Privacy Policy

We collect the following categories of information:

• Account information. Name and email address. We support passwordless sign-in via one-time email links ("magic links") and, optionally, a password you set. If you sign in with Google, we receive your name, email address, and profile identifier from Google in accordance with your Google account permissions. We do not receive or store your Google password.
• Workspace and branding information. Company name, logo, colors, contact details, and other configuration you provide.
• Customer content. Reports, artifacts, documents, files, links, comments, and other materials you ingest, upload, or generate, together with the client names, portal settings, and viewer email addresses you enter.
• Support and assistant interactions. Messages you send to our in-product assistant and the resulting conversation history.
• Usage and analytics data. We collect product analytics and engagement events, such as pages and features viewed, actions taken, clicks, session timing, referring pages, device and browser type, approximate location derived from IP address, and similar diagnostic data. We use this information to understand engagement and improve the Service.
• Cookies and similar technologies. We use strictly necessary cookies to keep you signed in and to operate the Service, and analytics cookies or similar identifiers to measure usage as described above.
• Payment information. Paid subscriptions are processed by our third-party payments provider, Polar (polar.sh), which acts as the merchant of record and handles checkout, billing, and card processing. We do not collect or store full payment card numbers; we receive limited transaction and subscription-status data (such as plan, status, renewal date, and a customer identifier). Polar's handling of your payment data is governed by Polar's own privacy policy.

We use information to:

• provide, operate, maintain, and secure the Service;
• authenticate users and manage accounts, workspaces, and access;
• store, process, and display Customer content as directed by the Customer;
• measure engagement and analyze usage in order to debug, improve, and develop new features;
• provide customer support and respond to requests;
• process subscriptions and send service-related communications;
• detect, prevent, and address fraud, abuse, security, and technical issues; and
• comply with legal obligations and enforce our Terms of Service.

We rely on trusted third parties to operate the Service. These providers process information only to perform services for us and are bound by confidentiality and data-protection obligations. They include our database, authentication, and file-storage provider (Supabase); cloud application hosting (Vercel); payment processing and billing (Polar, acting as merchant of record); AI model processing for the in-product assistant (Anthropic); sign-in with Google (Google); and providers of transactional email delivery, product analytics, and headless rendering used to capture and re-host shared links. We do not sell your personal information. A current list of sub-processors is available on request at support@1hub.work.

When you use the in-product assistant, the content of your messages is transmitted to our AI model provider to generate a response. We instruct such providers not to train their models on your inputs and outputs, subject to their applicable terms.

Where applicable law (such as the GDPR) requires a legal basis, we rely on: performance of our contract with you; our legitimate interests in operating, securing, and improving the Service; your consent (which you may withdraw); and compliance with legal obligations.

We may disclose information:

• to the Customer workspace to which your account or content belongs;
• to Client Viewers, only as directed by the Customer who controls a portal;
• to service providers and sub-processors as described above;
• in connection with a merger, acquisition, financing, or sale of assets, in which case information may be transferred as a business asset;
• to comply with law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of 1hub, our users, or others.

Customers are solely responsible for the content they upload and for the personal data of their clients and Client Viewers that they enter into the Service, including obtaining any required consents and providing any required notices. If you are a Client Viewer, the Customer who operates the portal is the controller of your information; please direct privacy requests to that Customer. 1hub will reasonably assist Customers in responding to such requests as a processor.

We retain information for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Assistant conversation history is retained for a limited period and then deleted. You may request deletion of your account, after which we will delete or de-identify information unless retention is required by law.

We implement technical and organizational measures designed to protect information, including encryption of ingested content at rest, encryption in transit over TLS (with HSTS), database-level tenant isolation via row-level security, sandboxed rendering of untrusted content on a separate origin, rate limiting on authentication endpoints, and access controls scoped to each Customer workspace. Client portals are private by default and are configured to instruct search engines not to index them; access can be further restricted by invitation, password, or per-report permissions. A fuller description of our practices is published on our Security page. If we become aware of a personal-data breach affecting you, we will notify affected Customers without undue delay, consistent with applicable law. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for activity that occurs under your account.

We and our service providers may process and store information in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers. By using the Service, you acknowledge that your information may be transferred to and processed in such locations.

Depending on your location, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA, UK, and California, among others, may have additional rights. To exercise these rights, contact us at support@1hub.work. Where we process data on behalf of a Customer, we will refer your request to that Customer. We will respond consistent with applicable law.

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

The Service may contain links to or embed third-party content. We are not responsible for the privacy practices of third parties, and this Policy does not apply to them.

We may update this Policy from time to time. The "Effective" date above indicates when it was last revised. Material changes will be communicated through the Service or by other reasonable means. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

Questions about this Policy or our privacy practices may be directed to 1hub at support@1hub.work.