Privacy and Cookie Policy

1. Controller

The controller is the owner of hubprod, operating from Portugal. For any privacy matter, please use the contact form on the home page (hubprod.com/#ideias), choosing the area "Request about my data", and leave the email linked to your account so we can reply.

2. What data we process

• Account: your email, account creation date and last sign-in date.
• Beta access request: name, email, profession, company and the message you provide.
• Application data: what you create and save in the applications (for example running orders, tournaments, crews, contacts, events, artists and documents you upload, such as contracts or riders).
• Video and audio: when you use the live applications (for example HubProd Live or cloud production), the pictures and sound from the cameras, phones and other sources you connect are processed on our media server for mixing, streaming, recording, clips and replays.
• Share links: when you share an item, we store the link, the application and the shared item until you revoke the link.
• App suggestions: the idea, the area and, if you provide them, your name and email.
• Availability pages: content published by the page owner and requests sent by visitors (name, email and/or phone, dates and message).
• Usage statistics: pages visited, time spent in applications, approximate country, region and city (derived from the IP address, which is not stored), device type, browser, operating system, language, screen size and referring site. Visitors are identified by a code that changes every day and does not reveal who you are; signed-in users are identified by a pseudonym. We use no cookies for this and record nothing if your browser sends "Do Not Track" or "Global Privacy Control".
• Security: an identifier derived from the IP address (we do not store the IP in clear) to limit abuse and spam, and a log of sensitive actions (for example invitations, exports, deletions and administration actions), without the content of your data.
• Preferences: the language chosen on the website.

3. Purposes and legal bases

• Providing the service, managing your account and processing the video and audio of your productions: performance of a contract (the terms of use).
• Sending your access code and service communications: performance of a contract.
• Assessing beta access requests: pre-contractual steps at your request.
• Preventing abuse and spam, ensuring security and logging sensitive actions: legitimate interest.
• Usage statistics to improve the website and applications: legitimate interest (without cookies and without identifying you).
• Reviewing suggestions and replying if you left contact details: your consent, which you may withdraw at any time.
• Complying with legal obligations, where applicable: legal obligation.

We do not sell data, do not run advertising and do not use third-party analytics or advertising tools.

4. When you are the controller

If you enter other people’s data in the applications (for example your crew, artists, clients requesting bookings) or film people in a live production, you are the controller of that processing and must inform them. In those cases hubprod processes that data only on your behalf to provide the service.

5. Where data is stored and providers (processors)

We use providers that process data on our behalf with appropriate GDPR safeguards:

• Supabase: database, authentication and file storage, in Ireland (European Union).
• Vercel: website hosting and operation; requests are processed in Frankfurt (European Union).
• Hetzner: media server (video, audio, recordings, clips and replays), in Finland (European Union).
• Resend: sending access-code emails.
• Cloudflare and Google: direct connection between cameras/phones and the server in the live applications (STUN/TURN); when a relay is needed, the encrypted video passes through Cloudflare servers.
• DeepL: automatic translation of website texts and app descriptions (no user data).
• Anthropic: text processing only when an application uses artificial intelligence features; no published application uses them at the moment.
• Google Fonts, cdnjs (Cloudflare) and jsDelivr: delivery of fonts and technical libraries used by some applications; your browser connects to these services, which receive your IP address.

Your account and application data are stored in the European Union. Some providers are US companies or run global services (Vercel, Resend, Cloudflare, Google, jsDelivr) and may process technical data outside the European Economic Area. In such cases transfers rely on the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

6. Retention

• Account and application data, including documents, recordings and clips: while the account exists; deleted when the account is deleted.
• Replay buffer of live productions: 15 minutes by default (at most 24 hours, depending on the production settings); deleted when the production ends.
• Share links: until you revoke them or the account is deleted.
• Beta access requests: declined requests are deleted after 90 days; accepted ones are kept while the account exists.
• Availability page requests: until the page owner deletes them, at most 24 months.
• Suggestions: until no longer needed to assess the idea, at most 3 years.
• Usage statistics: 13 months.
• Sensitive-action log: 24 months.
• Server technical logs: automatic rotation, for the short period needed for operation and security.

These periods are enforced by an automatic daily clean-up.

7. Cookies and browser storage

We only use cookies and storage that are strictly necessary for the website to work, so we do not ask for consent for them:

• Session cookie (sb-…-auth-token): keeps you signed in after you enter your code; lasts while the session is active.
• Language cookie (lang): stores the language you chose; lasts 12 months.
• Browser session storage (hp-sess): a random code that groups the pages viewed in the same tab for statistics; deleted when you close the tab and not a cookie.
• Application local storage: some applications keep preferences or a working copy on your device so they work faster or offline.

We do not use advertising, analytics or social media cookies. You can delete cookies in your browser settings; if you delete the session cookie you will need to sign in again.

8. Your rights

You may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest, through the contact form on the home page (hubprod.com/#ideias). We reply within one month.

On the "My account" page (your account menu) you can download a copy of your data in JSON format, turn on two-step verification, sign out of every device, revoke shared links and delete your account.

When an account is deleted, we also delete uploaded files, productions, recordings, clips and replays on the media server, share links and related requests.

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD), www.cnpd.pt, or the authority of your country.

9. Security

Data is transmitted encrypted (HTTPS) and stored on servers in the European Union, with encryption at rest in the database. Each user can only access their own data, including on the media server. Stream keys and passphrases are stored encrypted. Shared-link pages run isolated from your session. Administration access is restricted and sensitive actions are logged.

No system is completely secure; if we detect a data breach affecting you, we will inform you and the CNPD as required by law.

10. Beta phase

hubprod is in beta. There is also a separate test environment (beta.hubprod.com), with its own database and only fictitious data, where we test changes before publishing them.

11. Minors

hubprod is intended for professional use and is not directed at children under 16.

12. Changes

We may update this policy. The date of the last update appears at the end of this page. Significant changes will be announced on the website or by email.