Effective Date: October 20, 2026 · Version: 1.6

This Privacy Policy explains how Hubabble handles personal data when you visit our website, sign up as a coach, take part in the Hubabble Community, or use the Hubabble platform. It is written for the people who trust us with sensitive information, and we have tried to keep it plain. Where the law requires specific language, we use it, and we flag the legal mechanics so they are easy to find.

If you are a person being coached (a "client") who reached Hubabble through a link your coach sent you (to book a session, sign an agreement, pay, or view a receipt), please read the section "If you are a client of a coach" first. Your coach, not Hubabble, decides how your information is used.

If you joined Hubabble to take part in the Community (for example, as a student, graduate, or trainer whose access a partner training organization sponsors), the section "If you are a member of the Hubabble Community" explains who can see what you share and what a sponsoring partner does and does not receive.

1. Who we are

Hubabble is a business-in-a-box platform for coaches. It bundles scheduling, video sessions, a simple client relationship manager, transactional email, payments, e-sign documents, and coach website templates.

The company behind Hubabble is Hubabble, LLC, a member-managed multi-member limited liability company organized under Oregon law.

Principal office and notice address: 403 Portway Avenue, Suite 300, Hood River, Oregon 97031, United States.
Privacy and legal contact: privacy@hubabble.com

When this policy says we are a controller, we mean we decide why and how the personal data described is processed. When it says we are a processor, we mean we handle personal data on a coach's documented instructions, and the coach is the controller. The split between these two roles is the spine of this policy, so we set it out in full in the next section.

2. The two roles: when we are a controller and when we are a processor

Hubabble handles personal data in two different capacities, and your rights and our duties differ depending on which one applies.

We are the controller of:

Information about coaches and the accounts they run (identity, login credentials, billing, support history).
Information about members of the Hubabble Community, including members who are not coaches: their Community profile, what they post, the private messages they send, how they take part, and the records we keep to run and moderate the Community. Where a partner training organization appoints admins and moderators for its own community, they act under Hubabble's rules; section 16 explains what they can see and how we will tell you before that starts.
Information about visitors to our website and marketing pages.
Operational and security telemetry about how the platform is used.

For all of the above, Hubabble decides the purposes and means of processing, and this policy governs.

We are a processor for the personal data a coach collects about their own clients inside Hubabble: client names and contact details, session history, intake answers, free-form notes, signed agreements, payment receipts, and similar. For that data, the coach is the controller. The coach decides what to collect, why, and for how long. Hubabble holds and processes it on the coach's behalf, under the coach's instructions.

Clients touch Hubabble surfaces directly through tokenized links their coach sends (to book, sign, pay, or view a receipt). Even though a client interacts with our systems directly, they are doing so on their coach's behalf, and the coach remains the controller of that client data. Hubabble's own role toward that client data stays that of a processor.

Stripe is a special case and plays two roles at once. When Hubabble or a coach uses Stripe to process a payment, Stripe acts as a subprocessor on the coach's (or our) behalf for that transaction. Stripe is also an independent controller in its own right for its own purposes, such as fraud prevention, regulatory and anti-money-laundering compliance, and meeting its legal obligations as a payments company. We state Stripe's dual role identically wherever it appears in our documents: Stripe acts as a subprocessor when it processes payments on the coach's behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes. Stripe's own privacy notice governs the controller side of what it does.

KLIPY, the service that supplies GIFs in the Community, is a second exception. When you search for or view a GIF, your browser sends your IP address, browser details, and search terms straight to KLIPY, and KLIPY uses them as an independent controller under its own privacy policy, not only on our behalf. Section 5 explains what it receives.

3. The personal data we collect (as controller)

This section covers data for which Hubabble is the controller. For client data, see "If you are a client of a coach."

Coach identity and authentication

When you sign up as a coach, we collect your name, email address, the name of your coaching practice, and the credentials you use to log in. We use a third-party authentication library to manage sessions and passwords, and we store hashed credentials and session records, never your plaintext password. If you connect your Google Calendar, we also process the Google account data described in the Google user data section below. If you connect your own Zoom account, we also process the Zoom account details described in the Zoom section below.

Billing data (platform subscription)

When you subscribe to a paid Hubabble plan, our payments provider collects and processes your payment details to charge you. We receive and store limited billing metadata (such as your plan, subscription status, the last four digits and brand of your card, and invoice records). We do not store full card numbers ourselves; the payments provider does.

Support and correspondence

When you email us, fill in a form, or otherwise contact us, we keep what you send and our replies so we can help you and keep a record of the conversation.

Usage and telemetry

To keep the platform fast and reliable, we collect technical and usage information through our hosting and edge provider, including performance measurements via that provider's Speed Insights telemetry (for example, page-load timing and basic device and browser characteristics). We use this to find and fix slow or broken pages, not to build advertising profiles.

We also use PostHog to find errors, see how Hubabble is used, and fix what is confusing. Its analytics and session replay run only inside the signed-in dashboard (where coaches run their practice and where members take part in the Hubabble Community); a few records come from our servers instead, as described below. Here is what that means in practice:

Where it runs. The analytics and session replay run only in the dashboard you reach after signing in to your own account. They never run on the links coaches send their clients (to book, sign, pay, or view a receipt), on our marketing site, on coaches' websites, or while a Hubabble staff member is viewing your account for support.
What it records. Which dashboard pages you visit and what you click, with all on-screen text and link targets hidden, along with basic browser and device details and the IP address each request comes from (which PostHog can use to estimate an approximate location); and session replays, which show how a page was used. A replay shows the app itself (its buttons, headings, labels, and menus) but masks everything typed into a form or editor; people's names wherever the app shows them (yours, your clients', and other members'); email addresses and phone numbers; your practice name, site address, and domains; and what members post (threads, replies, captions, and comments), notes, feedback, and conversations with Robin. The names you give the parts of your practice and community, such as session types, spaces, labels, and post or email titles, are shown as part of the app, so a name typed into one of those would show too. Images, video, and embedded frames (such as payment fields and the video room) are blocked. Some pages are never recorded at all: your clients, sessions, documents, payments, messages, and Community messages. Web addresses are sent without the details after the page name, record ids are replaced, page titles are left out, and for the page you came from we keep only the website it was on.
Errors. When something breaks, in your browser or on our servers, we record the type of error, which page or operation it happened in, and where in our own code it happened. We never send the error message, what you typed, or your request's contents, headers, or full web address.
A few milestones from our servers. When you sign up, finish onboarding, have a session booked, or join a community, we record that it happened, with ids and simple values only (for a signup: which plan and whether a partner code was used; for a booking: whether it was paid, how the video is set up, and where it was booked from; for a community: how you joined). Nothing about your clients is ever sent.
Apps you connect. When an app you connected connects to or uses a Community tool, our servers record which tool it called, whether it worked (and, when it didn't, a general reason such as "not found" or "not allowed"), how long it took, which app called it (and that app's software name, version, and identifier), the names of the fields it filled in (such as "query", never what it typed), how much came back (its size and how many items, never the content), a random id that groups the calls of one conversation with the app, a short reason the app gives for the call, and your user id, never what was asked or what came back. We ask the app to describe only the purpose of the call, with no names and nothing a member wrote, and we remove email addresses and phone numbers and cut that reason to 200 characters before it is sent; we can't check it for every name. When the app gives no reason, we record the tool's own title instead. When such an app tells us there was something it couldn't do for you, PostHog also receives a short label the app wrote for what was missing. We ask the app to keep that label to a few words about the missing ability, with no names and nothing a member wrote, and we remove email addresses and phone numbers and cut it to 80 characters before it is sent; we can't check it for every name. The app's full report stays in Hubabble's own feedback system.
AI reliability and operational logs. Our servers record which AI feature and model ran, whether it worked, how long it took, how many tokens it used, and its cost when available. Internal user, account, conversation, and job ids connect related records. We also record whether server operations and background jobs completed or failed. These records never contain prompts, AI answers, uploaded audio, transcripts, request contents, or raw console messages.
How you are identified. By your internal Hubabble user id, with four details about your account: whether you are Hubabble staff, your role on the account, your subscription status (for example, trialing or active), and whether you are on the free Community plan. Never your name or email address.
Nothing left on your device. PostHog sets no cookies and leaves nothing in your browser's local or session storage; it keeps what it needs in memory and forgets it when the page is closed or reloaded. When it starts, its script does check your browser's storage for its own settings (such as an opt-out or debug switch) and whether storage works, without keeping anything there. It reaches PostHog through our own web address, which never passes on your sign-in cookie or the full address of the page you are on.
Your clients' information never goes to PostHog.

We use the same tool to turn new features on for a few people before everyone. The checks that decide what you see run on our own servers and send nothing about you to PostHog. Separately, while you use the dashboard, its script asks PostHog for its settings using the same user id and account details described above.

When you visit our website, we collect minimal technical information needed to serve the site and keep it secure, such as your IP address, the pages you view, and basic browser and device information. We aim to keep non-essential cookies to a minimum.

Community data

If you take part in the Hubabble Community, we collect and hold:

Your Community profile: your name, your photo if you add one, a short bio, and, in a community that uses them, your labels (up to three you chose, such as "Student," and any a moderator gave you, such as "Trainer"), which other members can see.
What you share: posts, replies, reactions, and any attachments, along with when you shared them and in which space.
Messages: the private messages you send and receive in the Community's Messages (including the files and photos you attach and any GIFs, and for each file its name, type, and size and the result of its malware scan), when each was sent, edited, or deleted, the emoji reactions people leave on messages (who left which one, and when), who is in each conversation and who added them, the name of a conversation with several people, whether you accepted, ignored, or left it, when you last read it ("Seen" in a one-to-one conversation), and whether you muted it or removed it from your inbox. Also the people you have blocked, your choice of who can send you message requests in each community, and whether you show when you have seen messages.
How you take part: which communities and spaces you belong to, which posts you have read (so we can show you what is new), and your Community email preferences. Where a partner's community has house rules, which version you accepted and when, once that community asks you to accept them.
How you joined: whether we or a community's admin added you to a space or you redeemed a join code, who added you or which code, and when. Where a partner training organization sponsors your access, we also hold the partner's name and the class or group you belong to.
Reports and moderation records: reports you make or that are made about your content, the content involved, and the actions moderators take (including which moderator took them and when). When someone reports a message, we keep a copy of that message and up to 10 messages before it in the same conversation that the person reporting could see, with the names of the people in it at the time, and a record of each time a member of the Hubabble team opens that copy.
If you are a community admin or moderator: that role, who granted it and when, and the actions you take in it.
Notification records: the emails we send you about Community activity (replies, announcements, and unread messages), the frequency and on/off choices you make, and delivery events for those emails; and the short in-app list of notifications about replies to your threads and replies and reactions to your posts (who, on which post, and when; never the words of a reply).
Staff feedback triage. Authorized Hubabble platform staff can separately connect a support app to read feedback reports across accounts, including reporter names, internal staff notes, and unpublished reply drafts, change report statuses, add internal notes, and publish updates to reporters. The app receives the report content staff asks it to read. This staff permission stays authorized with the connection until revoked, is checked against the staff member's current role on every request, and can be revoked by disconnecting the app. It does not include separate reporter email fields, screenshots, console logs, client records, billing records, private Community messages, or separate platform administration powers. Text a reporter included in a report can itself contain personal information. This is a staff support workflow, separate from an app a Community member chooses for their own use in section 16. Staff actions record the acting staff member and connected app; our tool-call analytics do not receive report text, notes, drafts, or the app's free-text reason for a staff feedback call.
Staff join-code management. Authorized Hubabble platform staff can separately allow a connected app to read join codes and their destinations across communities, create ordinary space codes with optional use and expiration limits, change those settings, and permanently revoke codes. This permission does not include changing a code's destination or partner pricing. It persists with the connection until revoked and is checked against live staff access and consent on every request. Changes record the acting staff member and connected app. Tool-call analytics do not receive code values, labels, or the app's free-text reason for a staff call.
Apps you connect: if you connect an app to your account (see "An app you connect" in section 16), a record of the connection: the app's registration, the access keys we issue to it, the permissions you allowed, and a log of each request it makes (which app made it, which tool it used, when, how long it took, whether it succeeded, how many items it returned, and a fingerprint of the request's details so repeated requests can be recognized). The log never holds the content the app read or the words of what you asked it. If the app tells us it couldn't do something you asked, we keep its report (what it says you asked for, what it tried, and what would have helped) in our own feedback system, filed under your account, so our team can add what's missing.

Please do not share sensitive information about yourself in the Community unless you are comfortable with other members seeing it, and never share information that identifies a client. That goes for Messages too: the people you message can read and keep what you send. The Terms of Service and the Community Guidelines explain that rule.

We do not knowingly collect special-category (sensitive) personal data about coaches or Community members as part of running their account. Sensitive client data is addressed in the client and special-category data sections.

For coaches, visitors, and others in the UK, EU, or EEA, the law requires us to identify a lawful basis for each purpose. The table below sets out the main purposes and the basis we rely on.

Purpose	Personal data used	Lawful basis (UK / EU GDPR)
Create and run your coach account; provide the platform's features	Identity, authentication, account content	Performance of a contract (Art. 6(1)(b))
Charge you for a paid plan; keep billing records	Billing metadata, invoice records	Performance of a contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c))
Authenticate you and keep your account secure	Authentication data, security telemetry	Legitimate interests in securing the service (Art. 6(1)(f)); contract (Art. 6(1)(b))
Provide calendar and scheduling features you connect	Google Calendar data (see Limited Use)	Performance of a contract (Art. 6(1)(b)); your consent to connect the integration
Create a Zoom meeting on your own Zoom account for each session, if you connect Zoom	Your Zoom account details and the meeting details described in section 11A	Performance of a contract (Art. 6(1)(b)); your consent to connect the integration
Answer your support requests	Support correspondence	Legitimate interests in helping you (Art. 6(1)(f)); contract (Art. 6(1)(b))
Keep the platform fast, reliable, and secure	Usage and performance telemetry	Legitimate interests in operating and improving the service (Art. 6(1)(f))
Find and fix errors, understand how the signed-in dashboard is used, and turn new features on for a few people first (PostHog, described in section 3)	Your internal user id, staff status, account role, subscription status, and whether you are on the Community plan; the IP address requests come from, and basic browser and device details; masked page views, clicks, and session replays from the dashboard; error reports without messages or anything typed; a few product milestones; and metadata about calls from apps you connect, with the app's short reason for each call (up to 200 characters) and a short label when it reports something it couldn't do (up to 80 characters), both with email addresses and phone numbers removed	Legitimate interests in operating, fixing, and improving the service (Art. 6(1)(f)), balanced by masking, dashboard-only use, and never sending your name, email address, or client information (an app you connect writes its own reason for a call or short label about something it couldn't do; we ask it for no names and remove email addresses and phone numbers, see section 3)
Send service and transactional emails (confirmations, receipts, password resets, security notices)	Identity, account events	Performance of a contract (Art. 6(1)(b)); legal obligation where applicable
Run the Hubabble Community: show your profile and posts to the members who share a space with you, keep track of what you have read, and let you take part	Community profile, posts, replies, reactions, read state, space membership	Performance of a contract (Art. 6(1)(b))
Deliver Messages: send your messages to the people in the conversation, handle message requests and blocks, show "Seen" in a one-to-one conversation when you both have it on, and email you when a message waits unread	Messages and the files and photos you attach, conversation and participant records, request and read state, blocks, your Messages settings	Performance of a contract (Art. 6(1)(b))
Let Community members search for GIFs and add them to posts and messages, which means your browser contacts KLIPY when you search for or view a GIF	Your IP address, browser details, GIF search terms, and which GIFs load (sent by your browser to KLIPY)	Legitimate interests (Art. 6(1)(f)): letting members add GIFs to their posts and messages
Confirm who may join a Community space (join-code redemption, a sponsoring partner's class or group membership)	Identity, join-code redemption records, partner and group membership	Performance of a contract (Art. 6(1)(b)); legitimate interests in keeping spaces limited to the people they are for (Art. 6(1)(f))
Send Community emails: reply emails at the frequency you choose, announcement emails from an announcements space you belong to, and emails letting you know a message is waiting (who sent it and in which community, never what it says)	Identity, Community activity, notification preferences	Performance of a contract (Art. 6(1)(b)) for reply and unread-message emails you keep on; legitimate interests in keeping members up to date (Art. 6(1)(f)) for announcement emails, which you can turn off at any time
Moderate the Community, handle reports, and keep members safe	Reports, the content reported (for a reported message, the copy of it and up to 10 messages before it), moderation records, Community access status	Legitimate interests in a safe and lawful Community (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c))
Let an app you choose, such as an AI assistant, read the Community on your behalf and, if you allow it and hold the role, act as you there	Your Community profile, the posts and replies in spaces you can read, and, if you hold an admin or moderator role, the reports, moderation record, join codes, spaces, and members list that role can see; only if you give the app that separate permission when you connect it, your Messages, including what other people sent you; and the records of the connection described in section 3	Your consent to connect the app (Art. 6(1)(a)), which you can withdraw at any time by disconnecting it; performance of a contract for keeping the connection working and logged (Art. 6(1)(b))
Handle questions and withdrawal requests about photos shared under the former partner photo sharing notice feature (see section 16)	The photos concerned and the retained notice and activity records	Consent (Art. 6(1)(a)) where previously given; withdrawal remains available at privacy@hubabble.com. New uploads do not give a partner permission for use outside the Community.
Improve Hubabble, including training or fine-tuning machine-learning models that power Hubabble features, using Community content (not done today; only after notice, with an opt-out; see section 16)	Community posts and replies (never private messages, never removed content, and never anything identifying a coach's clients)	Legitimate interests in improving the service (Art. 6(1)(f)), balanced by advance notice and an opt-out; consent where the law requires it (Art. 6(1)(a))
Comply with law, respond to lawful requests, and defend legal claims	As needed	Legal obligation (Art. 6(1)(c)); legitimate interests in establishing or defending claims (Art. 6(1)(f))

Where we rely on legitimate interests, you can ask us to explain our balancing assessment, and you have the right to object (see your rights). Where we rely on consent (such as connecting an integration or an app, or permission previously given under the former partner photo sharing notice feature), you can withdraw it at any time without affecting processing that already happened.

Whether you have to provide this data (Art. 13(2)(e)). Providing your account, identity, and billing data is a contractual requirement: we need it to create your coach account, charge you for a paid plan, and operate the service for you under our Terms of Service. If you do not provide it, we cannot create or run your account or process your payments. Optional fields and operational or performance telemetry are not a contractual requirement, and choosing not to provide an optional field does not stop us from running your account, though it may limit specific features you have asked for (for example, calendar scheduling without a connected calendar).

Where your data comes from when you did not give it to us directly (Art. 14). Most of the personal data we hold about you, we collect directly from you when you sign up and use the platform. In some cases we may also receive coach or prospective-coach information from a third party, such as a certification or referral partner through which a coach reaches Hubabble (for example, your name and email so we can set up an account for you through your certification program). A partner training organization that sponsors Community access may also tell us which of its students, graduates, or trainers belong to a class or group, so that we can add them to the right Community space or issue a join code to that group. Where we receive your data from a source like this, the categories are the same identity, contact, and group-membership details described in section 3, and we use them for the purposes and on the lawful bases set out in this section.

We do not use coach or client content to train external machine-learning models. Community content is handled differently, as section 16 explains. We do not sell personal data, and we do not share it for advertising ourselves. One thing to know: when you search for or view a GIF in the Community, your browser sends your IP address and search terms straight to KLIPY, and KLIPY's own privacy policy lets it use them for advertising. We do not turn on KLIPY's ads. See the KLIPY row in section 5.

We keep the list of third parties small and use them to run the service, not to monetize you. Each one processes personal data only as needed to do its job, under contract, except where a row below says otherwise (KLIPY, which supplies GIFs in the Community, uses what it receives under its own privacy policy).

The Subprocessor List is the single canonical list of the third parties we use. The table below is a convenience summary, and the Subprocessor List takes precedence. Rows marked FUTURE / not yet active describe capabilities we are building: the data is not flowing to those providers yet, and we will update the status before it does.

Subprocessor	What it does for us	Status / notes
Neon	Hosts our Postgres database (the system of record)	Live. Stores account and platform data
Vercel	Hosts and serves the application and website (edge and compute); provides Speed Insights performance telemetry	Live
Stripe	Processes platform subscription billing	Live. Dual role: Stripe acts as a subprocessor when it processes payments on the coach's behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes
Your video room provider	Powers white-labeled video sessions	Live. The provider is never named to coaches or clients; in coach- and client-facing surfaces we say "video session" or "your video room"
Google	Provides the per-coach Calendar integration	Live for coaches who connect their calendar. See Limited Use
Zoom	Creates, moves, and deletes a Zoom meeting on a coach's own Zoom account for each booked session	Only for coaches who connect their own Zoom account. Receives the meeting details in section 11A, never a client's email address. See section 11A
Resend	Sends transactional and e-sign emails, and Community emails: replies, announcements, and unread messages (the last never include what the message says)	Live. Our email provider can record delivery and engagement events such as opens and clicks where that is enabled
AWS S3 (AWS region us-east-1 (US East, N. Virginia))	Stores signed PDF documents, profile photos and practice logos, and Community attachments, and scans the files and photos you attach in Messages for malware (a file can be downloaded only once the scan finds it clean; a photo shows right away and is removed if the scan finds something)	Live
Inngest	Runs background jobs (queued and scheduled platform tasks)	Live
Cloudflare	Provides DNS and inbound email handling	Live
Anthropic (AI model inference, reached through the Vercel AI Gateway)	AI-assisted support behind in-app feedback: drafting the reply you receive when we resolve a report, and reading a new report on arrival to gauge whether it has enough detail for us to act on	Live. Receives the text of a feedback report you submit, which may include personal data you type in, including any client details you choose to mention
Ably	Real-time delivery so our internal staff triage board updates live, and so Community spaces update live while a member has one open	Live. Carries only internal record identifiers and status signals (for the Community, which space and post changed, and, for Messages, which conversation has something new); never post or message bodies, the content of reports, or your clients' personal data
KLIPY	Supplies the GIFs members can add to Community posts and messages	Live. Your browser talks to KLIPY directly to search for GIFs and to load them, so KLIPY receives your IP address, browser details, the search terms you type, and which GIFs load. Viewing a post or a message that contains a GIF sends your IP address to KLIPY, and there is no setting to turn GIFs off yet. We send KLIPY no name, email address, or account identifier, and we have no data processing agreement with it. It is an independent controller (our reading of its own stated collection and use): it uses what it receives under its own privacy policy, which allows advertising. We do not turn on KLIPY's ads
PostHog	Feature flags, error tracking, product analytics, and session replay for the signed-in dashboard (coaches and Community members)	Live. Receives your internal user id, staff status, account role, subscription status, and whether you are on the Community plan, the IP address requests come from and basic browser and device details, masked page views, clicks, and replays, error reports without messages or anything typed, a few product milestones, and metadata about calls from apps you connect, with the app's short reason for each call (up to 200 characters) and a short label when it reports something it couldn't do (up to 80 characters), both with email addresses and phone numbers removed. We never send it your name, email address, or your clients' information, apart from anything an app you connect puts in its reason for a call or short label about something it couldn't do (described in section 3), both of which have email addresses and phone numbers removed. Leaves nothing on your device
Stripe (client payments)	Processes your clients' payments to you through Hubabble	Imminent / not yet live. Same dual role: subprocessor when it processes client payments on the coach's behalf, and independent controller for its own fraud-prevention and legal-compliance purposes
Recording and transcription of video sessions	Optional session recording and (separately) transcription of recordings	FUTURE / not yet active. When chosen, the transcription provider will not be named to coaches or clients

We publish and maintain a current Subprocessor List as a companion to this policy, and that list is the canonical, authoritative source. Where the summary table above and the Subprocessor List differ, the Subprocessor List controls, including its live, imminent, and future split.

Other Community members are recipients too, though not subprocessors. Inside the Community, the members who share a space with you see your Community profile and what you post there, and the people in a conversation with you see the messages you send in it. A partner training organization that sponsors Community access receives nothing from the Community until Hubabble turns on admin and moderator roles for that partner's own community. Once that is on, the partner's admins and moderators can see, inside that community only, its members (name, photo, labels, Community profile), what is posted there, and reports about content posted there without the reporter's identity. They never see your email address, your account, billing, or practice data, anything about your clients, your Messages or reports about them, or anything from another community. Section 16 sets this out in full, including how we handle photos previously shared under the retired partner photo sharing notice feature.

An app you connect is a recipient too, and not a subprocessor. If you connect an app to your Hubabble account, such as an AI assistant, it receives what you ask it to read, which can include other members' posts in the spaces you can read and, only if you give it that separate permission when you connect it, your Messages, including what other people sent you, at your direction and under your own agreement with that app's provider. We do not send anything to it on our own, we cannot see or control what it does with what it receives, and disconnecting it ends its access. Other members' posts and messages reach that app only because you can read them, so treat what it shows you as you would the Community itself (Terms 9.4 and 9.11).

We also disclose personal data when the law requires it, to respond to lawful requests from public authorities, to enforce our terms, or to establish, exercise, or defend legal claims. If Hubabble is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will give notice as required.

We do not treat the following as recipients of your personal data, because they do not receive it in a form that identifies you: our icon library, our self-hosted web fonts, our internal webhook-delivery and secrets tooling. Future technologies are listed in section 12 and are not in use today.

6. International data transfers

Hubabble stores and processes personal data in the United States. If you are in the UK, EU, or EEA, your personal data is transferred to and processed in the United States and may be processed by the subprocessors listed above in the United States or elsewhere.

For transfers out of the EU and EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs). For transfers out of the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs, as applicable. We also rely, where available, on a subprocessor's certification under an approved transfer framework.

KLIPY is different: when you search for or view a GIF, your browser sends your IP address, browser details, and search terms straight to KLIPY (Kikliko, Inc., in the United States), which acts as an independent controller under its own privacy policy. No transfer agreement of ours covers that; KLIPY's own privacy policy describes how it handles transfers.

An app you connect is also different: it receives what you ask it to read, wherever its provider is, at your direction and under your agreement with that provider (see "An app you connect" in section 16). No transfer agreement of ours covers that; the provider's own privacy policy describes how it handles transfers.

You can ask us for more detail about the safeguards that apply to a specific transfer using the contact details above.

7. Your rights (EU, UK, and EEA)

If you are in the UK, EU, or EEA and we are the controller of your data, you have the right to:

Access the personal data we hold about you and get a copy.
Rectify inaccurate or incomplete data.
Erase your data in certain circumstances ("right to be forgotten").
Restrict processing in certain circumstances.
Portability: receive certain data in a structured, machine-readable format and have it sent to another controller where technically feasible.
Object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent where we rely on it, without affecting prior processing.

To exercise any of these, contact us at privacy@hubabble.com. We will respond within the timeframe the law requires (generally one month under the GDPR, extendable for complex requests). We will not charge a fee unless your request is manifestly unfounded or excessive, and we may need to verify your identity first.

You also have the right to lodge a complaint with your data protection authority. In the UK that is the Information Commissioner's Office (ICO). In the EU it is the supervisory authority in your country.

How to exercise these rights. To exercise these rights, contact privacy@hubabble.com and we will action your request within the timeframe the law requires.

Append-only records. Some records are kept in append-only form for integrity, audit, and legal reasons, and they survive a deletion request with identifying references removed or anonymized rather than the row being deleted. These include our events audit log, the financial ledger, records of legal acceptances, and executed signed agreements. We disclose this honestly: when you exercise erasure, these specific records persist in anonymized form, and we will tell you which categories were retained and why.

Erasure and your Community posts and messages. You can delete your own posts, replies, and messages at any time while you are a member. When you leave the Community or close your account, we remove your Community profile, and the posts and messages you left in place stay (posts in their threads, messages in the other people's conversations) with your name and photo removed and attributed to a former member, so other members' conversations stay intact. If you ask us to erase your data, we will also delete those remaining posts and messages, unless we need to keep a specific one for a legal reason (such as an active dispute or a moderation record), in which case we will tell you. Reports and moderation records about your content are kept for the period described in section 10, with your identifiers anonymized once your account is gone.

A message you delete disappears for everyone in the conversation. When you close your account or ask us to erase your data, we also take you out of every conversation, delete your Messages settings and the blocks you made, and delete any conversation nobody else can still read. (If you only leave a community, you simply lose access to its conversations.) If someone reported one of your messages, the copy kept for that report follows the report's retention in section 10, with your identifiers anonymized once your account is gone.

8. Your rights (United States: California and other states)

Notice at collection (California: CCPA / CPRA)

We collect the categories of personal information described in section 3: identifiers (name, email), commercial information (billing and subscription records), internet and network activity (usage and telemetry), the contents of your support communications, and, if you take part in the Hubabble Community, the profile and content you choose to share there (including a photo if you add one) and the messages you send and receive, together with the participation, join, moderation, and connected-app records described in section 3. We collect them for the purposes described in section 4, and we retain them as described in section 10.

No sale, no sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. One thing to know: if you search for or view a GIF in the Community, your browser sends your IP address and search terms straight to KLIPY, whose own privacy policy lets it use them for advertising. We do not turn on KLIPY's ads, and we do not receive anything from KLIPY in return. See section 5.

Sensitive personal information. Where we are the controller, we do not collect sensitive personal information about coaches for the purpose of inferring characteristics, and we do not use or disclose it beyond the purposes the law permits. Sensitive information clients provide to a coach (such as wellbeing or health-related intake answers) is controlled by the coach; see sections If you are a client and special-category data.

Your California rights. If you are a California resident, you have the right to know, access, correct, and delete your personal information, the right to opt out of sale or sharing (which we do not do), the right to limit use of sensitive personal information, and the right not to receive discriminatory treatment for exercising any right. To exercise these rights, contact privacy@hubabble.com. You may use an authorized agent, and we will verify your request as the law allows.

Other US state privacy laws

Several other US states have comprehensive privacy laws that give residents similar rights to know, access, correct, delete, and opt out of certain processing. We extend the substance of the rights above to residents of states where these laws apply.

Oregon Consumer Privacy Act (OCPA). Because Hubabble, LLC is an Oregon limited liability company, we call it out specifically. If you are an Oregon resident, the OCPA gives you the right to confirm whether we process your personal data, to access it, to obtain a list of specific third parties to whom we have disclosed personal data, to correct and delete it, to obtain a portable copy, and to opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell personal data or use it for targeted advertising. To exercise OCPA rights, contact privacy@hubabble.com.

Right to appeal a decision

If we decline to act on a privacy-rights request, you have the right to appeal that decision. This right is required by the OCPA and by most other US state privacy laws. To appeal, reply to our decision or email privacy@hubabble.com with the subject line "Privacy request appeal" and tell us which request you are appealing. We will respond to your appeal within 45 days of receiving it, telling you whether we will change our decision and explaining our reasons. If we deny your appeal, we will give you a way to contact your state Attorney General to submit a complaint. Oregon residents can contact the Oregon Department of Justice; residents of other states can contact their own Attorney General's office.

Consumer health data (Washington My Health My Data Act and similar laws)

Coaching can involve wellbeing and mental-health information. Where a coach collects wellbeing or mental-health intake answers through Hubabble systems, that information may qualify as "consumer health data" under the Washington My Health My Data Act (MHMDA) and similar laws in other states (such as Nevada and Connecticut).

If and where these laws apply, we commit that:

We do not sell consumer health data without a valid, separate written authorization that meets the law's requirements.
We do not use geofencing around any location that provides health-care services to identify, track, collect data from, or send notifications to consumers about their consumer health data.

Wellbeing and mental-health intake answers that a client provides to a coach are controlled by the coach. Hubabble processes that data only on the coach's instructions, as described in the client and special-category data sections.

9. Special-category (sensitive) personal data

Coaching often involves sensitive information. Client wellbeing and mental-health intake answers, free-form client notes and session notes, and (in the future) recordings and transcripts can reveal health or other sensitive details. Under the GDPR, these are special-category data (Art. 9) and need stronger protection.

For this data the coach is the controller, and the coach is responsible for having a valid basis to collect it, which in most cases means the client's explicit consent that is unbundled from other consents and can be withdrawn. Hubabble's role is to provide the tools and to process this data only on the coach's instructions.

We do not use special-category data for any purpose other than providing the service to the coach, and we never use it for advertising or sell it.

10. How long we keep data (retention)

We keep personal data for as long as your account is active and for as long as we need it for the purposes in this policy, then we work to delete or anonymize it. Billing and tax records are kept for the period the law requires.

Retention criteria by category (CPRA). California law asks us to state, for each category of personal information, the criteria we use to decide how long to keep it. Rather than fixed periods that we cannot yet enforce automatically across the board, we use these criteria:

Category	Criteria for how long we keep it
Identity and account data (name, email, practice name, login records)	Kept while your account is active and for a short wind-down period after closure; then deleted or anonymized once it is no longer needed to operate or close your account.
Billing and subscription records (plan, status, card brand and last four, invoices)	Kept for the period tax, accounting, and financial-recordkeeping law requires, which is typically several years, then deleted.
Support and correspondence	Kept for as long as needed to resolve and keep a record of the matter, and to handle related follow-up or disputes, then deleted or anonymized.
Usage, performance, and security telemetry	Kept for the shorter period needed to operate, secure, and troubleshoot the service, then deleted or aggregated so it no longer identifies you.
Dashboard analytics, session replays, and error reports held by PostHog	Session replays and usage events are deleted automatically when the retention period set for our PostHog project ends. If you ask us to erase your data, we also delete your PostHog profile together with its events and replays. An error report from our servers carries your user id only when the error happened in something you were doing while signed in; the others carry no identifier at all.
Documents and signed agreements	Document files are retained until the coach-stamped "purge after" date, when set, removes them; executed signed agreements are retained in append-only form for legal-defense and integrity reasons (see below).
Community profile (including any labels), posts, replies, reactions, and attachments	Kept while you are a member. Your profile is removed when you leave. Posts you deleted are gone; posts you left in place remain, attributed to a former member, until you ask us to delete them (see section 7).
Messages (the messages, the files and photos you attach, the reactions on them, and who is in each conversation)	Kept while the conversation exists. A message you delete loses its words, files, photos, and reactions straight away; the conversation shows that a message was deleted, by whom, and when. Removing a conversation from your inbox does not delete it for anyone else. Messages you left in place follow the same rule as posts: attributed to a former member when you leave or close your account, and deleted if you ask us to erase your data (see section 7). When we handle an account closure or erasure request, we also delete any conversation it leaves that nobody can still read. We do not yet delete abandoned conversations on a schedule.
The copy kept when a message is reported (the message and up to 10 before it)	Deleted 180 days after the report is resolved, or 365 days after it was made if it is never resolved.
Blocks and your Messages settings	Kept until you unblock or change them, or until your account is gone.
Community read state and email notification records	Kept while you are a member for the short period needed to show you what is new and to deliver notifications, then deleted. In-app notifications are deleted 90 days after their last activity.
Join-code redemption, community- and space-membership records, house-rules acceptances, and community admin or moderator roles	Kept while you are a member of the community or space and for a short period after, so we can answer questions about how you joined and who acted, then deleted or anonymized.
Your Zoom connection (the access tokens, and your Zoom user ID, account ID, and email address) and the Zoom meeting IDs and join links kept with your sessions	Kept while Zoom is connected. Disconnecting Zoom in your Hubabble settings deletes the tokens and your Zoom account details; the meeting IDs and join links stay with your sessions. If our access to your Zoom account stops working on its own, we delete the same details and ask you to reconnect. Removing Hubabble from your Zoom account deletes the same details and also clears the meeting IDs. Either way, join links stay with sessions already booked, so your clients can still join (see section 11A). Meeting IDs and join links that remain are kept until your account is closed, and everything above is deleted when your account is closed. One exception: when Zoom tells us that Hubabble was removed from your Zoom account, we keep a record of that notice as an integrity record, so a repeated notice from Zoom is not processed twice. The record is a one-way hash of the notice (our app's ID at Zoom, your Zoom user ID, and the time Zoom gives for the removal), so your Zoom user ID is not stored in readable form. Zoom sends that notice when you remove Hubabble in the Zoom App Marketplace. Zoom may also send us a removal notice after you disconnect in your Hubabble settings; it is handled the same way. That record is kept even after your account is closed; you can ask us to delete it at privacy@hubabble.com.
Connected-app records (the connection, its access keys, and its request log)	Access keys expire on their own, and disconnecting an app deletes them and your permission for it. The request log is kept while your account exists; when you close your account or ask us to erase your data, it is deleted or anonymized.
Community reports and moderation records	Kept for as long as needed to handle the report, apply and review the outcome, and handle any dispute or repeat-behavior pattern, then deleted or anonymized. Your identifiers are anonymized once your account is gone.
Append-only integrity records (audit events, financial ledger, legal-acceptance records)	Retained for integrity, audit, and legal-defense reasons; on erasure, identifying references are anonymized rather than the row deleted (see below).

We want to be honest rather than aspirational about deletion:

As noted in section 7, certain append-only records (the events audit log, the financial ledger, legal-acceptance records, and executed signed agreements) are retained in anonymized form even after a deletion request, for integrity, audit, and legal-defense reasons.

11. How Hubabble uses Google user data (Limited Use)

If you connect your Google Calendar to Hubabble, we access a limited set of Google user data to provide calendar and scheduling features. This section describes that use and our compliance with Google's Limited Use requirements.

Scopes we access:

https://www.googleapis.com/auth/calendar.events (to read and write calendar events so scheduling, availability, and session bookings work). This is a sensitive Google API scope.
https://www.googleapis.com/auth/calendar.readonly (to read your calendars and existing events so we can show your availability and avoid double-booking). This is a sensitive Google API scope.
userinfo.email (to identify your connected Google account by email).
userinfo.profile (to identify your connected Google account by basic profile).

How we use this data:

We use Google user data only to provide and improve the user-facing calendar and scheduling features you connect it for.
We do not transfer this data to others except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice (the narrow Limited Use exceptions).
We do not use this data for serving advertisements of any kind.
We do not allow humans to read this data, except with your affirmative consent for specific messages, when necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.
We do not sell this data.

Disconnecting the integration. You can disconnect your Google Calendar from Hubabble at any time in your settings. When you disconnect, we revoke the access token so Hubabble can no longer access your Google account, and we stop accessing your Google Calendar data. We delete the stored connection credentials, and we delete or anonymize Google-derived calendar data we no longer need to keep, except where an append-only or legal-defense record (such as a session that was already booked) must persist as described in the retention section. You can also revoke Hubabble's access directly from your Google Account permissions page at any time.

Consent screen. Google's OAuth consent screen, which you see when you connect your calendar, links to this published Privacy Policy so you can review how we handle Google user data before you grant access.

Hubabble's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11A. How Hubabble works with your Zoom account

If you run your sessions on your own Zoom account, you can connect it to Hubabble. Once it is connected, we create a Zoom meeting on your account for each session a client books with you, move it when the session is rescheduled, and delete it when the session is canceled, so every session has its own join link. This section describes what we receive from Zoom, what we send to it, how long we keep it, and how to disconnect.

Zoom's role. When you connect your Zoom account, Zoom is one of our subprocessors for the meeting details we send it, the same way Google is for a connected calendar. It is listed in section 5 and on our Subprocessor List. We send it only the meeting details listed below, so your sessions can run on your Zoom account. Your Zoom account itself is still your own: Zoom's terms and privacy statement govern it and the meetings in it, including anything recorded during a meeting.

Permissions we ask Zoom for:

meeting:write:meeting (to create a meeting for each session).
meeting:update:meeting (to move a meeting when its session is rescheduled).
meeting:delete:meeting (to delete a meeting when its session is canceled).
user:read:user (to show you which Zoom account is connected, and to recognize it if you remove Hubabble from Zoom).

We do not ask to read or list your meetings, and we do not ask for your recordings or your contacts. Hubabble only changes or deletes the meetings it created for your sessions.

What we receive from Zoom and keep:

The access tokens Zoom issues when you connect, which let Hubabble act on your Zoom account within the permissions above. We encrypt them before storing them (see Security).
Your Zoom user ID, your Zoom account ID, and the email address on your Zoom account, so we can show you which account is connected.
For each meeting we create, its meeting ID and its join link, which we keep with the session so we can move or delete the meeting and give your client the link.

We do not keep the host link. We keep the join link exactly as Zoom returns it, which may carry your meeting passcode embedded in it the way any Zoom invitation link does; we do not store the passcode as a separate value.

What we send to Zoom for each session:

A meeting title made of the session type and the first word of your client's name in Hubabble (for example, "Discovery Call with Sam"), so you can tell your sessions apart in Zoom.
The start time, the length, and your time zone.
The short description "Booked through Hubabble".
Two meeting settings: participants cannot join before you, and Zoom registration is not required.

We do not send your client's email address or contact details, or anything from your notes or intake forms, and we do not add your client to the meeting as a Zoom invitee. The passcode, waiting room, and recording settings follow your own Zoom settings; Hubabble never turns recording on.

How we use it. Only to create, move, and delete the Zoom meeting for each of your sessions, and to give your client the join link through Hubabble, such as on their session page and in the session emails we send them. If you have connected your Google Calendar, the join link can also go on the calendar event we create there for the session, when the meeting is ready at the time of booking or rescheduling. The meeting ID and join link are stored, and the join link is emailed, through the providers on our Subprocessor List, like the rest of your session data. We do not use Zoom data for advertising, we do not sell it, and we do not use it to train machine-learning models.

Disconnecting. You can disconnect Zoom at any time in your Hubabble settings. When you do, we ask Zoom to revoke Hubabble's access, and we delete the stored tokens and your Zoom user ID, account ID, and email address. You can also remove Hubabble from your Zoom account in the Zoom App Marketplace. When Zoom tells us you did, we delete the same details and also clear the Zoom meeting IDs we kept with your sessions. If our access to your Zoom account stops working on its own, we delete the same tokens and Zoom account details, and your settings ask you to reconnect. Whenever Zoom tells us Hubabble was removed, we keep one thing: a record of that notice, so that if Zoom sends the same notice again we do not process it twice. The record is a one-way hash of the notice (our app's ID at Zoom, your Zoom user ID, and the time Zoom gives for the removal), so your Zoom user ID is not stored in readable form. Zoom may also send us a removal notice after you disconnect in your Hubabble settings; it is handled the same way. If you close your Hubabble account, your Zoom connection is deleted with it; a removal record, if there is one, stays, as section 10 explains. Closing your account does not ask Zoom to revoke Hubabble's access the way Disconnect does, so disconnect Zoom in your settings first, or remove Hubabble from your Zoom account in the Zoom App Marketplace.

What stays after you disconnect. Meetings we already created live in your Zoom account, not in Hubabble, so sessions you already booked keep their Zoom join links and your clients can still join them. That holds for sessions whose Zoom meeting was already created; an upcoming session still waiting for its meeting uses your backup meeting link, if you saved one, or goes out without a video link. After you disconnect, Hubabble can no longer move or delete those meetings; you can change or delete them in Zoom. Sessions booked after you disconnect use the backup meeting link you saved, if you saved one, until you reconnect Zoom or choose another video option.

Questions or deletion requests about your Zoom data can go to privacy@hubabble.com.

12. Future features (not yet live)

For transparency, some capabilities are planned but not in use today, and we list them so it is clear they are future, not current. We will update this policy and our Subprocessor List before any of these process your personal data:

Video session recordings.
Transcription of sessions (a transcription provider that, like our video provider, would not be named in coach- or client-facing surfaces).
A partner training organization's learning portal that connects to your account the way any app you connect does (see "An app you connect" in section 16), so it can show you your own Community notifications and activity. Not live yet.

These are described here for honesty. None of them is active, and none is a current recipient of personal data.

13. If you are a client of a coach

If a coach invited you to Hubabble to book a session, sign an agreement, pay, or view a receipt, your coach is the controller of your information. The coach decides what to collect, why, and for how long. Hubabble processes that information on the coach's behalf as a processor.

That means:

To exercise your rights over your data (access, correction, deletion, and so on), contact your coach first. They control your data.
Hubabble will support a coach in responding to your request, consistent with our agreement with them.
The links your coach sends you are single-purpose, time-limited tokenized links. We design them so they reveal only what they need to for the task at hand.
Your use of those tokenized pages is governed by the Hubabble Client Terms of Use, which sets the rules for the client-facing surfaces (booking, signing, paying, and viewing receipts).
If your coach meets clients on their own Zoom account and has connected it to Hubabble, we create the Zoom meeting on your coach's account and send you the join link. The meeting's title is the session type and the first word of your name as your coach's Hubabble account has it. We do not give Zoom your email address or your contact details. Zoom handles those meeting details as one of our subprocessors (section 5). The meeting itself lives in your coach's Zoom account, and Zoom's own privacy statement covers what happens in it.

If you cannot reach your coach, or you believe your data is being handled improperly, you can contact us at privacy@hubabble.com and we will help route your request to the right controller.

Clients are not members of the Hubabble Community. Nothing your coach holds about you is shared into the Community, and Community members are told never to post information that could identify a client.

The analytics and session replay described in section 3 never run on the links your coach sends you, and nothing your coach holds about you is sent to PostHog, the provider behind them. If one of those pages fails on our servers, PostHog receives only a technical error report: the type of error, the kind of page or operation that failed (never its actual link or token), the request method, an error reference number, and where in our own code it happened. Never anything you entered.

14. Security

We take reasonable technical and organizational measures to protect personal data, including encryption in transit, hashed credentials, tenant isolation so one coach's data is not exposed to another, scoped tokenized links for client-facing actions, and access controls on our systems.

On encryption at rest: our database provider (Neon) provides encryption at rest for the database that holds your data. Per-coach calendar OAuth tokens (the credentials that let Hubabble connect to your Google Calendar) and Zoom tokens (the credentials that let Hubabble create meetings on your connected Zoom account) are additionally application-encrypted with AES-256-GCM before they are stored, so they are protected by a second layer beyond the database's own encryption.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as the law requires.

15. Children

Hubabble is sold to and intended for adult coaches, and clients are presumed to be adults. The Hubabble Community is for adults only (18 and over). The platform is not designed for and is not directed to children. We exclude under-16 users (the GDPR Art. 8 threshold) and under-13 users (the COPPA threshold) by contract through our Terms of Service and Data Processing Agreement, and we provide a path to delete data that should not have been collected. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, contact privacy@hubabble.com and we will delete it.

16. If you are a member of the Hubabble Community

The Hubabble Community is a set of shared spaces inside the Hubabble app: the Hubabble community (announcements, discussion, topic spaces, and a referral and practice exchange) and the communities we host for partner training organizations, such as the class spaces for a partner's students, which carry that partner's name, seal, and colors alongside ours. Hubabble operates the Community. Hubabble is the controller of everything you share in it, and this policy applies. If you are in the UK, EU, or EEA, the lawful bases in section 4 apply, and your rights in section 7 apply.

Hubabble is the controller of your Community data. A partner's admins and moderators, once Hubabble turns those roles on for its community, act under our Terms, our Guidelines, and our written agreement with the partner. They may not use what they see there for the partner's own purposes outside that community. Before we turn those roles on for a community you belong to, we will tell you inside that community what the partner's people will be able to see and do, and who to contact about your data. Photos previously shared under the retired partner photo sharing notice feature are addressed below. Whatever the partner's role, what it can and cannot see is set out below, and you can bring any request about your Community data to us at privacy@hubabble.com.

Who sees what you share:

Other members. Members who share a space with you see your Community profile (name, photo, short bio, and labels where a community uses them) and what you post there, and, unless the space keeps it private, can see the members list of that space. Hubabble-wide spaces are visible to every member; a class space is visible only to the people in that class, to that community's admins and moderators once those roles are turned on, and to Hubabble's platform administrators. Labels a moderator gave you (such as "Trainer") are shown as ones a moderator gave. Your profile shows all of your labels. Reactions show who reacted. Read state in spaces is private to you and is used only to show you what is new.
People you message. Messages is switched on one community at a time by the Hubabble team, and while we roll it out, for some people at a time. Where it is on for you, you can send a private message to someone you share a space with in that community, one-to-one or in a conversation of up to 8 people. A first message reaches the other person as a request, which they can accept, ignore, or block. Until they accept, you can send only a few messages, words only, and we never tell you if they ignored or blocked you. Only the people in a conversation see its messages, and someone added to a conversation sees only what is sent after they join, unless the person adding them chooses to share earlier messages, and the conversation then shows a line saying so to everyone in it at the time. In a one-to-one conversation, the other person sees "Seen" under their latest message once you have read it, unless either of you turns that off in your settings (turning it off also stops you seeing it). Messages are private, but they are not end-to-end encrypted: we store them on our servers like the rest of the Community, which is how a reported message can reach the Hubabble team, as the next bullet explains. The files and photos you attach are scanned for malware by Amazon Web Services, our existing storage provider. A file is held until the scan finds it clean, and only then can it be downloaded. A photo shows in the conversation right away, while the scan runs, and is removed if the scan finds something harmful. The scan is automatic and no person reads your files for it. A file or photo it finds harmful is deleted, and a file it could not check can't be downloaded.
Hubabble. Our platform administrators moderate every space and, until a partner's roles are turned on, are the only moderators. They can see Community content, reports, and moderation records in every space in order to operate and moderate the Community, handle reports, investigate abuse, and provide support. They are the only people who see who filed a report. Staff access to a coach's account data during support is separately audited. Your Messages are the exception to what platform administrators can see: nobody at Hubabble can browse or open your conversations in the app, and when a member of the team views the app as you to help with support, your Messages stay closed to them. The Hubabble team sees a message only when someone in the conversation reports it, and then sees only that message and up to 10 before it that the person reporting could see, with the names of the people in the conversation. Each time a team member opens that copy, it is logged. We keep it for 180 days after the report is resolved (365 days if it is never resolved). Beyond reports, we touch stored messages only to answer a request you make about your own data, to keep the service running or secure (for example, restoring a backup or investigating a security problem), or where the law requires it, never to read your conversations.
A sponsoring partner. A partner receives nothing from the Community until Hubabble turns on admin and moderator roles for that partner's own community, which happens per partner after it has agreed to Hubabble's terms for those roles. Once those roles are on, the partner's admins and moderators can see, inside that community only: its members (name, photo, labels, and the Community profile you chose for it), what is posted in its spaces, the moderation record there, and, for handling reports, the content reported in that community and the reason given, never who reported it. They can act on content and members in that community under our Guidelines and the partner's house rules, and Hubabble can reverse any decision they make. They never see your email address, your account, billing, or calendar data, anything about your clients, your Messages or reports about them, or anything from another community. Its staff who hold no such role see the spaces they belong to the way any member does. The partner tells us who belongs to a class or group so we can add them to the right space, and once its admin role is on, the partner's admins can add people who are already in its community to its spaces themselves. The partner is a separate organization with its own privacy notice for the enrollment and program records it holds about you. Earlier photo sharing under the retired notice feature is addressed in the next bullet.
Nobody outside the Community, except an app you choose to connect (the next bullet). Community spaces are not public and are not indexed by search engines. We do not use what you share in our marketing without your separate permission. The partner photo sharing notice feature has been retired. Uploading a photo does not give a partner permission to use it outside the Community. If you previously shared a photo while a partner's notice was shown, we keep the notice text and activity records to help answer questions about that earlier sharing. This change does not revoke permission you previously gave or recall copies a partner already made. You can still withdraw that earlier permission at any time by writing to privacy@hubabble.com. A partner holds its existing copies under its own privacy notice.
An app you connect. You can connect an app of your choice, such as an AI assistant, to your account so it can read the Community for you. When you do, it can see what you can see, including other members' posts in the spaces you are in, and only as part of what you ask it to do. It can also send our team a note when you ask for something it can't do yet; the note is kept with your reports (see section 3). If you hold an admin or moderator role in a community, you can also let it post and take moderation actions there as you, and, if you are a community admin, list and create join codes, make spaces, and add people who are already in that community to its spaces; the moderation record shows those actions as yours, and what it reads in that role, including reported content, stays under the limits on that role. Connecting is your choice, we show you what the app will be able to do before you allow it, and you can disconnect it at any time in your settings. The app's provider holds what it receives under your agreement with it, not ours (see section 5). An app never sees your Messages unless you tick the separate box for them when you connect it. If you do, it can read the conversations you are in, including what other people sent you, but never message requests you have not accepted, messages from people you blocked, or the files and photos you attach (only how many a message had). Other members should know this: something you post in a space can be read into a member's connected app the same way it can be read on their screen, and if someone in a conversation with you connects an app with that permission, what you write to them can be read into it, the same way it can be read on their screen.
KLIPY, for GIFs. When you search for a GIF, your search terms and IP address go from your browser to KLIPY, and when you view a post or a message with a GIF, your IP address goes to KLIPY as the image loads. KLIPY does not receive your name, email address, or what you post or write in a message. See the KLIPY row in section 5.
PostHog, for analytics and error tracking. The Community is part of the signed-in dashboard, so the analytics, session replay, and error tracking described in section 3 apply there too. On Community pages a replay shows the app's own words and the names of communities and spaces, but members' names and everything members post (thread titles, posts, replies, captions, and comments) are masked and images are blocked. Messages pages are never recorded, and PostHog never receives the words, photos, or files you post or send in a message.

Notifications. When someone replies in a thread you started or replied in, we email you at the frequency you choose: every reply, a roundup, a daily recap, or off. When a new announcement is posted in an announcements space you belong to, we email it to you: its title, who posted it, and the opening of the post, with a link to read the rest. Announcement emails are on unless you turn them off. When a message to you is still unread a while after it arrives, we email you to say who sent it and in which community, with a link to read it. That email never includes what the message says, and you get at most one an hour for each conversation. Unread-message emails are on unless you turn them off, and muting a conversation stops them for it. You can change or turn off each kind of Community email in your notification settings, and every Community email includes a link to do so. We may add a periodic digest later; if we do, it will use the same settings. Emails we send about the security of your account, or that the law requires, are not affected by those settings. In the app, we keep a short list of notifications about replies to your threads and replies and reactions to your posts. Only you see it, and we delete each notification 90 days after its last activity.

Sponsored access. A sponsoring partner pays Hubabble a flat fee for its people's Community access. Nothing is billed to you, and we do not charge or report per member. If the partner's sponsorship ends, or the partner tells us you are no longer part of its program, we may close or archive its class spaces, but your Hubabble account, your profile, and what you posted in Hubabble-wide spaces are not deleted for that reason.

Leaving, and your posts and messages. You can delete your own posts, replies, and messages at any time. When you leave the Community or close your account, your profile is removed and the posts and messages you left in place remain attributed to a former member so other people's conversations stay intact. You can ask us to delete those too; see section 7.

Improving Hubabble, including AI features. We may use Community content to develop and improve Hubabble, which can include training or fine-tuning machine-learning models that power Hubabble features. We do not do this today. Before we start, we will tell you what we plan to use, for what, and which providers are involved, and we will give you a simple way to opt out that applies to everything you have posted. Where the law requires your consent instead, we will ask for it. We will not use private messages for this, we will not use content you or a moderator removed, we will not use anything identifying a coach's clients, and we will not use posts in which you shared sensitive details about your own health or similar special-category information. If you are in the UK, EU, or EEA, our lawful basis would be our legitimate interests in improving the service, balanced by that notice and opt-out; see section 4.

A partner learning portal, in the future. We may later let you connect a partner's learning portal to your Hubabble account, the same way as any app you connect, so it can show you your own notifications and link you back to Hubabble. That is not live yet and is described in section 12.

17. Changes to this policy

We may update this policy as the platform and the law change. When we do, we will revise the Effective Date and Version at the top and, for material changes, give you reasonable notice through the platform or by email before the change takes effect. Before Hubabble's public launch, we may also update this policy in place, without changing the Effective Date or Version, whether to clarify its wording or to describe a feature that is not yet generally available. After launch, every material change follows the notice promise above. Continued use after a change takes effect means the updated policy applies to you.

18. Governing law and contact

This policy and any dispute relating to it are governed by the laws of the State of Oregon, without regard to its conflict-of-laws rules. The forum for disputes is Hood River County, Oregon.

Questions, requests, or complaints about this policy or your data:

Hubabble, LLC 403 Portway Avenue, Suite 300 Hood River, Oregon 97031 United States privacy@hubabble.com