider

• We do not train AI models on your data. We do not build or tune any model with it.
• Google may, while we are on its free service. That includes keeping it for longer than under Google’s paid terms, and using it to improve its own products. We cannot control or reverse that use once the content has been sent, and we cannot ask Google to delete a particular request. Deleting your RoleCube account removes what we hold, not what Google has already received.
• We plan to move to Google’s paid service. Under that service Google processes what we send only to return a response to us, as our processor, and does not use it to improve its products. When we do, we will update this notice and the date at the top, and content sent after that point is covered by the paid terms. Content sent earlier stays under the free-tier terms it was sent under.
• Each request is independent, apart from the earlier messages in the same conversation with a fictional colleague.

9.5 The limits of AI output

AI-generated replies and evaluation reasons can be wrong, inconsistent or oddly phrased. Nothing RoleCube produces is professional, legal, financial, medical or career advice, and a RoleCube score is not a qualification or a predictor of job performance. If you think an evaluation is unfair, you can ask for a human review. See section 10.

Your evaluation is produced largely automatically: rules measure what you did in the simulation, and the AI assesses the quality of your written reasoning against the rubric. Together they give your score and grade.

The UAE PDPL lets you object to automated processing that has legal consequences or seriously affects you, and the GDPR and UK GDPR give a comparable right not to be subject to a solely automated decision with legal or similarly significant effects.

A RoleCube evaluation is self-directed training feedback. It confers no qualification, is not given to anyone else unless you share it, and is not used to make decisions about your employment, credit, insurance or access to services, so in our view it has no such effect. We give you the safeguards anyway:

• you are told, here and in the product, that the evaluation is AI-assisted;
• you can see the score for each criterion, the reason for each verdict, and the quotes from your report that it relied on;
• you can ask for a human review of any evaluation by emailing us, and a person will look at it again;
• you can contest the result and give your view, and we will record it;
• evaluations our own checks consider unreliable are marked as provisional and flagged for a human check, without you having to ask.

If we ever offer RoleCube results to employers or educational institutions for decisions about people, we will reassess this and update this notice first.

11.1 What we never do

• We do not sell personal data, including under the broad definition of “sell” in the California Consumer Privacy Act.
• We do not share personal data for targeted or cross-context advertising.
• We do not disclose personal data to data brokers.
• We do not let any provider use your data for its own purposes. Each is bound to process it only on our instructions.

11.2 The providers who process data for us

• Vercel: hosts the website and product. Our servers run in London.
• Neon: the database, and the sign-in service that holds passwords and sessions. London.
• Google (Gemini): the AI described in section 9. Receives scenario content and what you write in a simulation, never your profile.
• Resend: sends our emails. Ireland.
• PostHog: analytics, only with your consent. Frankfurt, Germany.

The sub-processor list sets out exactly what each one handles and where, and how we give notice before adding anyone new. We do not currently use a payment provider.

11.3 Other disclosures

• Professional advisers: lawyers, accountants, auditors and insurers, bound by confidentiality, where necessary.
• Corporate transactions: if RoleCube is merged, acquired, financed or sold, data may pass to the other party under confidentiality, with this notice continuing to apply. We will tell you before your data becomes subject to a different privacy notice.
• Legal and regulatory: where a valid, binding legal order requires it, or where necessary to establish, exercise or defend legal claims or to protect someone’s vital interests. We disclose the minimum necessary and tell you unless the law prevents us.

RoleCube is operated from the United Arab Emirates. Our servers, database, email and analytics providers are in the United Kingdom and the European Union; our AI provider processes data in the United States and other countries where Google operates. Every transfer uses a lawful mechanism.

12.1 Transfers out of the UAE

The UAE PDPL allows transfers outside the UAE to countries with adequate protection, or where appropriate safeguards are in place (typically contractual clauses requiring the recipient to protect the data to UAE standards), or under a specific exception, such as necessity for performing a contract. We rely on contractual safeguards with every provider in section 11.

12.2 Transfers from elsewhere

The UAE PDPL and the laws of other places where you may live restrict some transfers of personal data. Wherever a provider in section 11 handles your data outside your own country, we rely on the contractual safeguards in our agreement with that provider, and we choose providers that commit to protecting the data to a standard comparable to the UAE PDPL. You can ask us for a summary of these safeguards, with confidential terms removed.

We keep personal data only as long as we need it, or as long as the law requires. When a period ends, we delete the data or anonymise it so it can no longer be linked to you.

Deleting your account

To delete your account, email privacy@rolecube.com from the address on your account. We will delete your sign-in identity and sessions, your profile, plan history, simulations, reports and evaluations, any problem reports you sent, the sign-up progress and service records tied to your account, and the link between your analytics identifier and your account, so any analytics that remains can no longer be connected to you.

What we keep: the record of your analytics choices, which holds only a random account identifier that no longer leads to you and is removed on the schedule in the table above; anything the law requires us to keep; and, if you ask us never to contact you again, a minimal record of your email address so we can honour that.

No system is perfectly secure, but these are real, working controls rather than aspirations:

• Encryption in transit: HTTPS everywhere, with HTTP Strict Transport Security so browsers never fall back to an unencrypted connection.
• Browser hardening: a Content Security Policy that lets no outside website load scripts into RoleCube or receive data from it, no embedding in other sites, MIME-type sniffing disabled, and a referrer policy that keeps the addresses of your pages from leaking to other sites.
• Device access denied: camera, microphone, location, payment and screen capture are blocked at the browser level. RoleCube uses none of them.
• Encryption at rest: the database and its backups are encrypted by our database provider.
• Password handling: passwords are stored only as salted, slow hashes by our sign-in provider, and never seen, stored or logged by us.
• Verified email: accounts must verify their email address before use.
• Secure sessions: signed, encrypted, HTTP-only session cookies, limited to our own domains.
• Private by default: every page of the product requires you to be signed in unless deliberately made public, and you can only ever see your own attempts, reports and evaluations.
• Verified webhooks: messages from our sign-in provider are cryptographically verified and protected against replay.
• Limits: text sent to the AI is length-limited on our servers, AI-backed actions are rate-limited per account, and so are attempts to enter an access code. Wrong access codes, passwords and email codes are also limited per network, and so are the verification and reset emails we will send, so guessing is slowed even for someone who creates no account or clears their cookies.
• Maintained dependencies: the software RoleCube is built from is checked for known vulnerabilities and kept up to date.
• Least privilege: access to production data is limited to people who need it, and credentials are kept in a managed secret store.
• Automated tests: access control and privacy behaviour are covered by automated tests that run on every change.

Please use a strong, unique password, do not share your account, and tell us at security@rolecube.com straight away if you think it has been compromised.

These rights come from the UAE PDPL. We give them to every RoleCube user, wherever you live.

16.1 European Economic Area, United Kingdom and Switzerland

RoleCube is not currently offered to people in the European Economic Area, the United Kingdom or Switzerland. We do not market to, price for or target people there, and we have not appointed a representative in any of them, which the GDPR, the UK GDPR and in some cases the Swiss data protection law would require if we did. If you are in one of those places, please do not create an account. If we learn that an account belongs to a person there, we may close it and delete its data, and you can ask us to do so at any time by writing to privacy@rolecube.com. We will appoint any required representatives and update this notice before we offer RoleCube in those places.

16.2 California

Under the California Consumer Privacy Act as amended by the CPRA, you can know what personal information we collected, its sources, purposes and recipients; delete it; correct it; opt out of its sale or sharing; limit the use of sensitive personal information; and not be discriminated against for using these rights.

• We do not sell or share your personal information as the CCPA defines those terms, and have not in the last twelve months.
• We do not use sensitive personal information to infer characteristics about you.
• We honour the Global Privacy Control signal as a valid opt-out.
• You may use an authorised agent, with written authorisation and verification of your identity.
• We make no disclosures to third parties for their direct marketing, so California’s “Shine the Light” law has nothing to report.

16.3 Other United States state privacy laws

Comprehensive privacy laws in many US states give residents rights of access, correction, deletion, portability, and opting out of targeted advertising, sale and significant profiling. We give these rights to every US resident, we do no targeted advertising and no sale, and we recognise universal opt-out signals. If we refuse a request and your state provides an appeal, we will tell you how to appeal and how to escalate to your state Attorney General.

16.4 Canada

Under PIPEDA you can access your personal information, challenge its accuracy, and complain to the Office of the Privacy Commissioner of Canada. In Quebec, Law 25 adds rights to de-indexing, portability, and to be told when a decision is based solely on automated processing. See section 10.

16.5 Brazil

Under the LGPD you can confirm and access processing, correct, anonymise, block or delete data, port it, learn who we share it with and what refusing consent means, withdraw consent, and ask for review of solely automated decisions. You can complain to the Autoridade Nacional de Proteção de Dados.

16.6 Australia and New Zealand

The Australian Privacy Principles give you rights of access and correction and require us to notify you and the Office of the Australian Information Commissioner of eligible data breaches. New Zealand’s Privacy Act 2020 gives comparable rights.

16.7 India

The Digital Personal Data Protection Act 2023 gives you rights to a summary of your data and our processing, to correction and erasure, to nominate someone to exercise your rights, and to grievance redress. Contact us first; you can then escalate to the Data Protection Board of India.

16.8 Saudi Arabia and the wider GCC

The Saudi Personal Data Protection Law gives rights of information, access, correction and destruction, enforced by the Saudi Data and Artificial Intelligence Authority. We apply equivalent standards across the GCC.

16.9 Everywhere else

If your country gives you a right this notice does not list, write to us and we will honour it as the law requires and, where practical, beyond it.

• In the product: edit most profile details yourself, and change your analytics choice in Profile → Preferences → Privacy.
• By email: for anything else, including a copy of your data or deleting your account, write to privacy@rolecube.com from the address on your account and tell us what you are asking for.

What happens next

• Verification: we need to be sure it is you, because giving your data to the wrong person is itself a breach. Usually an email from your registered address is enough; for unusual requests we may ask for more, but only what is proportionate.
• Timing: we aim to respond within 30 days. Where the GDPR or UK GDPR applies, one month is the maximum, extendable by two months for complex requests, in which case we tell you within the first month.
• Cost: free, unless a request is manifestly unfounded or excessive, in which case we will explain why.
• Refusals: if we cannot do what you ask, we will explain why and tell you how to appeal and how to complain to a regulator.

Please raise a concern with us first. We would rather fix it. Write to privacy@rolecube.com and we will acknowledge within 5 working days.

You can also complain directly to a regulator. You never have to come to us first.

RoleCube is a workplace training product for adults. You must be at least 18 years old to create an account, and we check this at sign-up from your date of birth.

• We do not knowingly collect personal data from anyone under 18. If we find we have, we delete the account and its data promptly.
• If you believe a person under 18 has given us personal data, tell us at privacy@rolecube.com.

If a security incident affects personal data, we investigate immediately, contain it, and assess the risk to you.

• Regulators: we notify the UAE Data Office without undue delay, as the PDPL requires, and, where the GDPR or UK GDPR applies, the competent authority within 72 hours of becoming aware, unless the breach is unlikely to put your rights at risk. We meet the deadlines of other applicable laws too.
• You: where a breach is likely to put your rights at high risk, we tell you directly and promptly: what happened, what data was involved, what we are doing, and what you should do.
• Records: we document every breach, including those we do not have to report.

We send only emails you need to use RoleCube:

• a verification code when you sign up;
• a code when you ask to reset your password;
• one welcome email once you have joined;
• a short confirmation, each time you use Report a problem, that we received it; and
• notice of material changes to our terms or this notice.

These are sent under our contract with you. We do not send marketing email, SMS or marketing calls, and we never give your contact details to anyone else for their marketing. If we ever want to send marketing email, we will ask for your consent first, separately from anything else.

We update this notice when what we do changes. The date at the top shows the current version.

• For minor clarifications, we update the page and the date.
• For material changes (a new purpose, a new type of data, a new recipient or a different legal basis), we tell you by email or in the product before the change takes effect.
• Where a change needs your consent, we ask for it, and we do not apply a new consent-based use to data collected before you agreed.