Hub procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the right to lodge a complaint with your local data protection authority Our legal bases for processing are: (a) performance of a contract (providing the Services), (b) your consent (for optional features like location and notifications), (c) our legitimate interests (improving the Services, preventing fraud), and (d) compliance with legal obligations” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the right to opt out of the "sale" or "sharing" of personal information (we do not sell personal information) You have the right not to be discriminated against for exercising your privacy rights” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the right to know what personal information we collect, use, share, or sell You have the right to delete personal information we have collected from you” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Uploaded content For the duration of applicable dataset licenses and as required by contractual obligations ” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ When you delete your account: We delete your personal account information (email, profile data, wallet address) within 30 days. We retain certain information where required by law (e.g., transaction records for tax and regulatory purposes). Uploaded content that has already been included in datasets licensed to enterprise clients cannot be retracted from those clients' copies, since you agreed to its use in datasets at the time of upload. Future use is stopped, and any unfulfilled licensing of that specific content ceases.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Push notification providers — to deliver push notifications to your device A current list of subprocessors is available on request at privacy@hub.xyz .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If Hub is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (via in-app notification or email) before your information is transferred and becomes subject to a different privacy policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Protect the rights, property, or safety of Hub, our users, or others” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Hub licenses AI training datasets to enterprise clients (such as research labs and technology companies). When we share data derived from your uploads: Uploaded content (the images, videos, audio you submitted) may be included in these datasets, since this content is the purpose for which it was collected and submitted. Demographic metadata (age range, gender, skin tone, language, location at country level) may accompany content in anonymized or aggregated form only . Personally identifying information — your name, email, wallet address, exact location, IP address, account credentials, or identity verification documents — is never shared with clients . We require all enterprise clients to agree to data handling terms that restrict use of the data to the purposes described in their contract. A Data Processing Agreement (DPA) is executed with each enterprise client, and a list of subprocessors is available on request at privacy@hub.xyz .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may share information for other purposes with your explicit consent. We do not sell your personal information to third parties. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information with third-party service providers who help us operate the Services. These providers are contractually bound to handle your information securely and only as instructed by us. They include:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not track you across other companies' apps or websites. We do not participate in advertising networks, and we do not share your data with third parties for the purpose of tracking your activity outside of the Services. The Hub App does not use Apple's IDFA or Google's Advertising ID.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment processors — to facilitate USDC payouts on the Base network” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party service you interact with. Key third parties we integrate with: Didit (identity verification) — https://didit.me/privacy Google (OAuth sign-in) — https://policies.google.com/privacy Discord (OAuth sign-in) — https://discord.com/privacy ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may disclose information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you choose to verify your identity, we use Didit , a third-party KYC provider, to perform verification. During verification, Didit collects identity documents (government ID, selfie, liveness check) and processes them on our behalf. Hub does not store your identity documents. We only store the verification status (verified / not verified) and the date of verification. For Didit's own privacy practices, see https://didit.me/privacy .” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.