In this section
Resources / Trust / Privacy
Data processing overview
A high-level, DPA-style description of how Hubbo processes visitor data on your behalf, the providers involved and the safeguards in place.
When you use Hubbo on your website, you collect data from your visitors. For that data you are the controller and Codemilk is the processor. This article describes the processing in the style of a data processing agreement (DPA). It is an overview, not a signed contract. If you need a signed DPA, email support@hubbo.io.
Subject matter and duration
Codemilk processes visitor data only to provide Hubbo to you, for as long as your account exists, plus any period needed to delete it after closure.
Nature and purpose
- Delivering the widgets you configured: notifications, NPS, surveys, roadmap and status page.
- Storing and displaying responses, comments and conversations in your admin app.
- Counting page views (unique browser sessions) to apply plan limits.
- Sending status incident update emails to people who subscribed.
- Producing AI summaries of NPS responses when you request them (Standard and Premium).
Categories of data and data subjects
| Data subjects | Categories of data |
|---|---|
| Your website visitors | Session marker, NPS and survey answers, free-text comments, page URL, country, language, device, browser, operating system, screen and connection information, optional name and email in conversations. |
| Status page subscribers | Email address. |
| Your team members | Name, email address, role, picture. (Codemilk is the controller for this data, see GDPR and privacy.) |
Hubbo is not designed to collect special categories of personal data. Do not ask for them in free-text questions.
Our commitments as processor
- We process visitor data only on your documented instructions, which are your configuration of the service and these terms.
- People with access to the data at Codemilk are bound by confidentiality.
- We apply the measures described in Security.
- We help you respond to data subject requests, for example by letting you delete responses and subscribers, and by supporting requests sent to support@hubbo.io.
- We notify you without undue delay if we become aware of a personal data breach affecting your data.
- On closure of an account we delete its data, unless law requires us to keep it.
- We make information available that is needed to show compliance, within reason.
Sub-processors
Codemilk uses third-party providers to run Hubbo. The categories below reflect the current architecture. The list may change, and you can ask for the current list at any time at support@hubbo.io.
| Provider (category) | Purpose | Data involved |
|---|---|---|
| Cloud hosting platform (Heroku) and managed data stores | Hosting of the API, embed script, admin app and databases, including caching and counters. | All service data. |
| Auth0 | Authentication of admin app users. | Team member identity data. |
| Stripe | Payments and invoices. | Billing data of account holders. Not visitor data. |
| Email delivery provider | Transactional emails such as invitations, status updates and limit warnings. | Recipient email addresses and message content. |
| Cloudinary | Storage of uploaded images. | Images you upload to Hubbo. |
| OpenAI | AI analysis of NPS responses, only when you run an analysis. | Up to 40 selected NPS responses with score, comment and context fields. No names or contact details are collected for NPS, but a comment can contain anything a visitor wrote. |
We require sub-processors to protect data in line with applicable law. Where data leaves the European Economic Area, we rely on lawful transfer mechanisms such as standard contractual clauses, as described in the Privacy Policy.
Your responsibilities as controller
- Decide on a legal basis and inform your visitors, for example in your privacy notice and cookie notice.
- Obtain consent where it is required in your jurisdiction.
- Configure Hubbo reasonably, for example by not asking for sensitive data in free-text fields.
- Handle requests from visitors about their data, with our help.
Return and deletion
You can delete content and responses in the admin app at any time, or delete the whole account under Settings → General. If you want an export before you leave, contact support@hubbo.io.
No certifications claimed
This overview does not imply any SOC 2, ISO 27001 or similar attestation. Codemilk does not claim to hold them. If you need a signed DPA or a security questionnaire completed, email support@hubbo.io.