Privacy Policy

We collect the minimum information needed to operate the platform: account data you provide (name, email, password hash if you sign up with a password), data you upload (course material, knowledge-base files, generation prompts), and operational signals (request timestamps, IP addresses for rate-limiting, error traces).

We do not run third-party advertising trackers and do not sell or rent personal data to anyone.

Visitors to the landing page can drop files into the chat-bar without signing up. These files are stored in a per-session staging container and the session itself expires automatically.

• Anonymous file & session TTL: 1 hour. Files are purged automatically when the session expires.
• If you sign up before the timer runs out, your staged files migrate into a fresh knowledge base on your new (or chosen) hub. If you do not sign up, the files are deleted along with the session row.
• No anonymous-session content is shared, indexed, or used for training.

We use your IP address only for rate-limiting and basic abuse prevention. The address is held in a Redis sliding-window counter for the duration of the relevant rate-limit window (1–24 hours depending on the endpoint) and is not stored long-term.

IP addresses are never shared with third parties for marketing or analytics. They appear in operational logs alongside ordinary request metadata, retained for the standard server-log lifetime (typically 30 days).

HubsTime uses a small number of third-party services to deliver the product. Each is contractually obligated to handle data only for the purposes we direct.

• OpenAI — content embedding and language-model generation. Course prompts and ingested knowledge-base text are sent to OpenAI under the OpenAI API terms; no training on customer data.
• Anthropic & Google — alternate language-model providers for premium recipes (Claude, Gemini). Same posture as OpenAI: per-API terms, no training on customer data.
• Stripe — payment processing. Card details never touch HubsTime servers.
• Microsoft Azure — hosting (Container Apps, Postgres, Blob storage, Redis).

Hubs, courses, knowledge bases, and uploaded documents you create are retained as long as your account is active.

Wallet ledger entries and invoice records are retained for the period required by accounting and tax law (currently 7 years in most jurisdictions we serve), even after account deletion. These records are anonymised where possible.

You can delete your account at any time from settings. Deletion removes your hubs, courses, knowledge bases, and personal profile. Wallet/invoice history is retained as described above for accounting compliance.

If you need to make a deletion request outside the in-app flow (for example to remove data tied to a hub you do not own), email support@hubstime.com from the address attached to your account.

HubsTime uses a small set of strictly-functional cookies. We do not place advertising or cross-site tracking cookies.

• __Host-hubstime_anon_session — HttpOnly, SameSite=Strict, Secure. 1-hour TTL. Holds the anonymous-session reference for landing-page visitors so files staged before signing up follow the user through.
• NEXT_LOCALE — your selected language preference (en/ar). Persisted across visits.
• Auth tokens are stored in localStorage by default (not in cookies) so they are never sent on cross-site requests; refresh tokens rotate on every refresh.

HubsTime is not directed at users under 16. We do not knowingly collect personal data from children. If you believe a minor has created an account, contact us and we will delete the account.

We may update this policy as the product evolves. Material changes will be announced in-product and via email to the address on your account before they take effect. The "Last updated" date below tracks the most recent change.