Service policy · Last updated 2026-10-20
Privacy Policy
This Privacy Policy explains how Hubzoid collects, uses, shares and protects personal information when you visit hubzoid.com, send us a project request or email, work with us on implementation services, or contact us about the Hubzoid open-source project. It also explains the choices and rights available to you.
Section 01
Who we are
Hubzoid makes open-source software that gives an organization one shared Hub for the knowledge, context, skills, agent definitions and authorized capabilities its internal AI agents use. We also provide implementation services, in which we design, build, deploy and hand over internal agents for organizations under a written agreement.
In this policy, "Hubzoid", "we", "us" and "our" mean Hubzoid. For the personal information described in this policy, Hubzoid is the controller, which means we decide why and how it is processed. You can contact us about privacy matters at privacy@hubzoid.com.
Section 02
Scope of this policy
This policy applies to personal information we process for our own purposes: when you browse hubzoid.com and its documentation, submit a project request, email us, take part in a business relationship with us, report a security issue or contact us about the open-source project.
It does not apply to data processed by a Hubzoid deployment that an organization runs on its own infrastructure. That data stays in the organization's environment and is controlled by that organization. If you use an agent at work, the organization that operates the deployment is responsible for how your information is handled there.
It also does not apply to personal data we process on a customer's behalf while providing implementation services. In that case the customer is the controller, and our processing is governed by our agreement with the customer and the Data Processing Addendum at /legal/dpa. Please direct requests about that data to the organization concerned.
Websites and services operated by others, such as GitHub, YouTube and model providers, are governed by their own privacy policies.
Section 03
Information you give us
Project requests. When you use the contact form on our Build with us page, we collect your name, work email address, company, team and the work you would like an agent to do, along with any other details you choose to share.
Email and correspondence. When you email contact@hubzoid.com or another Hubzoid address, we receive your name, email address, the content of your message and any attachments. We keep a record of our correspondence with you.
Business relationship information. When your organization works with us, we collect the names, work contact details and roles of the people involved, billing and invoicing details, contract records and communications about the work.
Security reports. When you report a vulnerability, we collect your contact details, the content of your report and any follow-up correspondence.
Open-source project interactions. When you open an issue, submit a contribution or send a private vulnerability report on GitHub, we see your GitHub username, your public profile information and the content you submit. Contributions include the name and email address in your commit sign-off.
Please do not include sensitive personal information, such as health information, government identifiers or payment card details, in a project request or email.
Section 04
Information we collect automatically
Request data. When you visit hubzoid.com, our hosting provider processes the technical information needed to deliver pages and protect the website, including your IP address, browser and device type, the page requested, the referring page and the date and time of the request.
Analytics data. If you consent to analytics, Google Analytics and PostHog collect information about how you use the website. This includes the pages you view, how you arrived at the website, the links and buttons you select, how far you scroll, how long you spend on pages, your browser, device, operating system, screen size and language, your approximate location derived from your IP address, and a pseudonymous identifier stored in a cookie.
Session recordings. If you consent to session replay, PostHog records how you interact with pages, such as mouse movements, clicks, scrolling and page changes, so that we can see where the website is confusing or not working. Text you type into form fields is masked and is not captured.
Browser storage. We store your cookie choices in a cookie on your device. If you choose to save your place in an Academy course or mark lessons complete, we store that progress on your device.
Academy videos. When you press Play on a course lesson, your browser loads the embedded video from YouTube. YouTube receives the technical information needed to deliver it and handles that information under its own privacy policy. We use its privacy-enhanced player and do not load it before you press Play.
Our Cookie Policy at /legal/cookies lists each cookie and storage item we use.
Section 05
Information we receive from others
Colleagues and partners. A colleague or partner may give us your name and work contact details when they introduce you or include you in a project request.
Your organization. When your organization engages us, it may share the names, roles and contact details of the people involved in the work.
Public sources. We may review publicly available business information, such as your company's website, to prepare for a conversation you have requested.
GitHub. When you interact with the open-source project on GitHub, we receive the information described in Information you give us from GitHub.
Section 06
The open-source software
Hubzoid software that you install and run on your own infrastructure does not send usage data, telemetry, prompts, files or other content to Hubzoid. We have no access to a self-hosted deployment or the data it processes.
OpenTelemetry tracing in the software is off by default. When an operator turns it on, traces go only to the endpoint that operator configures. Optional tracing to a model provider's own dashboard is also off by default. The bundled chat interface runs with its version update check turned off by default.
Model providers and other services that an organization connects to its deployment process prompts and data under that organization's own agreements with them. Third-party components, such as model provider tools, have their own data practices, described in their providers' terms.
The sample demo Hub includes a skill that can retrieve public pages from hubzoid.com when a user asks for current information about Hubzoid. Such a request is an ordinary web request, handled like any other visit to the website.
When you download the software from GitHub, the Python Package Index or GitHub Container Registry, those services process your request under their own terms and privacy policies.
Section 07
How we use information
To respond to project requests and enquiries, including assessing whether and how we can help and preparing a proposed scope.
To provide implementation services and manage our relationships with customers, including contracts, invoicing, support and communications about the work.
To operate, maintain and secure the website, including delivering pages, preventing abuse and diagnosing technical problems.
To understand how visitors use the website and improve its content, navigation and design, using analytics and session recordings only when you have consented.
To investigate and fix security issues reported to us and to maintain the open-source project.
To comply with legal obligations, enforce our terms and establish, exercise or defend legal claims.
We do not use your personal information to train AI models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Section 08
Legal bases for processing
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR, the UK GDPR and Swiss data protection law.
Contract. We process information to take steps you request before entering into a contract and to perform a contract to which you are a party.
Legitimate interests. We process information to respond to business enquiries, manage relationships with customers and their personnel, operate and secure the website, maintain the open-source project and protect our legal rights. We rely on these interests only where they are not overridden by your interests and rights, and you can object to this processing at any time.
Consent. We use analytics and session replay only with your consent. You can withdraw consent at any time through the Cookie settings link in the website footer. Withdrawal does not affect processing that took place before it.
Legal obligation. We process information where needed to comply with the law, for example to keep tax and accounting records or to respond to lawful requests from authorities.
Section 11
International data transfers
Hubzoid is based in India, and our service providers process information in the United States and other countries. These countries may have data protection laws that differ from those where you live.
When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognized as providing adequate protection, we use the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum and the adjustments required for Switzerland where they apply, or another lawful transfer mechanism.
You can request a copy of the safeguards we rely on by emailing privacy@hubzoid.com.
Section 12
How long we keep information
We keep personal information only for as long as we need it for the purposes described in this policy, unless the law requires or permits a longer period.
Project requests and enquiries. While we discuss a possible engagement and for up to 24 months after our last contact. If the discussion leads to an engagement, the information becomes part of our customer records.
Customer records. For the duration of the relationship and afterwards for as long as needed to meet legal, tax and accounting requirements and to establish or defend legal claims.
Hosting request logs. Up to 90 days, for security and abuse prevention.
Analytics data. Up to 14 months in Google Analytics and up to 12 months in PostHog. Session recordings are kept for up to 30 days.
Cookie choices. 12 months in your browser, after which we ask again.
Security reports. For as long as needed to resolve the issue and keep a record of how it was handled.
Personal data we process for customers during implementation services is retained and deleted as set out in the customer's agreement and the Data Processing Addendum at /legal/dpa.
When a retention period ends, we delete the information or anonymize it so that it no longer identifies you.
Section 13
How we protect information
We use technical and organizational measures designed to protect personal information against loss, misuse and unauthorized access. These include encrypted connections to the website, access limited to the people who need it, multi-factor authentication on business accounts and service providers selected for their security practices.
In implementation services, customer data stays in the customer's environment. Hubzoid access to that environment is time-bound, approved by the customer and revoked at handover.
No method of transmission or storage is completely secure. If you believe you have found a security issue, please report it to security@hubzoid.com as described at /legal/vulnerability-disclosure.
Section 14
Your privacy rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to its processing and withdraw your consent. The sections below describe the rights available in specific regions.
We honor these rights as required by applicable law, and we will not discriminate against you for exercising them.
Section 15
European Economic Area, United Kingdom and Switzerland
You have the right to access, correct and erase your personal information, to restrict its processing, to object to processing based on legitimate interests, to receive your information in a portable format and to withdraw consent at any time.
You also have the right to lodge a complaint with the data protection authority where you live or work, or where you believe an infringement took place. We would appreciate the chance to address your concern first, so please contact us at privacy@hubzoid.com.
Section 16
California
This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). In the past 12 months we have collected the categories of personal information listed below, from the sources described in this policy, for the purposes described in How we use information.
Identifiers, such as your name, email address, IP address and cookie identifiers.
Professional or employment-related information, such as your company, role, team and company size.
Internet or other electronic network activity, such as the pages you view, your interactions with the website and, with your consent, session recordings.
Approximate geolocation derived from your IP address.
Commercial information, such as records of services your organization has purchased from us.
The content of messages and requests you send us.
We disclose each of these categories to service providers for business purposes such as hosting, analytics, email delivery and business communications. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.
You have the right to know what personal information we collect, use and disclose, to access it, to delete it, to correct inaccurate information and to opt out of its sale or sharing. We honor Global Privacy Control signals as a request to opt out. We will not discriminate against you for exercising these rights.
You may use an authorized agent to make a request. We may ask the agent for proof of authorization and ask you to verify your identity with us directly. We keep each category of personal information for the periods described in How long we keep information.
Section 17
India
This section applies to individuals in India under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.
We process your personal data with your consent or for legitimate uses permitted by the DPDP Act, including where you voluntarily provide it for a specified purpose, such as sending a project request or email, and have not indicated that you do not consent to its use.
You have the right to obtain a summary of the personal data we process about you and of our processing activities, to know the identities of those with whom we have shared it, to have it corrected, completed, updated or erased, to withdraw consent at any time as easily as you gave it, to have your grievances addressed and to nominate another person to exercise your rights in the event of your death or incapacity.
For requests or grievances, contact us at privacy@hubzoid.com. We will respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Section 18
Other locations
Residents of other US states with comprehensive privacy laws, and people in other countries, may have similar rights under local law, including the right to appeal our decision on a request. We will honor these rights as required by applicable law.
Section 19
How to exercise your rights
To make a request, email privacy@hubzoid.com and tell us what you would like us to do. We will not charge a fee unless a request is manifestly unfounded or excessive.
We verify requests by confirming that you control the email address associated with the information, and we may ask for more information where needed to protect your data. We respond within the time required by applicable law, which is one month under the GDPR and 45 days under the CCPA, extendable where the law allows.
If we decline a request, we will explain why. You can appeal by replying to our decision, and we will review it and tell you the outcome.
If your request relates to data we process for a customer during implementation services, we will pass it to that customer and support them in responding.
Section 20
Children's privacy
Our website and services are intended for businesses and professionals and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact privacy@hubzoid.com and we will delete it.
Section 21
Changes to this policy
We may update this policy to reflect changes in our practices, services or legal requirements. The date at the top shows when it was last updated. If we make material changes, we will post a notice on the website and notify customers by email. Where the law requires your consent to a change, we will ask for it.
Section 22
Contact us
For privacy questions, requests or grievances, email privacy@hubzoid.com. For general enquiries, email contact@hubzoid.com. To report a security issue, email security@hubzoid.com.