Privacy Policy

• Account data: your name, email address and password (stored only as a salted hash), and the workspace you belong to.
• Content you create: posts, newsletters, mailing lists and subscriber email addresses, and related scheduling and approval information.
• Connected account data: when you connect a social account (e.g. LinkedIn or Facebook), we receive and store the access tokens and the profile/page information needed to publish on your behalf and show analytics (see below).
• Usage data: basic technical logs needed to operate and secure the service.

When you connect a LinkedIn or Facebook/Meta account, you authorize Hubcast — through each platform’s official API and the permissions you grant — to:

• identify the connected account and the company Pages it administers, so you can choose where to publish;
• publish posts you have created and explicitly approved, to the target you selected (a company Page or your own profile);
• read engagement and reach statistics for the selected Page to show you analytics inside Hubcast.

We only access this data to provide the features you ask for. We do not use platform data for advertising, we do not sell it, and we do not share it with third parties except the sub-processors listed below. Our use of information received from these platforms adheres to the LinkedIn API Terms and the Meta Platform Terms, including any limited-use requirements.

• To provide, maintain and secure the service.
• To publish your approved content and send your newsletters to the recipients on your mailing lists.
• To show you analytics for your connected channels.
• To respond to your support requests.

We do not sell your personal data.

We rely on a small set of service providers to run Hubcast. They process data only on our behalf:

• Hosting: Vercel (app hosting).
• Database: Neon (PostgreSQL, hosted in the EU).
• Email delivery: Resend (newsletter and transactional email).
• Social platforms: LinkedIn and Meta/Facebook, when you publish or read analytics through your connected accounts.

Data is stored in the EU. Connected-account access tokens are encrypted at rest with AES-256-GCM; passwords are stored only as hashes. We keep your data for as long as your account is active, and delete or anonymize it after account closure, except where we must retain it to comply with legal obligations.

You can access, correct or delete your personal data. You may also:

• Disconnect a channel at any time in Settings — this immediately deletes the stored access tokens for that account.
• Request deletion of your account and all associated data by emailing [email protected]. We will action it within 30 days.
• Newsletter recipients can unsubscribe via the one-click link in every email; their address is then suppressed.

We use a single, strictly necessary session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Questions about this policy or your data? Email [email protected].