In this section
Resources / Trust / Privacy
GDPR and privacy
What personal data Hubbo handles, which cookies and browser storage it uses, and how to exercise your rights. Links to the full Privacy Policy.
This article summarizes how Hubbo handles personal data. The binding document is the Privacy Policy. If anything here differs from the Privacy Policy, the Privacy Policy prevails.
Who is responsible
Codemilk (Poland) operates Hubbo. For the data of people who use the Hubbo admin app (you and your team) Codemilk acts as the controller. For the data of your website visitors that you collect with Hubbo, you are the controller and Codemilk acts as a processor on your behalf. See Data processing.
Data about account holders and team members
- Name and email address, and profile picture if you set one.
- Account details such as the account name, website URL and team roles.
- Billing information. Card details are handled by Stripe. Hubbo keeps plan and invoice information.
- Usage data from the admin app, such as pages visited and diagnostic data, described in the Privacy Policy.
Data about your website visitors
| Feature | Data stored | Identifies a person? |
|---|---|---|
| Page-view counting | A session marker cookie. No visitor identifier is stored in your account data, only a count. | No |
| NPS | Score, optional comment, page URL, date, and context such as country, device, language, browser, operating system, screen and connection information. | Not by itself. A comment could contain personal data if the visitor writes it. |
| Surveys | Answers, whether the survey was completed or declined, and the same context fields as NPS. | Not by itself. Free-text answers may contain personal data. |
| Notification comments and chat | Messages and, if given, a name and email address. | Yes, if the visitor provides them. |
| Status page subscribers | Email address. | Yes |
| Roadmap and notification pages | Nothing about the visitor is stored beyond the session marker. | No |
No fingerprinting for advertising
Hubbo does not sell data and does not use visitor data for advertising. The context fields are collected to help you understand the circumstances of feedback, for example a low score on mobile.
Cookies and browser storage
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
| hubbo_api_key | api.hubbo.io (httpOnly, Secure, SameSite=None) | Lets the embed identify which Hubbo account the site belongs to. | Set when the embed script is requested with your key. |
| hubbo_pv_* | api.hubbo.io (httpOnly, Secure, SameSite=None) | Marks that this browser session has already been counted as a page view, so usage limits are accurate. | Browser session. |
| hubbo_chat_* | api.hubbo.io (httpOnly, Secure, SameSite=None) | Holds a short-lived guest chat token so a visitor can continue a conversation started on a public notification page (mutations and subscription). | About 24 hours, or until the token expires. |
| hubbo (localStorage) | Your website’s origin | Remembers which notifications were shown, and the timing and throttling decisions for NPS and surveys, so visitors are not asked repeatedly. | Until cleared by the visitor or the browser. |
The cookies are set by Hubbo’s API host and are therefore third-party cookies on your site. They are used to provide the service you configured, not for advertising.
Consent is your decision
Whether you need a consent banner depends on your jurisdiction and on how you classify these cookies and storage items. Hubbo does not display a consent banner for you. Check with your legal advisor, and describe Hubbo in your own cookie notice using the table above.
The Hubbo marketing site (hubbo.io) also uses Hubbo and counts visits as page views like any other site. Its cookies and tracking technologies are described in the Privacy Policy.
Legal bases
- Providing the service and performing our contract with you (account holders).
- Legitimate interests, for example keeping the service secure and preventing abuse.
- Consent, where required, for optional communication.
- For visitor data collected through Hubbo on your site, the legal basis is determined by you as the controller.
Your rights
Under the GDPR you may ask for access to your data, correction, deletion, restriction, portability, and you may object to certain processing. You also have the right to lodge a complaint with a supervisory authority, in Poland that is the President of the Personal Data Protection Office (UODO).
- As an account holder: email support@hubbo.io from your account email address.
- As a visitor to a site that uses Hubbo: contact the site owner first, since they decide why the data is collected. If you are unsure who that is, email support@hubbo.io and we will help route your request.
Retention and deletion
- Content and responses stay in your account until you delete them or delete the account.
- Deleting an account removes its content and settings: notifications and reactions, Messages, NPS and survey responses, roadmaps, the status page with its incidents and subscribers, saved audiences, analytics and team memberships.
- You can delete individual survey responses and status subscribers in the admin app.
- To ask for deletion of data we cannot delete from the interface, email support@hubbo.io.
International transfers
Some of the providers listed in Data processing may process data outside the European Economic Area. Where that happens we rely on the safeguards available under the GDPR, such as standard contractual clauses, as described in the Privacy Policy.
Contact
Codemilk, ul. Osiedle Nad Jarem 115, 83-200 Starogard Gdański, Poland. Email: support@hubbo.io.