Last updated 15 October 2026.
Who we are
huesix is operated by Bcube Technology Services, Dubai, United Arab Emirates. This policy covers this website, Studio (where our customers build configurators), and the configurators they publish. For anything about your data, write to support@huesix.com or use the contact form.
Two roles
We decide how your data is used (we’re the controller) when you visit this website, write to us, use Studio, or pay for a plan.
We process data for our customers (we’re their processor) when you use a configurator on a brand’s website (or on the brand’s own domain) and send it an enquiry. That brand decides what is collected and why, and its privacy notice applies; please contact it first. We help it answer your request, under our data processing terms.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Your account: name, email, password (stored only as a secure hash), workspaces and roles, invitations. | To give you Studio and your team access to it. | Contract |
| What you put in a workspace: models, pictures, sounds, products and settings. | To build, store and publish your configurators. | Contract |
| Billing: the billing contact’s name, email and address, tax ID, plan and invoices. Card details go straight to Stripe; we never see or store card numbers. | To charge for plans and storage, and keep tax records. | Contract; legal obligation |
| Messages to us: name, email, company, topic, message and the page you wrote from. | To answer you. | Legitimate interests; steps before a contract |
| Emails we send you: sign-up confirmation, password reset, invitations, receipts, payment problems, trial reminders, and new enquiries (which a workspace can turn off). | To run your account. We don’t send marketing email. | Contract |
| Security records: sign-in sessions (with the browser and IP address used), a log of billing and admin actions, and our hosting provider’s request logs. | To keep accounts and the service secure, and to investigate misuse. | Legitimate interests |
| How often each configurator loads, counted per product per day. This holds no personal data. | To show your plan’s usage. | Legitimate interests |
| For our customers, what shoppers do in their configurators: options chosen, AR and VR opened, shares, enquiries and carts, time spent and load times, with the type of device, the country, the site the shopper came from and the page it’s on. No cookies, nothing stored on the device, and no IP address kept: a visitor is counted with a hash whose salt is replaced every day. Browsers sending Global Privacy Control or Do Not Track aren’t counted. | To give the brand its configurator analytics (as its processor). | The brand’s; we act on its instructions |
| For our customers, enquiries shoppers send: name, email, phone, message, the design and the page. Stored encrypted. | To deliver them to the brand (as its processor). | The brand’s; we act on its instructions |
Where we rely on legitimate interests, we’ve weighed them against your rights, and you can object (see your rights).
What we don’t do
- We don’t sell personal data, or share it for cross-context behavioural advertising.
- This website uses no analytics, advertising or tracking cookies. See cookies and storage.
- We don’t make decisions about you by automated means that have legal or similarly significant effects.
- We don’t use your workspace content to train AI models.
Who we share it with
Only the providers that run huesix for us, listed with what they do and where on the sub-processors page, each bound by a data processing agreement. We also share data when the law requires it, to protect people’s safety or our rights, or with a company that takes over huesix (and then this policy keeps applying). Services you connect yourself, such as Shopify or a webhook, receive what you send them.
International transfers
Our providers run in several countries, including the United States and the European Union. When data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the transfer relies on the European Commission’s standard contractual clauses (with the UK addendum and Swiss amendments), or on the EU–US Data Privacy Framework where the provider is certified. Transfers from the UAE follow the Personal Data Protection Law’s rules on cross-border transfers.
How long we keep it
| Data | Kept |
|---|---|
| Account and workspace content | Until you delete it, your workspace or your account. Deleting removes it from huesix at once; database backups expire within 35 days. |
| Invoices and billing records | As long as tax and accounting law requires, generally up to 7 years. |
| Messages to us | 2 years. |
| Billing and admin action log | 2 years. |
| Expired sessions, reset links and invitations | 30 days after they expire. |
| Configurator load counts and configurator analytics | About 13 months (400 days). |
| Enquiries (for our customers) | Until the brand deletes them, its product or its workspace. |
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you and give you a copy, in a format you can take elsewhere;
- correct it;
- delete it;
- stop or limit using it, or object to uses based on legitimate interests;
- withdraw a consent you gave, at any time, without affecting what happened before.
Much of this you can do yourself in Studio, under Settings: change your name and password, and export or delete a workspace or your account (Your data). For anything else, write to us. We answer within one month (45 days for requests under US state laws), may ask you to confirm who you are, and never treat you differently for using your rights. An authorised agent may ask for you with your written permission.
You can also complain to a data protection authority: in the EU, the one where you live or work; in the UK, the Information Commissioner’s Office; in the UAE, the UAE Data Office. We’d like the chance to put things right first.
Where you live
- EU, EEA, UK and Switzerland: the rights above come from the GDPR, UK GDPR and Swiss FADP. Where a law requires a representative in your region, contact us and we’ll put you in touch.
- California and other US states: we collect the categories in the table above (identifiers, commercial information, internet activity, professional information), for the purposes listed, and don’t sell or share them or use sensitive information to infer anything about you.
- UAE and the Gulf: we follow the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021) and the Saudi Personal Data Protection Law where they apply.
- Elsewhere: including Brazil (LGPD), Canada (PIPEDA), India (DPDP Act), Australia and Singapore, you have the rights those laws give you, and we honour them in the same way.
Security
Data is encrypted in transit and at rest. On top of that, shoppers’ enquiry details, the credentials of connected systems and shop tokens are encrypted field by field (AES-256-GCM), so a copy of the database alone doesn’t reveal them. Passwords and API keys are stored only as secure hashes, access is limited to the people who need it, and administrative and billing actions are logged. If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.
Children
huesix is a business service and isn’t meant for children under 16. If you think a child has given us personal data, tell us and we’ll delete it.
Changes
We’ll update the date at the top when this policy changes, and tell account holders by email before a change that matters takes effect.