Loading CubicleLoading CubicleLegal
Document
This Privacy Policy explains what personal information Cubicle processes, why it is processed, who it is shared with, how long it is kept, and how authorized school staff can make requests.
Effective August 25, 2026
Cubicle (“we”, “the platform”) is a school operations application used by authorized staff. This Privacy Policy describes how personal information is collected, used, disclosed, stored, protected, and disposed of in connection with mycubicle.app.
It should be read together with the Terms & Conditions, Intellectual Property & Licence, Acceptable Use Policy, and Security & Data Safety statement. Division IT, privacy, and legal contacts should review this policy before formal board or division-wide adoption.
This policy is written for staff users and for the school division as a local authority. It is not a consumer privacy notice for a public social network, and it is not a substitute for the division’s own LA FOIP procedures.
The participating school division determines the purposes for which staff operational data is collected in Cubicle (who may book carts, which emails are allowlisted, how long records are kept for school operations). In that sense the division is the primary public body responsible for personal information under Saskatchewan local-authority privacy law.
Operators of Cubicle process that information on the division’s behalf to run the application: authentication, database hosting, application delivery, email notifications, and related technical support. Individual users (teachers and admins) also enter information in the course of their duties. Processing school records does not transfer ownership of the Cubicle software to the division. The software remains the Cubicle Owner’s property as described in the Intellectual Property & Licence policy.
Privacy questions, access requests, and correction requests should ordinarily go to the school division’s privacy contact / IT, who can involve the platform operators as needed. Contact: it-support@rbe.sk.ca.
This policy applies to Cubicle available at mycubicle.app, including the signed-in application, public legal and about pages, sign-in flows, and operational email sent by the platform.
The platform is designed around staff operational data. Depending on how you and administrators use the service, we may process the following categories.
Cubicle is not intended to collect student personal education records, health information, or payment card data as a primary purpose. Avoid entering those categories in free-text fields.
We do not buy staff lists from data brokers. Allowlist records are created by the school division.
We process personal information only as needed to:
We do not use staff operational data to serve third-party advertising, we do not sell personal information, and we do not use it to train public generative-AI models. You may not export personal or operational data in order to populate a clone of Cubicle.
The participating school division is a local authority for the purposes of Saskatchewan’s Local Authority Freedom of Information and Protection of Privacy Act (“LA FOIP”). Personal information in Cubicle is collected and used for the authorized school purpose of coordinating shared instructional technology and related staff operations.
Processing is limited to what is needed for those purposes, for the protection of people and property (including equipment safety and abuse prevention), and for purposes consistent with those for which the information was obtained, as LA FOIP and division policy allow.
Canada’s Anti-Spam Legislation (CASL) is relevant to commercial electronic messages. Operational notices about bookings, shares, swaps, cancellations, and equipment issues are transactional / service messages related to your use of a work tool, not marketing. You can reduce optional notification types in Settings.
PIPEDA generally does not replace LA FOIP for a Saskatchewan school division acting as a public body. If a vendor processes information outside Saskatchewan, the division remains responsible for ensuring contractual and policy safeguards are adequate.
Other signed-in staff can typically see operational booking and issue information that the board requires for a shared schedule (who has which cart in which period). Treat that visibility as workplace operational transparency, not a public directory.
We share personal information only as needed to operate the service, comply with law, or protect the school community. We use trusted infrastructure processors, currently including:
These processors handle data under their agreements and security controls as needed to run the platform. They are not permitted to use school staff data to advertise to you.
We do not sell personal information, and we do not share it with third parties for their independent marketing.
If email is configured, Cubicle may send messages to your school address about events such as:
Message content may include cart name, period, date, staff names, and a short operational summary. You can turn some categories off in Settings. Security, access, and administrative messages may still be sent. Delivery depends on the email provider, school spam filters, and DNS authentication for the sending domain; we cannot guarantee inbox placement.
To keep every open board accurate, the application subscribes to database change events and may show whether a colleague appears currently signed in. Presence is a coarse workplace signal, not a timesheet, not GPS tracking, and not proof of classroom location.
Optional camera access on a phone is used only when you choose to scan a cart or laptop QR label. The image is processed to decode the code; it is not used to build a photo gallery of staff or students. You can deny camera permission and still use the rest of the product.
Operational records (bookings, issues, profiles, inventory) are retained while needed for school operations, troubleshooting, equipment history, and audit requirements. There is no automatic “right to be forgotten” that erases school operational history while you remain staff and the division still needs the record, except as LA FOIP and division records schedules provide.
Record retention and destruction schedules should follow school division policy. Platform operators will cooperate with documented IT requests to correct or remove specific records where technically feasible and lawful.
We apply administrative and technical safeguards described in the Security & Data Safety statement, including encrypted transport (HTTPS), least-privilege credentials, allowlist enforcement, role-based authorization, and database row-level security. Service-role secrets are not shipped to the browser.
No method of transmission or storage is perfectly secure. You must also protect your Google account, devices, and the information you type into free-text fields. Report suspected incidents promptly to it-support@rbe.sk.ca.
As a staff member of a Saskatchewan local authority, you may have rights to request access to personal information about you, and to request correction of inaccurate personal information, subject to exceptions in LA FOIP (for example other people’s information, security, or solicitor-client privilege).
Submit requests through the school division’s established privacy process, or start with it-support@rbe.sk.ca. We may need to verify that the request is from the individual concerned or an authorized representative. School operational records that are not “personal information” (or that contain mixed information about several staff) will be handled according to division FOI/LA FOIP procedures.
Cubicle is directed to authorized adult staff users, not children, and not to students as account holders. It is not a general public social platform and is not a student information system.
Do not enter student names, student numbers, medical notes, safeguarding reports, or other sensitive student identifiers into booking notes or issue descriptions unless a documented division procedure requires that specific field for the task. If such information is entered in error, notify IT so it can be removed.
Infrastructure providers may process or store data in Canada, the United States, or other regions depending on service configuration (for example application hosting, database, authentication, or email). Where personal information may leave Saskatchewan or Canada, the school division remains responsible for ensuring that vendor arrangements and contractual protections meet its privacy obligations.
Staff should assume that operational records are stored on managed cloud infrastructure, not only on a server physically located in the school building.
Cubicle uses automated rules for operational consistency, for example:
These rules are not consumer credit scoring and are not used to profile staff for advertising. They can have workplace effects (you cannot book a locked slot; a cart may be pulled from circulation). Speak with an administrator if you believe a rule was applied in error.
We may update this Privacy Policy to reflect product, legal, or operational changes. The effective date at the top will be revised when changes are published on mycubicle.app. Material changes to purposes or categories of personal information should be reviewed with division privacy contacts. Continued use of the service after the new effective date constitutes awareness of the updated policy.
For privacy questions, access or correction requests, or concerns about how Cubicle handles personal information, contact your school division IT / privacy contact:
If you are not satisfied with the division’s response, Saskatchewan law may allow you to contact the Saskatchewan Information and Privacy Commissioner. Use the Commissioner’s published process. We encourage you to raise the issue with the division first so it can be investigated quickly.
Intellectual-property questions are not privacy complaints. Use the Intellectual Property & Licence policy and mark correspondence “Cubicle Owner — IP”.
For authorized school staff. Review with your division IT and privacy contacts before formal board adoption.
