Hubitos Privacy Policy

Hubitos collects only the information needed to operate the workspace and connected publishing workflows.

• Account information such as name, email address, user identifier, and workspace preferences.
• User-provided content such as prompts, draft posts, captions, uploaded attachments, generated files, and workflow configuration.
• Authorization metadata from connected services, including provider name, granted scopes, connected account identifiers, and token status.
• Basic product usage and diagnostic information such as feature events, error logs, device or browser information, and app version.

Depending on the features you use, these categories also include:

• Login and account-security information, such as an email address or phone number, password authentication records, verification events, login sessions, and identifiers returned by a sign-in provider. Signing in with Google or another provider does not by itself authorize social publishing or access to unrelated account data.
• Connected social-account information, such as account and channel identifiers, display names, profile images, Facebook Pages, granted permissions, connection status, posts, publishing receipts, and permitted engagement or performance information.
• Content and working context, including conversations, files, images, videos, product references, social-analysis inputs, draft and scheduled posts, task results, and, where available and enabled, saved AI memory and preferences used to personalize later work.
• Billing and transaction information, such as your plan, credit balance, usage, order and payment references, payment status, and subscription status. Payment-card details are handled by the payment provider through its payment interface; Hubitos receives the transaction information necessary to manage your purchase.
• Information you deliberately send through a connected messaging bot, including the linked account identifier, messages, attachments and delivery information. Connecting a bot does not grant general access to all of your private conversations.
• Information about public accounts, posts or product pages you ask us to analyze, obtained from the relevant platform or a data-retrieval service. Public-source analysis and private account authorization are separate activities; neither grants unrestricted access to private platform data.

Data is used to deliver Hubitos features, protect user sessions, and provide support.

• To create, save, reopen, and synchronize conversations, workflows, toolkits, generated files, and user preferences.
• To process user instructions and attachments so AI assistants can draft, summarize, transform, and organize user-requested work.
• To authenticate users, prevent misuse, investigate errors, and maintain reliable service behavior.
• To respond to support requests, troubleshoot reported issues, and communicate important product or policy updates.

When a user connects a Meta family service, Hubitos uses the granted permissions only for user-directed workspace and publishing actions.

• Hubitos requests only the permissions required for the feature the user chooses, such as identifying the connected account or preparing and publishing user-approved content.
• Authorization data may be used to display connected account status, draft or publish content, read permitted publishing metadata, and keep the user-requested workflow connected.
• Hubitos does not sell Meta authorization data and does not share it with third parties except service providers needed to operate the product or when required by law.

Where available, Hubitos may support TikTok account connection, content analysis and publishing through TikTok developer products, including Login Kit, Display API and Content Posting API, either directly or through a service provider supporting the connection. The products and permissions available to you depend on the integration actually enabled and the authorization screen you approve.

• We use approved profile information, account identifiers, statistics and videos to identify your connected account and provide the analysis, content-management and publishing features you request.
• We submit content to TikTok only for a publishing action you request or confirm, including a scheduled action you have approved. You control the content and the available audience, privacy, interaction and disclosure settings presented for that action.
• Connecting an account is not permission to publish arbitrary content, access private messages, or use unrelated TikTok data.
• TikTok may process submitted content and associated metadata under its own terms and privacy policy. Disconnecting Hubitos does not remove a video or post already held by TikTok.
• You can withdraw access through the available Hubitos connection controls or TikTok's connected-app settings, and request deletion of data held by Hubitos at support@hubitos.ai.

TikTok Shop is a separate seller authorization. If offered and connected, it may provide shop identifiers, shop details, authorization scopes and credentials needed for the shop functions specifically enabled. A TikTok social-account connection does not authorize TikTok Shop access. Any additional product, order or customer-data processing must be disclosed for the relevant shop feature before it is used.

Where you use the YouTube connection, Hubitos uses YouTube API Services, including through its publishing integration provider, to manage the channel and publishing actions you authorize. Relevant information may include channel identifiers, profile information, upload metadata, publishing status and permitted performance information.

Google sign-in and YouTube channel authorization serve different purposes. Neither grants access to Gmail, Google Drive or other Google products unless a separate feature requests that access and you authorize it.

Hubitos' use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. Such information is used for the disclosed, user-facing features and is not used for advertising targeting or to develop or train generalized AI models. Any permitted AI processing remains limited to the authorized feature and applicable platform requirements.

The Google Privacy Policy also applies to Google's processing. You can revoke access through Google's security settings. Instructions for requesting deletion from Hubitos are set out below and in the Data Deletion Instructions.

Access tokens are treated as sensitive credentials.

• Hubitos may store access tokens only when needed to maintain a user-authorized connection or complete a user-requested workflow.
• Stored tokens are protected using reasonable technical controls and are not exposed in public pages, logs intended for users, or marketing material.
• Tokens are retained only while needed for the authorized connection or requested actions. Disconnecting a connection removes the relevant Hubitos-held credential or requests disconnection through the integration provider, depending on the connection. Removing a locally held credential is not necessarily the same as revoking the grant at the platform; you can also revoke access in the platform's settings. Deletion of previously stored content and metadata is addressed separately below.

The desktop application stores information needed for local operation, such as login-session information, preferences, caches and local working files. Local processing does not mean that all features operate offline: using cloud AI, synchronization, uploads or connected services sends the information needed for that action to Hubitos or the relevant service provider.

When text-selection features are active and the operating system permits access, Hubitos can detect selected text and the source application. Depending on the operating system and application, selection detection may use accessibility interfaces or a clipboard-copy fallback. Invoking an AI action can send the selected text to the configured AI service; saving it to cloud files uploads the selected content. You can manage the feature and available application filters in settings, and revoke operating-system permissions.

When you initiate a screenshot, Hubitos uses screen-capture access to obtain the image needed for your selection. A screenshot submitted to a conversation or saved to cloud storage is processed like other uploaded content. If you enable local task execution, the files, commands and execution results relevant to the task may be processed by the desktop runtime and returned to the service. Review the requested access and any approval controls before proceeding.

Hubitos uses local storage, session storage, application files and, where used by a service component, cookies to maintain sessions, preferences and service functionality. Clearing local data may sign you out or reset preferences; it does not delete data stored on our servers.

Where product analytics is enabled, Hubitos uses PostHog to receive feature events, route information, anonymous and session identifiers, the Hubitos user identifier when signed in, language, operating-system and user-agent information, app version, release channel, event timing and sanitized error diagnostics. These identifiers can make events linkable to an account; this is not a claim that all analytics is anonymous.

The client analytics configuration disables session recording and automatic interaction capture. It filters sensitive event properties such as prompts, message text, selected text, email addresses, credentials and local file paths. This describes analytics handling, not the content processing needed to deliver an AI or publishing feature. Network services may also process IP addresses and technical request information to deliver and protect the service.

Where applicable law requires consent or an opt-out for non-essential tracking, we will provide and respect that choice. You can contact support@hubitos.ai about analytics-related privacy requests.

We disclose information as needed to deliver your requested features, maintain security, handle support and payments, comply with law, or carry out a transaction subject to appropriate safeguards. Relevant recipients include:

Provider availability depends on your feature and environment. Upload-Post describes its processing in its Privacy Policy. Social platforms process information under their own policies. We remain responsible for the processing for which Hubitos is legally responsible; using a provider does not remove that responsibility.

Hubitos serves users across Southeast Asia, including Vietnam, Malaysia, Singapore and Indonesia, subject to service availability and applicable law. Data may be processed outside your country by our infrastructure and service providers. Our infrastructure includes processing in Singapore and the United States. Connected platforms and service providers may process information in additional locations.

Where applicable law requires safeguards, notices, consent or other conditions for cross-border transfers, we will satisfy those requirements before making the transfer. Contact support@hubitos.ai for information about the recipients and locations relevant to your use.

We retain personal information for the purposes described in this policy only for as long as necessary, taking into account your use of the service, deletion requests, the type of information, applicable law and platform requirements. We use access controls and other reasonable technical and organizational measures to protect it. No system can guarantee absolute security.

Deleting an item, clearing local data, switching off memory and disconnecting a platform do not necessarily delete all related information. To request deletion of all relevant account data or a specific category of information, email support@hubitos.ai. We will review related content and retained copies within the scope of your request.

Retention exceptions are limited to information genuinely necessary for a specific legal, billing, security or dispute-related purpose. Backup copies may remain until they expire under the applicable retention process. The Data Deletion Instructions explain how to request deletion and information about any necessary retention.

Users remain in control of connected accounts.

• Where available, users can disconnect a provider inside Hubitos account authorization or settings surfaces.
• Users can also revoke Hubitos access from the relevant Meta, Facebook, Instagram, or Threads account settings for connected apps and websites.

For TikTok, YouTube, X, LinkedIn and other integrations, you may also use that platform's connected-app controls. If the connection was provided through Upload-Post, the application name displayed by the platform may differ from Hubitos; check the authorization you actually granted. Stop or cancel pending workflows when withdrawing access. An action already submitted to a platform may not be retractable through disconnection alone.

Users may request deletion of personal data associated with their Hubitos account or connected social authorization.

• Send a deletion request to the support email listed below and include the Hubitos account email plus the connected provider to identify the data.
• Hubitos will process verified deletion requests within a reasonable period and confirm completion when the request is resolved.
• Some information may be retained when required for security, fraud prevention, legal compliance, billing records, or backup integrity.

See the separate Data Deletion Instructions for request details, identity verification, provider handling, retained data and the difference between deleting Hubitos records and deleting content on a social platform. Where a platform imposes a shorter deletion deadline, that requirement applies to the relevant platform data.

Depending on applicable law, you may have rights to be informed, access or correct your information, request deletion or a portable copy, restrict or object to processing, withdraw consent, and complain to the relevant regulator. Contact support@hubitos.ai to exercise a right. We may request proportionate information to verify that the request relates to you; do not send passwords, access tokens or verification codes.

Withdrawing consent does not affect processing that was lawful before withdrawal. If information is necessary for a requested feature, declining to provide it or withdrawing the relevant authorization may prevent that feature from working. Contract acceptance and consent to optional processing are separate decisions.

The account-eligibility rules in our Terms apply. Where local law requires a minimum age, guardian involvement or a specific legal basis to process a young user's information, those requirements must be met. If you believe a child has provided information without the required authorization, contact support@hubitos.ai so we can investigate and take appropriate action.

We will publish an updated policy with its effective date when our practices change. For material changes, we will provide additional notice and obtain a new consent where required. A policy update does not, by itself, authorize unrelated processing of information already collected.