Privacy Policy

The data controller for the personal data described in this policy is HubsTime, a sole proprietorship (enkeltmandsvirksomhed), CVR 46664183, Dybkjærvej 23C, 8200 Aarhus N, Denmark. You can contact us about any privacy matter at admin@hubstime.com.

We have not appointed a data protection officer; please send privacy questions to the email address above.

We collect the personal data listed below. To create an account you must give us your name and email address and, unless you sign in with Google or Microsoft, a password; without them we cannot create your account. Everything else is optional, but some features need it — for example, a purchase needs payment details, which you give to Stripe.

• Account details: your name and email address, a password hash if you sign up with a password, your interface language, the time of your latest sign-in, the username we create for you, and the country and city we estimate from your IP address when you sign up or sign in.
• Sign-in details from Google or Microsoft, if you sign in with them: an account identifier, your email address and name, and, from Google, a link to your profile picture.
• Your public profile: every account has a public profile page at hubstime.com/u/ followed by your username, from the moment the account is created. It shows your name, your username and when you joined, any public hub you own, and the published courses in public hubs that you own or wrote. We create your username from your name, or from the part of your email address before the @ if your name has no Latin letters; you can change it in your profile settings. Anything else you add — display name, bio, location, photo, social links, or a profile built from a CV you upload — is shown there too, and, if you turn on "Show learning activity on public profile" in Settings, the courses you have completed that are listed on Explore, with each course's hub and the month you completed it. You cannot currently hide this page.
• What you create and upload: course material, knowledge-base documents and web addresses, and the topics and instructions you give for course generation.
• Your activity: hub memberships, enrolments and learning progress, follows, hearts and ratings.
• Hub details, if you run a hub: its name, description, logo, banner, website, social links and billing email.
• Payment records: your purchases, subscriptions, wallet balance and credit history, and Stripe payment references; if you sell on HubsTime, your Stripe payout account identifier.
• Invitations: the email addresses of people a hub invites, and the name of the person who sent the invitation. If you were invited to a hub, we received your email address from the hub owner or admin who invited you; you can object, or ask us to delete the invitation, by emailing admin@hubstime.com.
• Notifications we show you, such as hub invitations, which include the name of the person who invited you.
• Messages you send us by email.
• Technical data: IP addresses, browser user-agent, request times and error logs.

For each purpose, we rely on the following legal basis:

• Providing your account and the service — course generation and its automated quality review, hosting, enrolment, your public profile and the CV-based profile draft — performance of our contract with you (Art. 6(1)(b)).
• Processing payments, subscriptions, wallet credits and payouts to sellers through Stripe — performance of a contract (Art. 6(1)(b)).
• Sending account emails, such as email verification and password reset — performance of our contract with you (Art. 6(1)(b)).
• Sending a hub invitation to an email address that a hub owner or admin enters — our and the inviting hub's legitimate interest in delivering the invitation (Art. 6(1)(f)).
• Rate limits, abuse prevention, delivering our website and protecting it against attacks through a website delivery and security provider (Section 6), and the security log of account activity, including IP addresses and browser user-agent — our legitimate interest in keeping HubsTime secure and available (Art. 6(1)(f)).
• Estimating your country and city from your IP address when you sign up or sign in, and using it in our internal statistics — our legitimate interest in security and in understanding where HubsTime is used (Art. 6(1)(f)).
• Anonymous sessions for visitors who are not signed in (Section 4) — to protect the service from abuse and, if you sign in while the session is still valid, to carry your choices into your account — our legitimate interest (Art. 6(1)(f)).
• Keeping server logs (IP address, requested web address and errors) for 30 days to run and fix the service, keeping AI responses for up to 7 days so that an identical request is not charged twice, and giving our administrators access to account data for support — our legitimate interest in operating HubsTime reliably and fairly (Art. 6(1)(f)).
• Keeping accounting records — our legal obligation under the Danish Bookkeeping Act, bogføringsloven (Art. 6(1)(c)); Section 7 explains what we keep today.
• Marketing emails — your consent (Art. 6(1)(a)). We do not send any today; if we ever do, you will be able to withdraw your consent at any time.

If you are not signed in, you cannot type or add files in the course builder on our home page. If you click its options, we may still create an anonymous session: a cookie and an entry in your browser's local storage (see Section 11), and a record holding your choices, your IP address and your browser user-agent. The session stops working one hour after it starts.

We do not yet delete expired anonymous sessions automatically, nor any files staged in them (visitors could add files in earlier versions of the site); they stay on our servers until we delete them. You can ask us to delete yours at any time by emailing admin@hubstime.com.

Before you sign in, nothing in an anonymous session is sent to an AI provider, indexed or used for training. If you sign in while a session is still valid, it moves into your account: if you do not own or manage a hub, or you choose "Create a new hub for this course" when we ask which hub to use, we create one named after you (for example "Sara's Hub"), which is public — listed on Explore and on your public profile — until you turn off "Public Hub" in its settings; we create a knowledge base in your hub and add any staged files to it, processed as Section 6 describes; and a staged topic, if there is one, starts a course generation. We keep the record of a session that has moved into an account, including its IP address and user-agent, with no fixed deletion date yet.

We use your IP address for the purposes listed below. We never share it for marketing or analytics. Our hosting provider processes it as part of running the service; our website delivery and security provider receives it with every request to our website, hubstime.com and www.hubstime.com (Section 6); and when your browser opens Stripe's payment page, Google or Microsoft sign-in, or content embedded from another website, that service receives your IP address directly.

• To apply rate limits, in short-lived counters kept for 1 to 24 hours.
• In a security log of account events — sign-ups, sign-ins, email verification, password resets, hub invitations and changes to a hub's team, and certain hub, course, enrolment, billing and generation actions — which also records your browser user-agent and details of the event (see Section 7).
• To estimate your country and city when you sign up or sign in, using a geolocation database on our own servers (MaxMind GeoLite2), so your IP address is not sent to MaxMind. We store the country and city of your latest sign-in on your account, and the location estimated for each event with its security-log entry, and HubsTime's administrators can see them.
• In the record of an anonymous session (Section 4).
• In our server logs, together with the web address requested, for 30 days.

We use the service providers below to run HubsTime. Some work only on our instructions, as our processors; others, as noted, handle your data under their own privacy policies. Some of these providers process data outside the EU/EEA, including in the USA: a transfer to the USA relies on the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795) where the provider is certified under the EU–US Data Privacy Framework, and any other transfer relies on an adequacy decision for the country concerned or, where there is none, on the European Commission's Standard Contractual Clauses. You can ask us at admin@hubstime.com for a copy of these safeguards and for the current list of our service providers.

• Cloud hosting (EU) — our hosting provider runs the whole service in the EU: application servers, database, file storage, cache, secrets and server logs.
• Website delivery and security (USA) — every request to our website, hubstime.com and www.hubstime.com, passes through this provider's network, which delivers the pages and protects the website against attacks and abuse. It receives your IP address, the request headers your browser sends, including the language cookie, the pages we send back, and the web address you request, which for some pages contains a one-time code or a sign-in token — for example the link in a password-reset email, or the page you return to after signing in with Google or Microsoft. What your browser sends to our API at api.hubstime.com — for example your password when you sign in, the course descriptions you type and the documents you upload — does not pass through this network. The provider may block, or ask to check, requests that look automated or abusive; its dashboard shows us statistics about the traffic to our website and can show us individual requests, including requests it did not block or check, with details such as their IP address, browser user-agent and the web address requested, for up to 31 days. It acts as our processor for what passes through its network, and as an independent controller for some data about this traffic, for example to secure and improve its network, under its own privacy policy.
• AI model providers (EU and USA) — write and review the courses you generate, build the search index of your knowledge bases, and turn your CV into a profile draft if you use the CV option on your profile; which provider writes a course depends on the quality level you choose. They receive the course description and instructions you give, the course outline and the generated content, the passages retrieved from a knowledge base you attach, the text of the documents you add to a knowledge base and the searches run against it, and the text read from your CV. We do not send your name, email address or account ID as separate fields, but anything you type or upload is sent as written. Under their terms, these providers do not use this data to train their models.
• Stripe — processes payments on its own hosted payment pages, so we never receive your full card number. Stripe receives your name and email address (for a hub's wallet, the hub's name instead of yours), what you are buying and the amount, and reference numbers that link the payment to your account. If you sell on HubsTime, Stripe collects your identity and bank details directly to verify you and pay you out. Stripe also acts as an independent controller for some data, for example for fraud prevention and its own legal obligations, under Stripe's privacy policy. Stripe, LLC is certified under the EU–US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision.
• Email delivery (EU and USA) — our email provider sends our emails: email verification, password resets and hub invitations, including invitations to people who do not have an account yet. It receives the recipient's email address and the message, which for invitations includes the hub's name and the name of the person who sent it.
• Our mailbox (USA) — our @hubstime.com mailboxes are hosted by a provider, so emails you send us, including privacy requests, are stored with it.
• Google and Microsoft sign-in — if you choose to sign in with them, they confirm your identity and send us the details listed in Section 2, under their own privacy policies.
• Content from other websites — some courses and profiles include videos or images that their authors chose to embed, for example from YouTube, Vimeo, Figma or Spotify. When such a page opens, your browser connects to that service, which receives your IP address and may set its own cookies under its own privacy policy.
• Other HubsTime users — your public profile page, which every account has (Section 2), can be seen by anyone, including search engines. Hub owners and admins can see the enrolments and progress of learners in their courses, and the name and email address of the members of their hub's team, and the name of the person who created a course or owns a hub is shown on its public pages. When you subscribe to a hub, the payment goes to the hub creator's own Stripe account, so you become the creator's customer and the creator receives your email address.
• People who run HubsTime — our administrators can access account data to provide support and keep the service secure, including by signing in as a hub's owner for up to one hour, which is recorded in the security log.

We do not yet delete every category of personal data automatically once its purpose has ended, and we will update this policy when we set a fixed period where none exists yet. This is how long we keep each category today:

• Account record (name, email address, password hash, profile, preferences and the country and city of your latest sign-in): until you delete your account. Copies remain in our database backups for up to 7 days.
• Profile photo and other profile images: not yet removed from file storage when you delete your account; email us and we will delete them.
• Enrolments, progress, follows, hearts, ratings and hub memberships: until you delete them or your account.
• Courses: deleting a course hides it, but we keep the course and its content.
• Knowledge bases: deleting a knowledge base hides it but keeps its documents and search index, so that courses already made from it can still show their sources. Deleting a single document removes it, its search index and its stored file; file storage keeps a recoverable copy for 7 days.
• Hubs: when you delete your hub yourself, we hide it and its courses, and nobody can open them any more, including the learners enrolled in them. We keep its records in our database: its courses and their content, enrolments, memberships, followers, knowledge bases and their documents, generation history, and its sales, refund and billing records. We keep the sales, refund and billing records for at least 5 years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires (bogføringsloven § 12). We do not yet delete the other records, or the stored files behind them — course content, uploaded documents and course materials — automatically; email us if you want them deleted. When HubsTime's administrators close a hub, it is hidden and its data is kept.
• Course-generation requests: the topics, instructions and settings you submit are stored with the generation request, with no fixed deletion date yet; deleting the course, the hub or your account does not delete them. The topic you type is also copied into our security log, which keeps it after the course, the hub or your account is deleted, with no fixed deletion date yet.
• AI response cache: to avoid charging twice for an identical request, we keep AI providers' responses — including a profile draft built from a CV — for up to 7 days on our server's temporary disk. After 7 days a response is never reused, and it is cleared from that disk over time and whenever the server restarts.
• CVs: we do not store the CV file itself. Only the profile fields you choose to save are added to your profile, and the file name is kept on the matching entry in your credit history.
• Anonymous sessions: see Section 4 — there is no automatic deletion yet.
• Server logs, including IP addresses and requested web addresses: 30 days.
• Rate-limit counters: 1 to 24 hours.
• Security log (IP address, browser user-agent, approximate country and city, and details of the event — for sign-ups your email address; for invitations the invitee's email address, including people who have no account; for course generations the topic you typed; course titles, hub names and top-up amounts; and, for actions our administrators take on a hub, the reason they give and, if they sign in as the hub's owner for support, that owner's email address): no fixed deletion date yet, and it is kept after you delete your account or your hub.
• Invitations: the invitee's email address is kept with the invitation and in our security log, with no fixed deletion date yet.
• Payment and credit records: when you delete your account, we keep the records of your purchases, your wallet and your credit history for at least 5 years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires (bogføringsloven § 12); we do not yet delete them automatically after that. We remove what links them to your account, but they keep amounts, dates, what each entry was for and payment references, which our account with our payment provider can connect to you. Our account with our payment provider also keeps your name, email address and any card saved for a plan, with no fixed deletion date yet.
• Emails you send us, including privacy requests: kept in our mailbox until we delete them; we do not yet delete them automatically.
• Accounting records: the Danish Bookkeeping Act (bogføringsloven § 12) requires us to keep accounting records for 5 years from the end of the financial year they relate to.
• Stripe, our email provider and our website delivery and security provider keep their own records under their own policies; the website delivery and security provider's dashboard can show us individual requests to our website, including their IP address, for up to 31 days (Section 6). Our AI model providers may keep what we send them for a limited period to detect misuse, and do not use it to train their models.

For personal data about a hub's learners and members, such as enrolments and course progress, HubsTime is the data controller. The hub's owners and admins can see the enrolments and progress of learners in their courses, and can remove an enrolment.

If a hub owner puts personal data about other people into their courses or knowledge bases, the hub owner decides what to include and must have a lawful basis for it. You can send requests about data in a hub directly to us.

Under the GDPR, and subject to its conditions, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased — you can delete your account yourself in Settings, within the limits in our Terms of Service (Section 14), or email us; Section 7 lists what we keep after deletion;
• restrict our processing in certain circumstances;
• receive your data in a portable, machine-readable format — there is no export button yet, so email us;
• withdraw any consent you have given, at any time, without affecting processing that took place before;
• complain to Datatilsynet, the Danish Data Protection Agency (Section 15).

Where we process your data on the basis of our legitimate interests — for example the security log, rate limits and location estimates described in Sections 3 and 5 — you can object at any time, on grounds relating to your particular situation, by emailing admin@hubstime.com. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

HubsTime itself sets only the two cookies below. Neither is used for advertising or to track you across websites.

• __Host-hubstime_anon_session — the anonymous session for visitors who are not signed in (Section 4). HttpOnly, Secure, SameSite=Strict; it expires after 1 hour.
• NEXT_LOCALE — your interface language (en, ar or da). It is set when you open HubsTime or choose a language, and is kept for up to one year.
• Local storage: your sign-in tokens are kept in your browser's local storage, not in cookies, so your browser does not send them automatically when another website makes a request to HubsTime. The token that keeps you signed in stays the same until it expires after 7 days, or until you sign out. We also keep a few other things there: which tips and tours you have seen or dismissed, and when; and, if you click the course builder's options before signing in, your anonymous session's ID, which stays in your browser until you sign in or clear this site's data. For the current tab only (session storage), we note whether the home-page animation has played and whether your language has been synced.
• Embedded content: when a course page with a YouTube video opens, YouTube sets its own cookies in your browser straight away — some kept for about six months — before you press play and without asking for your consent. Other embedded sites, for example Vimeo, Figma, Spotify or image hosts, can do the same.
• Website delivery and security: on an ordinary visit our provider sets no cookie; if it checks whether a request comes from a real browser, it may set its own security cookie, such as cf_clearance, which it describes as strictly necessary.
• Analytics: we do not use any website-analytics or advertising service, and no analytics script runs in your browser; for our website, the dashboard of our website delivery and security provider shows us traffic totals, such as the number of requests and visitors, and requests by country, and can show us individual requests (Section 6). If we add analytics, we will update this policy and ask for your consent before any analytics runs.

We protect your data with encryption in transit (HTTPS) and our hosting provider's encryption of stored data, and we limit access to the people who run HubsTime.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you (GDPR Article 22).

HubsTime is meant for people aged 16 or over (Terms of Service, Section 3). We do not ask your age when you sign up, and we do not knowingly collect personal data from children under 16. If you believe a child under 16 has an account, email admin@hubstime.com and we will delete it.

We may update this policy as HubsTime changes. When we do, we update this page and the date at the top. If a change is material, we will also email you at least 15 days before it takes effect.

You can contact us about any privacy question at admin@hubstime.com. To use your rights, email us — from the address on your account if you have one, so that we can confirm the request is yours; if you do not have an account, tell us what the request is about, for example the address an invitation was sent to, and we may ask for information to confirm it is yours. We will respond without undue delay and within one month; for complex requests we may extend this by up to two further months and will tell you why. Using your rights is free of charge.

If you are unhappy with how we handle your data, you can complain to Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk.