Privacy, made legible.

• The HubBound application distributed through the Microsoft Store;
• The HubBound CLI, daemon, local agent and integration tools that the application installs or uses;
• The HubBound API and cloud services;
• The web console, public registry and artifact distribution services linked to the account;
• Integrations enabled by the user or organization, such as AI providers, GitHub, GitLab, Bitbucket Cloud, Azure DevOps, Jira, Linear, CI/CD, observability, security and other supported connectors.

This Policy does not control processing performed by Microsoft, Google, GitHub, an OIDC provider, an AI provider or any other third party under its own policies. Review those services’ policies before connecting them.

The table below summarizes the categories that may be processed. Not all categories are collected in every installation: some depend on the enabled feature, plan, organization configuration, permissions granted and integration selected.

We use data for the following purposes:

1. provide requested functions, including accounts, authentication, organizations, teams, artifacts, distribution, registry, analytics and support;
2. validate permissions, apply organization isolation, control device scopes and prevent unauthorized access;
3. synchronize an enabled integration, such as GitHub, and return metrics or synchronization status to the user;
4. process enabled telemetry, generate aggregated metrics and detect performance or availability errors;
5. create technical provenance evidence and maintain upload histories and idempotency;
6. analyze submitted artifacts to generate security findings when the feature is active;
7. send transactional authentication, invitation, security and operational emails;
8. maintain security, investigate abuse, apply rate limits, debug failures and comply with legal obligations;
9. display content that a user has made public and measure aggregated registry downloads;
10. improve product reliability, documentation and functionality using aggregated or de-identified information where reasonably possible.

We do not use content for targeted advertising or sell personal profiles. We do not make legal, credit, employment, housing or insurance decisions based solely on an automated output from HubBound.

When applicable law requires a legal basis, the specific basis will depend on the product contracted, configuration, country and HubBound’s role in relation to the organization. In general, we may rely on:

When processing is based on consent, users may withdraw it through the relevant control or by writing to the privacy contact. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

In Colombia, personal-data processing will be carried out with prior, express and informed authorization where required, or under another basis permitted by Law 1581 of 2012. Submitting a Book a demo request does not constitute authorization for marketing: commercial updates require separate consent and must include a way to unsubscribe. That consent can be withdrawn by writing to support@hubbound.net.

We may share or make data available in the following circumstances:

Depending on the feature and jurisdiction, users may:

• disable local telemetry when the control is available, or ask the organization administrator to disable analytics and its cloud synchronization;
• sign out and revoke active sessions;
• disconnect GitHub and other authorized integrations;
• view, correct and update profile data available in the application;
• control the visibility, members and permissions of artifacts and workspaces;
• delete comments, artifacts or other content when the feature and permissions allow it;
• request access, rectification, deletion, restriction, objection, portability or withdrawal of consent, when those rights are available under applicable law;
• request information about derived data, the source of an integration and the categories of providers receiving it.

To exercise rights, write to support@hubbound.net with the subject “Privacy request.” Include the account, organization or resource to which the request refers, but do not send passwords, tokens or private keys. We may request reasonable information to verify identity, protect other people and prevent fraudulent requests.

If the account belongs to an organization, some data may only be modified or deleted by that organization’s administrator. HubBound may retain information when necessary for security, fraud prevention, legal compliance, dispute resolution or transaction integrity.

In Colombia, personal-information inquiries are handled within a maximum of ten (10) business days; if it is not possible to respond within that period, we will explain the delay and provide a response date, which may not exceed five (5) additional business days. Claims for correction, updating, deletion or revocation are handled within a maximum of fifteen (15) business days counted from the day after receipt; an informed extension may not exceed eight (8) additional business days. If you believe processing violates the rules, you may file a complaint with the Superintendence of Industry and Commerce or the data-protection authority in your country.

We apply technical and organizational measures that are reasonable and proportionate to risk, which may include:

• modern encryption in transit and access controls by identity, organization, team, resource and scope;
• rotation, expiration, revocation and protected storage of session credentials;
• cryptographically bound device tokens and storage of the public material needed to validate the proof;
• short-lived object-access URLs with limited permissions;
• separation between raw content, provenance metadata and analytics projections;
• redaction and allowlists for default telemetry;
• idempotency controls, auditing, rate limiting, security logs and operational monitoring;
• review of artifact content for risks when a security audit is requested.

No system can guarantee absolute security. Users should keep Windows and connected tools up to date, protect credentials and private keys, review GitHub permissions and avoid uploading secrets or information that is not necessary.

If you detect a security incident, contact support@hubbound.net. Do not include credentials or secrets in the first contact.

HubBound SAS is incorporated in Colombia and uses primary AWS infrastructure in us-east-1. HubBound and its providers may process data in countries other than the user’s country of residence. When applicable law requires it, we will use a valid international-transfer mechanism, such as an adequacy decision, standard contractual clauses, supplementary measures or another recognized mechanism. The enterprise DPA and applicable contracts will detail the specific mechanism when necessary.

The region and effective location may vary according to the cloud environment, organization and connected provider. Contract-specific information applicable to an organization may be available in the services agreement or data-processing addendum.

The application and local agent may store configuration, protected credentials, public keys, identifiers, logs and a temporary delivery queue on the device. Some of this information is needed to sign in, maintain the integration or deliver data when the device reconnects. Local access is subject to operating-system controls and the permissions of the account running the application.

The web console may use cookies, local storage or other strictly necessary technologies for authentication, security, preferences and session continuity. We do not use these technologies to sell data or for behavioral advertising. If we add non-essential technologies in the future, we will provide the controls and notices required by applicable law before enabling them.

HubBound is a platform for engineering teams and organizations. The final age classification for Microsoft Store publication must be confirmed before this version is published: if HubBound is not directed to children under 13, we will not knowingly collect personal data from children under that age; if any version is directed to children under 13 or to a higher age set by local law, the corresponding notices, controls and parental consents will apply. If you believe a child provided us with data, write to support@hubbound.net so we can investigate and take appropriate action.

We may update this Policy when features, integrations, providers, legal requirements or retention practices change. We will publish the new version at the URL indicated in the Microsoft Store and update the last-modified date. If the change is material, we will show a notice in the product or through a reasonable channel before it applies when required by law.

The published Policy must remain consistent with the application, Microsoft Store listing, declared permissions and effective production configuration.

Controller: HubBound SAS
Legal and compliance contact: Angel Eduardo Lindarte Lopez, angel@hubbound.net
Address: Dg 40Sur #34D-23, Bogotá, Colombia
Privacy: support@hubbound.net
Security: support@hubbound.net
Support: support@hubbound.net
Data Protection Officer: Angel Eduardo Lindarte Lopez, angel@hubbound.net