HUBAL Privacy Policy

1. Data controller

The controller of your personal data is ANTONI SUROWIAK EMA STUDIO (a sole proprietorship), ul. Westerplatte 6, 38-200 Jasło, NIP 6852286869, REGON 383714040 (hereinafter: "HUBAL", "we").

Contact for personal data matters: privacy@hubal-project.com. We have not appointed a Data Protection Officer — for all matters concerning data, you may write to the above address.

2. What this Policy covers and in what role we act

HUBAL is a SaaS project management platform (web + Android mobile application). Depending on the data, we act in two roles:

• As controller — for data we manage for our own purposes: account and login, billing, contact, security and service development, data of visitors to our website. This Policy covers that part.
• As processor — for the content your organisation enters into the platform (projects, documents, financial data, employee data, correspondence, chats). In that case the controller is your organisation, and we process that data on its instructions, under the terms of a Data Processing Agreement (DPA). If your data entered HUBAL through an organisation (e.g. an employer/principal), please contact that organisation first regarding that data.

3. What data we process

• Account and login data: first name/name, e-mail address, organisation name, password hash, profile picture; when signing in via Google/Microsoft — basic profile data (e-mail, first name).
• Billing data: NIP, address, subscription plan and history, payment data handled by the payment operator (we do not store full card details).
• Technical data: IP address, device and browser type, activity and security logs, device identifiers, push notification tokens (FCM).
• Project content: projects, tasks, schedules, documents (including PDF, DXF, DOCX), files, comments, notes, knowledge base.
• Project financial data: budgets, invoices, rates, margins, profitability indicators.
• HR and working time data: employee profiles, working time records and utilisation, performance alerts, leave requests — most often these concern the employees of our customers (the organisation is the controller).
• E-mail (mailbox feature): login credentials for your IMAP/SMTP mailboxes and OAuth tokens (Microsoft/Google), e-mail content and metadata, attachments, contacts.
• Communication: team chat messages, support requests.
• AI assistant memory: remembered commitments, deadlines and summaries (including those extracted from correspondence).
• Conversations with AI assistants: the content of conversations with the HUBAL Assistant and your organisation's AI assistants, conversation topics together with their instructions, as well as the profiles of AI assistants created by the organisation (name, role, instructions, settings).
• Social media (integration): if your organisation switches on the social media integration, we also process the content of posts, the attached images and videos, and the identifiers, names and avatars of the connected accounts (Social Media Integration Terms).
• Add-ons (e.g. Media Kreator): if your organisation switches an add-on on, we also process the data described in its Add-on Terms — in Media Kreator these are instructions, input materials, outputs and voice samples and clones (Media Kreator Add-on Terms).
• Voice data: the audio stream from the microphone when you use the voice assistant.
• Photos: images from the camera/gallery when you add them in the application.
• Calendar: events created/read as part of the Google Calendar integration.

4. Purposes and legal bases (Art. 6 GDPR)

Where we rely on legitimate interest, we have carried out a balancing test (you may request a summary of it).

5. Retention periods

6. Recipients and processors (sub-processors)

We use trusted providers acting on our instructions (data processing agreements, Art. 28) or as independent controllers within their own scope. We make the current list of sub-processors available on request.

We do not sell data or share it for cross-site advertising purposes.

7. Transfers of data outside the European Economic Area

Your data is stored in the European Union (Google Cloud, region europe-central2 in Warsaw). However, certain operations involve a transfer to the USA:

• the voice assistant feature — the audio stream is processed by Google (Gemini Live) outside the EEA (incl. USA);
• AI features using Claude models (incl. conversations with AI assistants, analyses, "Multi-AI") — Anthropic (USA);
• sending of platform e-mails (notifications, verifications) — Resend (USA);
• the AI assistant's web search — Brave Search (USA); photo and GIF search — Pexels, Giphy (search phrase only);
• handling of payments and invoices — Paddle (United Kingdom);
• Google LLC as a group entity in the USA.

We base these transfers on: an adequacy decision of the European Commission — for the USA under the EU-US Data Privacy Framework (certified providers, including Google), and for the United Kingdom on the basis of the EC adequacy decision for the UK (2021) (Paddle) — as well as on Standard Contractual Clauses (SCC) together with additional safeguards. You may obtain a copy of the safeguards by writing to the address in Section 1. We do not base transfers on the invalidated "Privacy Shield" mechanism.

Social media integration. Transfers in the integration — at the intermediary Zernio, including to the United Kingdom and the USA — are described in the Social Media Integration Terms. They apply only to organisations that have switched the integration on.

Add-ons. Transfers in add-ons — e.g. in Media Kreator, where some models process data outside the EEA — are described in their Add-on Terms (Media Kreator Add-on Terms). They apply only to organisations that have switched the given add-on on.

8. Data security

• Encryption in transit: TLS 1.3 for all communication.
• Encryption at rest — two layers: (1) the entire database and file storage are encrypted with AES-256 at the Google Cloud infrastructure level, using keys managed by Google; (2) in addition, selected sensitive data is encrypted at the application layer (AES-256-GCM) with your organisation's key, protected by our master key in Google Cloud KMS — this covers the content of e-mail messages together with their AI summaries, project names, note content, the financial profile, invoice data, document excerpts used by AI, the instructions of Media Kreator jobs, and the instructions of AI assistants' work orders and recurring tasks. Some fields are encrypted directly upon write, others within a fraction of a second after write (a server-side re-encryption mechanism). Login credentials for your mailboxes are encrypted with a separate key on the e-mail service side.
• Access control: permission restrictions, two-factor authentication for the platform's administrative personnel, monitoring.
• Personnel access: in justified cases (technical support, security, diagnostics) authorised HUBAL personnel may access content — to the minimum extent necessary, under the terms of the data processing agreement and with such access being logged (who, when, for what purpose).
• In all honesty: HUBAL does not use "end-to-end / zero-knowledge" encryption — under a model with keys held on our side, we have the technical ability to decrypt data in the above, controlled cases. We do not claim otherwise.

9. Integrations

• Google / Microsoft sign-in: basic scope (e-mail, profile) to create/authenticate the account.
• Google Calendar: with your consent, we create/read events corresponding to tasks; from the calendars you select in the Calendar widget we read the title and time of events to show them in your view; we do not read the content of private events beyond the title/time; we do not store a copy of the calendar.
• Google Tasks: only if you switch this option on and grant a separate Google permission, we read (read-only) the title, due date and status of your tasks due in the viewed month and show them only to you in the Calendar widget; we do not store them on our servers or share them with anyone. You can withdraw consent by switching the option off or in your Google Account settings.
• Use of Google data (Google Calendar, Google Tasks) complies with the Google API Services User Data Policy, including the Limited Use requirements: Google data is used only to display and sync it in HUBAL for the person who granted consent, it is not used for advertising, not sold and not used to train AI models.
• E-mail (IMAP/SMTP + Microsoft 365): to operate your mailbox, we store — in encrypted form — login credentials or OAuth tokens as well as e-mail content/metadata. You can disconnect access to the mailbox at any time.
• External AI assistants (MCP): if you connect your own assistant (e.g. Claude, ChatGPT, Cursor) to HUBAL, then on your instruction it retrieves from the Platform the data it asks for and passes it to its provider under your agreement with that provider — HUBAL is not a party to that agreement and does not control the further processing. Connecting requires your consent in the Platform; the list of connections and the disconnect button are in Settings → Integrations. For each connection we store the client identifier, the time and call-count statistics (no query content). The organisation administrator may connect an external assistant (or issue an access key) on behalf of one of the organisation's AI assistants — actions are then signed by that assistant and limited to its permissions.
• AI assistant: see Section 10.

10. Artificial intelligence (AI)

• AI assistants: HUBAL includes built-in assistants (the HUBAL Assistant, the Alerts Assistant) and AI assistants created by the organisation — with a name, role and instructions set by the administrator. All of them are AI systems, not humans.
• Permission boundaries: an AI assistant acts within the permissions of the person talking to it — it will not show that person anything they cannot see themselves, and it presents changes requiring approval to them for confirmation. In a group chat, the assistant sees only what all participants can see and writes nothing. The assistant performs background work within the permissions granted to it, and proposes changes requiring approval to the person who ordered the work. The assistant reads other people's working time and absences only for the organisation administrator or a person with HR permissions.
• What we send and to whom: to fulfil your request, we pass the necessary context to the AI provider — the text of the request, the instructions of the assistant and of the conversation topic, excerpts of project content/documents, and for the voice assistant the audio stream, for e-mail features the content of e-mails. The main provider is Google (Gemini via Vertex AI). Anthropic (Claude) processes data in features for which a Claude model has been selected — chosen by the organisation administrator in the AI model settings or in the AI assistant's profile (some assistant templates use Claude by default); this includes conversations with assistants, analyses, task time estimation and the "Multi-AI" verification.
• Add-ons: the AI features of add-ons (e.g. generating images, clips, voice-over and music and cloning voices in Media Kreator) work only in organisations that have switched the add-on on; the providers, locations and the rules for voice cloning and for labelling AI content are described in the Media Kreator Add-on Terms.
• File tasks (sandbox): when you ask the assistant to process files (e.g. rotate or merge PDF pages, turn a PDF table into Excel, convert a file, chart a spreadsheet), we pass the whole selected files to Anthropic. A Claude model performs the task in the provider's isolated environment (with no internet access) — also in organisations that chose Gemini for conversations. The provider keeps the data of that environment (input files and results) for up to 30 days; we delete the files passed to the task and the downloaded results from its file storage as soon as the task ends, and we save the results in HUBAL, in the conversation files.
• Location: Gemini text features run in the EU (Vertex AI, EU endpoint); the voice assistant and Claude models (including file tasks) — outside the EU (transfer as in Section 7).
• Model training: with Google and Anthropic we use commercial API variants in which the providers do not use your data to train their models. The rules of add-on providers are described in the Add-on Terms.
• Improving estimates (anonymised data): to improve task time estimation, we create anonymised data from data about their completion — aggregated statistics and transformed (paraphrased) task descriptions, stripped of names, identifying data, the organisation's name and the original content. Data anonymised in this way does not allow a person or company to be identified, and the original content of tasks is not shared with other organisations. You can opt out of your organisation's participation in creating this data in the settings.
• Assistive nature: AI outputs are of an assistive nature and may contain inaccuracies — verify them before use. We do not make automated decisions producing legal effects concerning you (Art. 22 GDPR).

11. Cookies and local storage

Our application does not use cookies for tracking or advertising. We use only first-party local storage (localStorage) in your browser/device, for purposes necessary for the operation of the service (maintaining the login session, preferences, the selected organisation/project, recording your consent). Such storage is covered by the rules on storing information in terminal equipment, but as necessary storage it does not require consent.

We currently do not conduct web analytics or use marketing tracking technologies. If we enable them in the future (e.g. statistics), we will first ask for your consent and update this Policy as well as the separate Cookies Policy.

12. Your rights

You have the right to: access (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and withdrawal of consent at any time (without affecting the lawfulness of prior processing).

To exercise your rights — write to privacy@hubal-project.com or use the privacy settings in the application (including data export and deletion). We respond without undue delay, at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

Providing the data necessary to create an account and provide the service is voluntary, but required to use HUBAL.

13. Mobile application (Android)

The HUBAL mobile application for Android delivers the same service as the web version, using additional system permissions — each required only with your consent granted in the system (the Android 6.0+ runtime permissions model).

13.1. Permissions and data collected by the mobile application

13.2. What we do NOT collect

• Location (GPS, network) — we do not collect it
• Contacts — we do not collect them
• SMS messages — we do not collect them
• Activity in other applications — we do not collect it
• Advertising identifiers (Advertising ID) — we do not use them
• Body sensors (BODY_SENSORS, ACTIVITY_RECOGNITION) — we do not use them

13.3. Security in the mobile application

• All communication with HUBAL servers over HTTPS / TLS.
• Session tokens (Firebase Auth) stored in the application's isolated storage (the Android app sandbox — inaccessible to other applications).
• External URLs are opened in the system browser, outside the application.

13.4. Revoking permissions and deleting data

• You can revoke each permission in Settings → Apps → HUBAL → Permissions.
• To delete local data — Settings → Apps → HUBAL → Clear data (logs/cache) or uninstall the application.
• To delete your account and Customer Content from the server — via the application (Settings → Privacy → Your data → Delete my data and account) or by e-mail to support@hubal-project.com. Details in Section 12.

13.5. Google Play Data safety

The HUBAL application is published on Google Play. The 'Data safety' section in the Play Console contains a concise, standardised summary consistent with this Privacy Policy. The full document containing the detailed declarations for Play Data safety is available in the Data safety Sheet.

14. Children

The service is intended for businesses and professionals and is not directed at children. It is not intended for persons under 16 years of age, and we do not knowingly collect data of such persons.

15. Rights of US users (state-law addendum)

If you use HUBAL in the USA: we collect the categories of data described above for the purposes of providing the service and security; we do not "sell" or "share" personal data within the meaning of the California CCPA/CPRA or other state laws. You have the right to information, access, correction and deletion of data — we fulfil these through the channel described in Section 12. We currently do not respond to the "Do Not Track" signal, because we do not conduct cross-site tracking.

16. Changes to the Policy

We may update this Policy. We will inform you of material changes in advance (by e-mail or in the application). Each version has a number and a date; we make previous versions available on request.

17. Contact

For data protection matters: privacy@hubal-project.com · ANTONI SUROWIAK EMA STUDIO, ul. Westerplatte 6, 38-200 Jasło.