Privacy Policy

1. Who We Are

HubKard ("we", "us", "our") is based in Kaštel Novi, Croatia. HubKard is one restaurant management product made up of modules — Menus, Bookings, Inventory, Reviews and Marketing — for independent restaurants and hospitality businesses. Marketing is the module you are using now.

Contact: privacy@hubkard.com

2. What Data We Collect

We collect only what's necessary to provide the service:

We do not collect: payment card details, location data, device fingerprints, or any data from your POS system beyond what you explicitly upload.

3. How We Protect Your Data

• Encryption in transit: All connections use TLS/HTTPS.
• Encryption at rest: Database encrypted via AWS (Supabase infrastructure).
• Row-Level Security: Each organization's data is isolated at the database level. Users can only access data belonging to their organization.
• Password hashing: Passwords are hashed with bcrypt. We never store or see your plaintext password.
• Session security: Authentication uses httpOnly cookies to prevent XSS attacks.
• Daily backups: Database is backed up daily with point-in-time recovery.

4. Data Hosting & Transfers

Your data is hosted on Supabase (AWS EU region). The application is served via Vercel (global CDN). Both providers maintain EU-adequate data protection standards and process data under Standard Contractual Clauses where applicable.

5. Your Rights (GDPR)

Under EU GDPR, you have the right to:

• Access your personal data — request a copy of everything we store about you.
• Rectification — correct inaccurate data in your profile.
• Erasure — request deletion of your account and all associated data.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.

To exercise any of these rights, contact privacy@hubkard.com. We will respond within 30 days.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data is permanently deleted within 30 days. Backups are purged within 90 days.

7. Cookies

HUBKARD Suite uses only essential cookies for authentication (httpOnly session cookies via Supabase). We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required because we only use strictly necessary cookies.

8. Third-Party Services

9. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify you via email or in-app notification of any material changes.