Legal
Privacy policy
How Hubber handles personal data — both the data we hold about our own customers, and the data our customers hold about their clients and staff inside the software.
Last updated: 3 November 2026
1. Who we are
Hubber is job management software for trade and field-service businesses, provided at gethubber.com. In this policy, "Hubber", "we" and "us" mean [TO CONFIRM: registered company name and number], registered at [TO CONFIRM: registered office address].
We are registered with the UK Information Commissioner's Office under registration number [TO CONFIRM: ICO data protection fee registration number]. We have not appointed a Data Protection Officer — [TO CONFIRM: confirm whether a DPO is required or has been appointed]. Privacy questions go to ryan@rrwebdesign.co.uk.
2. Controller and processor — the important distinction
Hubber is business-to-business software. Each business that subscribes (a "Customer") gets its own separate, isolated workspace. That matters for who is legally responsible for the data in it.
| Data | Controller | Hubber's role |
|---|---|---|
| Your clients' data (names, addresses, jobs, photos, quotes, invoices, messages) | The Customer — the business using Hubber | Processor. We only process it on the Customer's instructions. |
| The Customer's staff and HR records (contracts, licences, DBS checks, payroll, leave, incidents, cases) | The Customer — the employer | Processor. |
| The Customer's own account data (account owner name, email, login, subscription and billing records, support correspondence) | Hubber | Controller. |
| Website visitors to gethubber.com | Hubber | Controller. |
3. What data is in Hubber
Data Hubber holds as controller (about our own customers)
- Account details: name, email address, username, and a hashed password (bcrypt).
- Organisation details: company name, branding, settings, role assignments, and team invitations.
- Subscription and billing records: plan, subscription status, and the identifiers returned by Stripe. We never see or store card numbers.
- Support correspondence you send us.
Data our Customers put into Hubber (we are processor)
The software is broad, so the list is long. Being specific is deliberate — you should be able to see exactly what the platform is capable of holding.
| Category | Examples held in the system |
|---|---|
| Client contacts | Names, email addresses, phone numbers (including E.164 format for WhatsApp), postal addresses, geocoded address coordinates, lead source, notes, tags and custom fields. |
| Job records | Pickup and delivery addresses and coordinates, dates and times, special instructions, surveys of a property and its contents, quotes, line items, invoices and job costs. |
| Photos and video | Job media (photographs and video of premises and belongings, which may carry GPS coordinates captured by the device), incident photographs, expense receipts, staff profile photos and document scans. |
| Electronic signatures | Signature images, typed names, timestamps and — for quote approvals and staff contract signing — the signer's IP address. |
| Staff and HR records | Names, dates of birth, home addresses, emergency contacts, pay rates and payroll statements, working time and clock-ins, leave (including sick leave), driving licence and CPC details, DBS check details, right-to-work and medical compliance checks, uploaded documents and contracts, training records and declarations, performance reviews, grievance and disciplinary cases, and recruitment applicants and CVs. |
| Health-related data | Workplace incident reports can record injury details and treatment given; compliance checks can record a medical check; leave requests can record sickness absence. This is special category data under UK GDPR. |
| Payment records | Invoice amounts and status, payment attempts, refunds and chargebacks, and provider reference identifiers. No card numbers, expiry dates, security codes or bank details are stored in Hubber — those stay with the payment provider. |
| Communications | Internal staff chat messages and attachments, notifications, activity logs, email and message templates, outbound message delivery records (including the recipient address or number and the personalisation values used), inbound WhatsApp messages, and consent and opt-out records. |
| Consent records | Where a Customer sends WhatsApp or marketing messages, the platform records who consented, for what purpose (operational or marketing), when, from what source, and any later withdrawal — including automatic opt-out when a recipient replies STOP. |
| Access and identity | Login sessions, NFC staff badge tokens (stored only as a SHA-256 hash — the badge value itself is never stored), audit records when a platform administrator accesses an account for support, and the browser/device identifier and user agent for any device signed up to push notifications. |
| AI assistant logs | When staff use the in-app AI assistant, the question they typed is stored (truncated) alongside token counts and cost, so usage can be audited and billed. The assistant's answers are not stored. |
Mailbox data (optional Connected mailboxes)
A Customer can connect a mailbox so Hubber can find supplier invoices and receipts. This is optional and off until someone with the right access connects one. Hubber supports Google (Gmail and Google Workspace), Microsoft (Outlook, Microsoft 365) and other email providers. For Google and Microsoft we ask only for permission to read mail (never to send, change or delete it); for other providers the Customer gives an app password, which Hubber uses only to read the inbox. Hubber looks only at the inbox and never marks an email as read. Emails that look like an invoice or receipt are kept so they can be saved as a bill; other emails are not kept. Sign-in tokens and app passwords are stored encrypted and are deleted when the mailbox is disconnected. A Microsoft Customer should also remove Hubber from their Microsoft account's app list, as only they can do that. Mailbox data is used only to bring in invoices for that Customer and is never used for advertising. Invoice and receipt emails that Hubber brings in are sent to an AI provider (OpenAI) to read the supplier, date and amount; those requests are sent with storage disabled, and the content is not used to train models.
4. Why we use it, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the software to a Customer under their subscription | Contract (Art. 6(1)(b)) with the Customer. For data about their clients and staff, Hubber acts on the Customer's instructions and the Customer determines the basis. |
| Taking subscription payments and preventing non-payment | Contract, and legitimate interests in being paid. |
| Keeping the service secure — rate limiting, audit logs, access control | Legitimate interests in protecting the platform and its users. |
| Service emails to account holders (invites, billing notices, security notices) | Contract and legitimate interests. |
| Meeting our own legal and accounting obligations | Legal obligation. |
| Special category data (health, e.g. incident injury details, sickness absence) | Determined by the Customer as employer — typically Art. 9(2)(b), employment and social protection law. Hubber only stores it on their behalf. |
5. Sub-processors
We use the following third parties to run the service. Each receives only what it needs for its function. Several are optional features that transmit nothing at all unless a Customer turns them on.
| Sub-processor | What it does and what it receives | Location |
|---|---|---|
| Supabase | Hosts the PostgreSQL database (all application data) and the private file storage buckets holding staff documents, job media, chat attachments and depot maps. Files upload directly from the browser using short-lived signed URLs. | London, UK (eu-west-2) |
| Vercel | Hosts the application and its API. All web traffic passes through it, and it holds platform request logs. | London, UK (lhr1) |
| Resend | Sends system and customer-facing email — recipient address, subject, message body and any attached PDF (invoice, quote, job sign-off certificate, survey, payroll statement, rota). Optional: without an API key, no email is sent. | [TO CONFIRM: Resend hosting region and transfer safeguard] |
| Stripe | Hubber's own subscription billing only. Receives the account owner's name and email and an internal user reference. No client or staff data is sent to Stripe. Card details are entered on Stripe's own hosted checkout and never reach Hubber. | [TO CONFIRM: Stripe hosting region and transfer safeguard] |
| Mollie | Customer invoice payments, where a Customer connects their own Mollie account. Receives the payer's name and email address, the amount, an invoice reference and a return link. Card and bank details are entered on Mollie's hosted page and never reach Hubber. Optional and off by default. | [TO CONFIRM: Mollie hosting region and transfer safeguard] |
| Mapbox | Address geocoding, distance estimates and route optimisation, plus map tiles in the browser. Receives job pickup and delivery addresses and coordinates. Optional: without an access token, addresses are never sent. | [TO CONFIRM: Mapbox hosting region and transfer safeguard] |
| OpenAI | Powers the optional in-app AI assistant and the reading of supplier invoices and receipts (bills) that a Customer uploads, forwards or brings in from a connected mailbox. Receives the question a staff member types plus whatever CRM records the assistant needed to answer it, and, for bills, the invoice or receipt file or email text. Requests are sent with storage disabled, so OpenAI does not retain them. Off unless enabled for a Customer. | [TO CONFIRM: OpenAI hosting region and transfer safeguard] |
| Meta Platforms (WhatsApp Business Platform) | Sends and receives WhatsApp messages where a Customer connects a WhatsApp Business account. Receives the recipient's phone number in E.164 format, the message template and the personalised message content (such as name, job reference and date), and delivers inbound replies back to us. Optional, off by default, and further gated by a separate sending switch and a per-account allowlist. | [TO CONFIRM: Meta hosting region and transfer safeguard] |
| Web push services | Delivers push notifications to staff devices. The push service is chosen by the recipient's own browser (typically Google, Apple or Mozilla). It receives the device endpoint and an encrypted payload containing a short notification title, body and link. Optional: without VAPID keys configured, nothing is sent. | Determined by the recipient's browser |
| Google (Gmail) and Microsoft (Outlook, Graph) | Only where a Customer connects a mailbox. Hubber receives the mailbox's inbox emails through the provider's read-only mail permission and the sign-in tokens needed to keep reading. Optional and off by default. | Determined by the Customer's own provider |
| Other email providers (IMAP) | Only where a Customer connects a mailbox with an app password. Hubber connects to that provider's mail server to read the inbox. Optional and off by default. | Determined by the Customer's own provider |
| Google Fonts | Serves the two typefaces used on the site. A visitor's browser requests the font files directly from Google, which means Google receives the visitor's IP address, browser user agent and referring page on every page load. | [TO CONFIRM: whether to self-host these fonts instead, to remove this transfer entirely] |
We will keep this list current. Customers are told before we add a sub-processor that handles their data.
6. International transfers
The database, file storage and application hosting are all in the United Kingdom. Some of the sub-processors above are, or may be, outside the UK — in particular the email, payment, mapping, AI and WhatsApp providers. Where personal data is transferred outside the UK we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
[TO CONFIRM: the exact transfer mechanism in place with each non-UK sub-processor, and whether a transfer risk assessment has been completed]
7. How long data is kept
In practice that means retention is decided by the Customer, as controller of their own client and staff records. Customers should set and apply their own retention schedule — for example, employment records are commonly kept for six years after a person leaves, and accounting records must be kept for six years under UK tax law.
For data where Hubber is the controller — account and subscription records — we intend to keep them for [TO CONFIRM: retention period for closed accounts, e.g. 90 days before deletion] after an account closes, and to keep billing records for six years to meet HMRC requirements.
One thing worth knowing before you rely on deletion: deleting a client contact in the app removes the contact record, but it does not automatically remove every related job, invoice, quote or photograph that references them. A complete erasure request is handled by us directly — see the data deletion page.
8. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data held about you.
- Rectification — have inaccurate data corrected.
- Erasure — have data deleted, where there is no overriding legal reason to keep it.
- Portability — receive your data in a structured, machine-readable format. Hubber can export the main records as CSV.
- Restriction and objection — ask us to pause processing, or object to processing based on legitimate interests.
- Withdraw consent — where processing relies on consent, including marketing messages. Replying STOP to a WhatsApp message from a business using Hubber records an immediate opt-out.
To exercise any of these, email ryan@rrwebdesign.co.uk. If your data sits inside a Customer's workspace, we will route the request to them, as they are the controller. We aim to respond within [TO CONFIRM: target response time — the statutory maximum is one month]. You can also complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
9. Cookies and local storage
Hubber does not use advertising cookies, tracking pixels or third-party analytics. There is no Google Analytics, no advertising network and no session-recording tool anywhere in the product or on this website.
- Session cookie — a single strictly necessary cookie keeps you signed in. It expires after seven days, or after 30 days if you tick Save login on this device.
- Local storage — the app remembers interface preferences, such as which sidebar sections you left open, in your own browser. If you tick Save login on this device, it also stores your username on that device so the sign-in page can fill it in. It never stores your password, and it never leaves your device.
- Public quote form pages record the page address, referring page and any UTM campaign tags on a submitted enquiry, so the business can see where the enquiry came from.
- Facebook SDK — only on the Communications settings page, and only after you tap to connect a WhatsApp account. It is loaded with cookies disabled.
10. How we protect data
- All traffic is served over HTTPS.
- Passwords are stored as bcrypt hashes, never in readable form.
- Third-party access tokens — WhatsApp and payment provider credentials — are encrypted before they are stored, with key versioning for rotation.
- Staff badge tokens are stored only as SHA-256 hashes, so a database leak cannot yield a working badge.
- Files live in private storage buckets. They are never publicly addressable; every download goes through a short-lived signed URL issued only to an authorised user.
- Every record carries an organisation identifier and every query is scoped to it, so one Customer's workspace cannot read another's. Row-level security is enabled on all database tables as a second line of defence.
- Role-based access control governs every feature. Sensitive HR areas — payroll, compliance checks, employee relations cases — default to no access for most roles and must be granted deliberately.
- Login and public token endpoints are rate limited. Public links (payment, quote, portal, contract) are long random capability tokens that can be revoked or rotated.
- Platform administrator access to a Customer's account for support is possible but always written to an audit log recording who, when and why.
11. Data breaches
If a personal data breach occurs and it is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where Hubber is a processor, we will notify the affected Customer without undue delay so they can meet their own obligations, and we will give them the information they need to do so. Where the risk is high, we will also inform the individuals affected directly.
12. Children
Hubber is business software and is not directed at children. We do not knowingly collect data from anyone under 16 in our own capacity as controller.
13. Changes to this policy
We will update this page when the service changes. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle personal data, we will tell account holders by email before it takes effect.
14. Contact
Email ryan@rrwebdesign.co.uk for any privacy question, data request or complaint. Postal address: [TO CONFIRM: registered office address for written data requests].