Privacy Policy - SaaS / Web Application

Last Updated: 23/06/2026

Introduction

ByHubo ("we," "our," or "us") operates ByHubo available at https://byhubo.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Information We Collect

Account Information

When you create an account, we collect:

Full name and email address
Company name and job title (if applicable)
Password (stored in hashed form)
Billing information (processed by our payment provider)
Profile picture and preferences

User-Generated Content

We store content you create, upload, or submit through the Service, including:

Hosted trust kit for micro-SaaS — live Trust Pages, subprocessor lists, and DPA downloads.
Comments, annotations, and collaborative content
File attachments and uploads

Usage Data

We automatically collect:

Application Logs: Feature usage, actions performed, errors encountered
Device Information: Browser type, operating system, screen resolution, device type
Network Information: IP address, approximate location (city/country level)
Session Data: Login times, session duration, pages/features accessed
Performance Data: Load times, crashes, and diagnostic information

Information from Third Parties

We may receive information from:

Authentication Providers: If you sign in via Google, GitHub, or other OAuth providers
Payment Processors: Transaction status and billing details (we do not store full credit card numbers)
Analytics Services: Aggregated usage patterns

How We Use Your Information

Purpose	Legal Basis (GDPR)
Provide and maintain the Service	Contractual necessity
Process payments and subscriptions	Contractual necessity
Send transactional emails (receipts, password resets)	Contractual necessity
Improve features and user experience	Legitimate interest
Detect and prevent fraud or abuse	Legitimate interest
Send product updates and announcements	Legitimate interest (opt-out available)
Send marketing communications	Consent
Comply with legal obligations	Legal obligation

Data Storage and Security

Infrastructure

Your data is stored on servers provided by EU / US located in EU / US.

Security Measures

We implement industry-standard security measures:

All data encrypted in transit (TLS 1.2+)
Data encrypted at rest (AES-256)
Regular security audits and penetration testing
Role-based access controls
Multi-factor authentication available
Automated backups with encryption
SOC 2 Type [I/II] compliance (if applicable)

Data Breach Response

In the event of a data breach that affects your personal information, we will:

Notify affected users within 72 hours (as required by GDPR)
Notify relevant supervisory authorities
Provide details on the nature of the breach and remediation steps

Subprocessors

We use the following third-party subprocessors to process personal data on our behalf:

Subprocessor	Purpose	Location	DPA
Clerk	Authentication and user management	United States	DPA
Stripe	Payment processing	United States / EU	DPA
Vercel	Application hosting and CDN	United States / EU	DPA
PostHog	Product analytics	United States / EU	DPA
Resend	Transactional email	United States	DPA

Each subprocessor has its own privacy policy and data processing agreement governing the use of your information.

Data Sharing

We do not sell your personal information. We may share data:

With your team/organization: If you use a team or enterprise plan, administrators may access usage data and manage accounts
With service providers: As listed above, strictly for providing the Service
For legal compliance: When required by law, subpoena, or court order
During business transfers: In connection with a merger, acquisition, or asset sale (you will be notified)

Data Retention

We retain personal data for up to 365 days unless a longer period is required by law or necessary to resolve disputes. After account deletion, we remove or anonymize your data within 30 days, except where retention is required by law.

Your Rights

All Users

Access: Request a copy of your personal data
Correction: Update inaccurate information
Deletion: Delete your account and associated data
Export: Download your data in a machine-readable format
Objection: Object to certain processing activities

GDPR Rights (EEA/UK Residents)

Right to restrict processing
Right to data portability
Right to withdraw consent
Right to lodge a complaint with a supervisory authority

Data Protection Officer: hello@byhubo.com

CCPA Rights (California Residents)

Right to know what personal information is collected
Right to delete personal information
Right to opt out of the sale of personal information (we do not sell data)
Right to non-discrimination

To exercise any of these rights, contact us at hello@byhubo.com or use the account settings in the application.

Cookies

We use cookies for:

Authentication: Keeping you logged in
Preferences: Remembering your settings
Analytics: Understanding how the Service is used
Security: Detecting and preventing threats

You can manage cookie preferences in your browser settings.

International Data Transfers

If you access the Service from outside EU / US, your data may be transferred to and processed in EU / US. We ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) for EU data transfers
Data Processing Agreements with all sub-processors

Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect information from children.

Changes to This Policy

We will notify you of material changes via email or an in-app notification at least 30 days before the changes take effect. Continued use of the Service after changes constitutes acceptance.

3. Legal Basis for Processing

Under GDPR, we must have a lawful basis for each processing activity. Below is a summary of the legal bases we rely on:

Processing Activity	Legal Basis (Article 6 GDPR)
Providing our service and fulfilling contracts	Performance of a contract (Art. 6(1)(b))
Processing payments and transactions	Performance of a contract (Art. 6(1)(b))
Sending transactional emails (order confirmations, security alerts)	Performance of a contract (Art. 6(1)(b))
Responding to your inquiries and support requests	Performance of a contract (Art. 6(1)(b)) / Legitimate interest (Art. 6(1)(f))
Sending marketing communications	Consent (Art. 6(1)(a))
Setting non-essential cookies and tracking	Consent (Art. 6(1)(a))
Improving our services and user experience	Legitimate interest (Art. 6(1)(f))
Ensuring security and preventing fraud	Legitimate interest (Art. 6(1)(f))
Complying with tax, accounting, and legal obligations	Legal obligation (Art. 6(1)(c))
Protecting vital interests of data subjects	Vital interests (Art. 6(1)(d))

Where we rely on legitimate interests, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 6).

Where we rely on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. You may exercise any of these rights by contacting us at hello@byhubo.com.

6.1 Right of Access (Article 15)

You have the right to obtain confirmation as to whether we are processing your personal data, and if so, to receive a copy of that data along with information about how and why we process it.

6.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and to have incomplete data completed.

6.3 Right to Erasure / Right to Be Forgotten (Article 17)

You have the right to request the deletion of your personal data when:

The data is no longer necessary for the purpose for which it was collected
You withdraw your consent and there is no other legal basis for processing
You object to the processing and there are no overriding legitimate grounds
The data has been unlawfully processed
The data must be deleted to comply with a legal obligation

Note: We may be required to retain certain data for legal, tax, or regulatory purposes even after a deletion request.

6.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your personal data when:

You contest the accuracy of the data (for a period enabling us to verify accuracy)
The processing is unlawful and you request restriction instead of erasure
We no longer need the data but you need it for legal claims
You have objected to processing pending verification of whether our legitimate grounds override yours

6.5 Right to Data Portability (Article 20)

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (e.g., JSON, CSV). You also have the right to transmit that data to another controller without hindrance from us.

This right applies when:

Processing is based on consent or a contract, and
Processing is carried out by automated means

6.6 Right to Object (Article 21)

You have the right to object, at any time, to the processing of your personal data based on legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

You have an absolute right to object to processing for direct marketing purposes at any time.

6.7 Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you.

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning data subjects.

6.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in the EU member state where you reside, work, or where the alleged infringement took place. A list of supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

How to Exercise Your Rights

To exercise any of the rights described above:

Email: hello@byhubo.com
Mail: Address available on request

We will respond to your request within 30 days. In complex cases, we may extend this period by an additional 60 days, and we will inform you of any extension within the initial 30-day period.

We will verify your identity before processing your request. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.

7. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure an adequate level of protection by relying on one or more of the following transfer mechanisms:

Adequacy decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection (Article 45 GDPR)
Standard Contractual Clauses (SCCs): Contracts approved by the European Commission that provide appropriate safeguards for international transfers (Article 46(2)(c) GDPR)
Binding Corporate Rules: Internal data protection policies approved by a supervisory authority for transfers within a corporate group
Consent: In limited circumstances, with your explicit consent after being informed of the risks

You may request a copy of the safeguards we have in place by contacting us at hello@byhubo.com.

Countries where data may be processed: EU / US

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

ByHubo

Email: hello@byhubo.com
Address: Address available on request
Website: https://byhubo.com

For data protection inquiries, contact ByHubo Team at hello@byhubo.com.

You also have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

ByHubo ProcureKit — not legal advice. Consult qualified counsel before relying on this document.