Privacy Policy — HubKard

Last updated: March 2026

1. Who We Are

This service is operated by HubKard ("we", "us", "our"), based in Kaštel Novi, Croatia. The HubKard suite includes the Bookings, Inventory, Menus, Reviews and Marketing modules — restaurant management tools for independent restaurants and hospitality businesses.

Contact: privacy@hubkard.io (interim: hrvoje.malenica@gmail.com)

2. What Data We Collect

We collect only what's necessary to provide the service:

Data	Purpose	Legal Basis
Email address	Account authentication	Contract
Password (hashed)	Authentication	Contract
Full name	Personalization	Contract
Organization/restaurant name	Multi-tenant data scoping	Contract
Business data (recipes, ingredients, transactions, employees, etc.)	Core service functionality	Contract
Avatar photo (optional)	Profile personalization	Consent
Language preference	UI localization	Contract

We do not collect: payment card details (handled by payment processor), precise location data, device fingerprints, or any data from your POS system beyond what you explicitly upload.

3. How We Protect Your Data

Encryption in transit: All connections use TLS/HTTPS.
Encryption at rest: Database encrypted via AWS infrastructure (Supabase).
Row-Level Security: Each organization's data is isolated at the database level. Users can only access data belonging to their organization.
Password hashing: Passwords are hashed with bcrypt. We never store or see your plaintext password.
Session security: Authentication uses httpOnly cookies that cannot be accessed by JavaScript.
Daily backups: Database is backed up daily with point-in-time recovery.

4. Data Hosting & Transfers

Your data is hosted on Supabase (AWS EU region). The application is served via Vercel (global CDN). Both providers maintain EU-adequate data protection standards and process data under Standard Contractual Clauses where applicable.

5. Your Rights (GDPR)

Under EU GDPR, you have the right to:

Access your personal data — request a copy of everything we store about you.
Rectification — correct inaccurate data in your profile.
Erasure — request deletion of your account and all associated data.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interest.

To exercise any of these rights, contact privacy@hubkard.io. We will respond within 30 days.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data is permanently deleted within 30 days. Backups are purged within 90 days. Files your team attaches to a booking (for example a menu or an event brief) are deleted automatically 12 months after the date of that booking.

7. Cookies

HubKard uses only essential cookies for authentication (httpOnly session cookies managed by Supabase). We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required because we only use strictly necessary cookies.

8. Third-Party Services

Service	Purpose	Data Shared
Supabase	Database, auth, storage	All application data
Vercel	App hosting & CDN	None (static files only)
Google OAuth (MarketPilot)	Google Search Console & Analytics access	OAuth tokens, email
Anthropic Claude API (MarketPilot)	AI-powered marketing analysis	Business profile, anonymized metrics
Stripe (future)	Payment processing	Email, plan selection

9. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify you via email or in-app notification of any material changes.