Privacy Policy

1. Who this policy covers

This policy covers visitors to hubbrand, account holders, invited collaborators, people who contact us, and visitors to published brand hubs. It describes the current beta service.

The service operator is responsible for account administration, support, security, and service analytics. When a customer puts other people’s personal data in a hub, that customer may be the controller and hubbrand may process it on their behalf. That processing requires appropriate contractual terms; this privacy policy does not replace a data processing agreement. Contact the hub owner about their use of your information, or contact us if you need help identifying the appropriate recipient.

2. Information we process

Account information includes your email, authentication details, account identifier and handle, and any profile details you provide, such as your name, company, country, and type of work. If you use Google sign-in, we receive the account information made available through that sign-in process. We also store account settings, onboarding progress, hub memberships, and terms acceptance information where recorded.

Content includes the brand hubs, text, images, documents, audio, video, fonts, links, and other files you upload or import, together with associated filenames and metadata. These materials can contain personal information about you or other people. Invitations include the invitee’s email address, hub, and access role; we receive those details from the person inviting them.

When you contact us, we process your name, email address, subject, message, and subsequent correspondence. Requests to the service also expose technical information such as IP address, browser information, requested URLs, and timestamps to our infrastructure providers. Please do not put passwords, payment details, or sensitive personal information in a support message or brand hub.

3. Why we use information

To provide an account, save and share your work, manage access, and run features you request, the proposed legal basis is performance of our contract with you, or steps you request before entering that contract (GDPR Article 6(1)(b)). Optional profile fields are not required to create an account. Authentication information is needed to provide account access; a reply email and message are needed to answer a contact request.

For business-contact correspondence, invitations, abuse prevention, troubleshooting, and service measurement, the proposed basis is our legitimate interests in operating a secure, useful service and responding to requests (Article 6(1)(f)), subject to an assessment of your rights. Invitations help customers collaborate with their chosen colleagues. You may object to processing based on legitimate interests.

Where a specific law requires us to retain or disclose information, the basis is legal obligation (Article 6(1)(c)). Where processing requires consent, including non-essential device storage or access where applicable, that consent must be obtained separately and can be withdrawn. Agreeing to the Terms of Service is not consent to all uses of personal information. These proposed bases require the operator’s confirmation before this draft is finalized.

4. Published hubs and shared files

Publishing a hub makes its published content available to its audience. People with access can view and download content, and searchable hubs may appear in search engines. Collaborators receive access according to the role assigned to them.

Uploaded media currently uses public file URLs. Someone who has a file’s URL can retrieve it even when the associated hub is private or unpublished. A private hub setting does not make those file URLs private. Avoid uploading confidential material or personal information that should not be accessible this way.

Deleting or unpublishing a hub cannot recall copies that others have already downloaded or independently stored. Files you contributed to another person’s hub can remain with that hub when you delete your account; contact its owner or us about requests relating to personal information in those files.

5. AI features and imported content

When you request AI writing, analysis, or imports, the selected provider—OpenAI, Anthropic, or Google—receives the input needed for that task. This can include instructions, brand context, document text, images, filenames, and URLs. Check the content and selected provider before running a task, and only submit information you are authorized to share.

If your account has no saved provider key, Brand Assistant and the AI writer can run on hubbrand’s own Anthropic account within a free trial allowance. Anthropic then receives the same input for those tasks under hubbrand’s account with it. For each such request hubbrand records only how much of the allowance it used, not what it contained. Adding your own key replaces the free trial.

If you save your own provider API key, hubbrand stores it using Supabase Vault and retrieves it to authenticate your requests. You can remove saved keys in AI settings. The provider’s processing, retention, and any use for model training depend on the applicable service terms and account settings; this policy does not promise zero retention or that every provider excludes training.

Import and media features may contact the websites you specify or services such as Brandfetch and Unsplash. Those services receive the relevant domain, search, or asset request. AI output is used to help create content; the reviewed application does not implement automated decisions producing legal or similarly significant effects about individuals.

6. Service providers and other recipients

The application integrates Supabase for authentication, database storage, media storage, and saved API keys; Vercel for hosting and web analytics; and Resend for email delivery. Email recipients and the mailbox provider also process messages sent through our contact and invitation features. Google processes Google sign-in when you choose it. AI and media providers receive information when the relevant features are used, including Anthropic for free-trial AI requests made on hubbrand’s account.

Feedback you send from inside the application is stored in our database with your account identifier, your account email address, the type you selected, your message, and technical context: the page you were on, the application version, your screen size, and your browser user-agent string. A copy is emailed to the operator through Resend so it can be read and answered. Service administrators can access these records. Feedback is kept when you delete your account: the link to your account is removed, but the message, its type, the technical context and the email address you sent it from remain so it can still be acted on and answered. Only a service administrator can delete feedback; use the contact form to ask for yours to be removed.

Authorized service administrators can access information needed to operate and support the service. Hub owners and collaborators receive shared content and relevant membership details. Competent authorities or professional advisers may receive information when needed to meet a legal obligation or handle a legal claim.

The exact contracting entities, enabled production services, processing locations, and processor agreements must be verified before this draft becomes the final notice.

7. Cookies, browser storage, and external content

Authentication uses cookies to maintain and refresh your session. The application also uses browser storage to remember interface choices, such as whether you have seen a publishing or export notice. These values can persist until you clear site data. Blocking or deleting authentication cookies can sign you out or prevent account features from working.

Vercel describes its Web Analytics product as cookie-free. That does not mean that every feature on hubbrand is cookie-free or exempt from privacy requirements. The current application includes analytics without a visitor consent control; its lawful configuration needs review.

Brand hubs can load third-party video, audio, Figma, Storybook, and other embedded pages, remote images, and Google Fonts. Those requests expose connection information, including your IP address, to the relevant provider, which may also use cookies or similar technologies. Some hub embeds load when the page is displayed. The homepage’s YouTube trailer loads after you press play. Browser controls and third-party policies apply, but they do not replace any consent controls hubbrand is legally required to provide.

8. Visits and download statistics

For published hubs, the server combines the date, IP address, and browser user-agent into a daily hash to count visitors. The visit database stores that hash, hub identifier, and date rather than the raw IP address and user-agent. The hash changes with the date, but hashing does not guarantee anonymity. Infrastructure providers may separately process the original request information.

Download statistics record the hub, date, asset URL, asset name, and count. Hub owners can view aggregate visit and download statistics; administrators can access analytics records. Vercel Web Analytics separately measures website usage, including page views and related browser, device, and referral information.

9. How long information stays

Account and hub records remain while the account and content exist. Account settings include a deletion function that removes your account and owned hubs and attempts to remove uploaded files, subject to the exception for contributions to other people’s hubs described above. Removing your account also removes its saved AI keys from active storage.

The reviewed application has no automatic age-based expiry for hub visit hashes or download statistics; those records are linked to the hub and deleted with it. The contact form’s in-memory abuse-prevention entries expire after ten minutes, although hosting logs and delivered messages are separate records.

Retention periods for support correspondence, invitations, infrastructure logs, provider copies, and backups still need to be confirmed. Copies outside the active application may remain after an account is deleted. We cannot give a verified deletion deadline for those copies in this draft. Before final publication, the operator must set and disclose specific periods or meaningful criteria for each category and implement the corresponding deletion process.

10. International processing

Our providers may process information outside your country, including outside the European Economic Area. The applicable processing locations and transfer arrangements have not yet been confirmed for this notice.

Where the GDPR applies, transfers outside the EEA require a valid mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary additional safeguards. The final notice must identify the mechanisms actually used and explain how to obtain information about the safeguards. This draft does not certify that those arrangements are already in place.

11. Your rights and choices

Where the GDPR applies, you can request access to your personal information, correction, erasure, restriction, and—where applicable—a portable copy. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. These rights have conditions and exceptions.

Use our contact form to make a privacy request, including if you no longer have an account. Describe the request and the account or hub involved; do not send a password. We may need proportionate information to verify identity. GDPR requests generally require a response within one month; a permitted extension of up to two further months must be explained within the first month.

You can complain to the supervisory authority in the EEA country where you habitually live or work, or where the alleged infringement occurred. In Poland, this is the President of the Personal Data Protection Office (UODO). You do not need to contact us before making a complaint.

12. Changes to this policy

This draft was last updated on 21 October 2026. We will update the date when the policy changes. Material changes in processing must be explained before they take effect where required by law; publishing an updated policy does not itself obtain consent for a new purpose.