Hubbo Trust Center

An overview of how Hubbo approaches security, privacy and legal commitments, and where to find the details.

Hubbo runs on your website and talks to your customers, so you need to know how it behaves. This Trust Center summarizes what Hubbo does with your data and your visitors’ data, which technical controls are in place and which documents apply.

Who we are

Hubbo is a product of Codemilk, a company based in Poland (ul. Osiedle Nad Jarem 115, 83-200 Starogard Gdański). Contact: support@hubbo.io. The service is available at hubbo.io, the admin app at app.hubbo.io and the API at api.hubbo.io.

The documents

Document	What it covers
Security	Technical and organizational measures.
GDPR and privacy	Personal data, cookies, visitor data and your rights. Links to the full Privacy Policy.
Terms of Service	The rules for using Hubbo.
Data processing	How Hubbo processes visitor data on your behalf, and which providers help us do it.

Principles

Collect little. Hubbo does not show a login form or force visitors to identify themselves. NPS and survey responses are anonymous by default. A name or email is stored only when a visitor types one into a conversation or status subscription. Your site may optionally call hubbo.identify() for Targeting; with Identity Verification enabled, Hubbo checks an HMAC from your backend before treating a visitor as logged in — see Identify visitors.
No tracking across sites. Hubbo uses a small set of httpOnly cookies for its own operation (account key, page-view session, and optional guest chat) and does not build advertising profiles.
Tell you what is stored. Every cookie and data category is listed in these articles.
Don’t overclaim. We describe what the product does today. We do not claim certifications we do not hold.

Frequently needed information

Question	Short answer
Where is the code that runs on my site?	The embed script served from api.hubbo.io/embed.
Which cookies does it set?	hubbo_api_key, hubbo_pv_, and (when a visitor starts a chat) hubbo_chat_ — all httpOnly on api.hubbo.io. See the cookie table in the GDPR article.
Is there a public REST API?	No. There is only the GraphQL API used by the widget.
Are there security certifications?	We do not currently hold or claim SOC 2, ISO 27001 or similar certifications.
Who do I ask?	support@hubbo.io

Need a signed document?

If your organization needs a signed data processing agreement or a security questionnaire answered, email support@hubbo.io and we will work through it with you.