Privacy policy

2. Data protection officer

We have not appointed a data protection officer as this is not legally required in our case.

Privacy inquiries: use the contact details in section 1 or email privacy@huba.info

3. Overview: what Studio processes

studio.huba.info is hubA’s control plane (hubA STUDIO): sign-in, onboarding, workspace editor, APIs, and optional integrations.

The public marketplace gallery on huba.info has its own privacy notice. Customer websites you publish need their own imprint/privacy pages for your venue.

We only process personal data where needed for each purpose.

• Account & authentication (email, password hash, magic link, Google sign-in, sessions)
• Projects & site content (draft, staging, production), branding/legal identity of your venue
• Media uploads and published site artifacts (object storage)
• AI assist (field suggestions, Ask chat, image planning/generation, menu extraction)
• Optional integrations (e.g. Google Business Profile, place data)
• Technical logs, abuse protection, optional operator support access
• No payment card data in Studio (no checkout in the current version)

4. Delivery, hosting, and log files

When you visit studio.huba.info, your browser automatically sends information that may be stored in server or edge logs (e.g. IP address, date/time, requested URL, referrer, user agent).

Infrastructure: Cloudflare, Inc. (CDN) und Cloudflare R2 — Auslieferung und Speicherung veröffentlichter Websites aus Vorlagen; Studio-App-Hosting über Vercel, Inc.; relationale Datenbank (PostgreSQL) beim jeweiligen Datenbank-Anbieter

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable delivery and abuse prevention).

Retention of access logs: typically up to 30 days unless longer retention is required for evidence or security.

5. Account and authentication

Using Studio requires an account. We process email address, display name (if provided), authentication metadata, and session identifiers.

Sign-in methods: email magic link, email + password (including password reset), and “Continue with Google” (OAuth). Passwords are stored only as hashes; magic-link and reset tokens are time-limited and single-use.

Sessions use HttpOnly cookies (prefix “huba”). Short-lived cookies may also be set for OAuth return URLs and Studio pass / preview sessions.

Legal basis: Art. 6(1)(b) GDPR (contract / pre-contract steps) and (f) GDPR (authentication security).

Recipients: authentication runs on Studio infrastructure (Better Auth); Google LLC as identity provider for Google sign-in; email delivery via Resend (transactional mail).

6. Projects, content, and domains

In the workspace we store website configurations and content you create (pages, blocks, locales, branding, venue legal fields for your customer site, domain records).

Purpose: editor, staging preview, and publishing your gastronomy website.

Legal basis: Art. 6(1)(b) GDPR.

Note: imprint/privacy pages on your published customer site concern your role as controller toward guests — not this Studio notice.

7. Media and files

Uploaded images, PDFs, and other media plus baked publish artifacts are stored in object storage (Cloudflare R2) and may be delivered via CDN. Development may use local mirror directories.

Legal basis: Art. 6(1)(b) GDPR.

Retention: for as long as the project exists or until you delete media; then according to platform deletion and backup processes.

8. AI assist (Field Assist, Ask Assist, images, menu)

When you use AI features, we send data required for the request to AI providers, including: your prompts/briefs, selected field and block context, brand/vertical context, Ask Assist chat messages, and for image/menu features prompt or document/image content.

Providers depending on configuration: Anthropic (Claude, direct API) and/or Amazon Web Services (Bedrock), Google (Generative AI / Gemini for images and optionally extraction), optionally OpenAI for menu extraction.

Purpose: assist with text, layout, and media tasks and workspace navigation. We do not make automated decisions with legal or similarly significant effects under Art. 22 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contractual service) and/or (f) GDPR (efficient Studio operation).

We store AI job metadata (e.g. brief, target, context snapshot) in our database for execution and traceability. Ask Assist threads may also be stored locally in your browser (localStorage).

We do not use your Studio content to train our own general-purpose AI models. Whether subprocessors claim training rights depends on their terms — we prefer configurations that avoid unwanted training for production use where available.

9. Optional integrations and place data

Google Business Profile: after you connect, we store OAuth tokens and location data for sync. Provider: Google LLC.

Google Places / Maps import and geocoding (including OpenStreetMap Nominatim): address and place data to enrich local presence — only when you use the feature.

Cloudflare Turnstile may be used on published customer forms for bot protection (token verification, optionally IP).

Legal basis: Art. 6(1)(b) or (f) GDPR; for OAuth connections, your initiated link/consent as applicable.

10. Guest inquiries on customer websites

Forms on published customer sites collect guest inquiries (fields per form definition, consent flag, locale, page path). Technical endpoints run on platform infrastructure; submissions are stored in the project context and may be confirmed or forwarded by email (Resend).

Toward guests you are typically the controller of inquiry content. hubA processes the data as a processor / technical operator of the infrastructure unless otherwise agreed.

Abuse protection may include IP-based rate limits and Turnstile (Art. 6(1)(f) GDPR).

11. Cookies and local storage

Studio uses strictly necessary cookies and similar storage. We currently do not use marketing, tracking, or analytics cookies in Studio.

Legal basis for strictly necessary storage: Art. 6(1)(b) or (f) GDPR and § 25(2) TDDDG.

• hubA Auth session cookies (HttpOnly) — sign-in
• Short-lived OAuth/bridge cookies — auth flow
• Studio pass cookies (project/user) — reopen workspace
• Onboarding entry cookie — short-lived configurator access
• Support session cookie (HttpOnly) — operator support
• localStorage/sessionStorage: panel widths, interaction mode, Ask chat threads, pending claim / preview pass (UX / session continuity)

12. Operator support access

For troubleshooting, authorised platform operators may open time-limited support sessions for a project. Operator id, email, reason, and expiry are stored; API actions may be audited.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation and support) or (b) GDPR where support is contractual.

13. Recipients and processors

We use service providers that process data on our behalf. Where required, we conclude data processing agreements under Art. 28 GDPR.

Cloudflare, Inc. (CDN) und Cloudflare R2 — Auslieferung und Speicherung veröffentlichter Websites aus Vorlagen; Studio-App-Hosting über Vercel, Inc.; relationale Datenbank (PostgreSQL) beim jeweiligen Datenbank-Anbieter

• Vercel, Inc. — Studio application hosting
• PostgreSQL database provider — account, project, and operational data
• Cloudflare, Inc. — R2 storage, CDN, Turnstile, custom hostnames / TLS
• Resend — transactional and notification email
• Google LLC — OAuth sign-in, Places, Business Profile, Generative AI (when used)
• Anthropic PBC and/or Amazon Web Services (Bedrock) — text AI / Ask Assist
• OpenAI, L.L.C. — optional menu extraction
• OpenStreetMap / Nominatim — geocoding (when used)

14. Transfers outside the EEA

Some providers are established or process data outside the EU/EEA (in particular the US). Transfers occur only with appropriate safeguards under Art. 44 ff. GDPR (e.g. adequacy decision, EU Standard Contractual Clauses) and additional technical/organisational measures where required.

15. Retention and deletion

We store personal data only as long as needed for the purposes above or as required by statutory retention periods.

Accounts and projects: until deletion or per platform lifecycle (pause/delete). Sessions and tokens: as described above. Logs: typically up to 30 days. Support sessions: until TTL expiry plus short audit retention.

After deletion, residual data may remain briefly in backups until rotation completes.

16. SSL/TLS encryption

Studio uses SSL/TLS encryption. You can recognize a secure connection by “https://” in your browser address bar.

17. No automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI suggestions are reviewed and applied by you.

18. Your rights

You have the following rights regarding your personal data:

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation (Art. 21 GDPR).

You may lodge a complaint with a supervisory authority (Art. 77 GDPR). Competent supervisory authority: the state authority for the controller’s place of residence/business (to be named once the address is finalized).

To exercise your rights, send an informal message to privacy@huba.info.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdraw consent (Art. 7(3) GDPR) where processing is based on consent

19. Updates to this privacy policy

We update this privacy policy when law, Studio features, or service providers change. The version published on this page applies.

Provider identification: https://studio.huba.info/imprint

Marketplace privacy: https://huba.info/policy