Privacy Policy

1. Who We Are

HUBKARD Suite is operated by HubKard ("we", "us", "our"), based in Kaštel Novi, Croatia. Our products include CountSheet, HubKard, MenuCraft, and MarketPilot — a suite of restaurant management tools for independent restaurants and hospitality businesses.

Contact: privacy@hubkard.com

2. What Data We Collect

We collect only what's necessary to provide the service:

We do not collect: payment card details (handled by our payment processor), precise location data, device fingerprints, or any data from your POS system beyond what you explicitly upload.

3. How We Protect Your Data

• Encryption in transit: All connections use TLS/HTTPS.
• Encryption at rest: Database encrypted via AWS infrastructure (Supabase).
• Row-Level Security: Each organization's data is isolated at the database level. Users can only access data belonging to their organization.
• Password hashing: Passwords are hashed with bcrypt. We never store or see your plaintext password.
• Session security: Authentication uses httpOnly cookies that cannot be accessed by JavaScript.
• Daily backups: Database is backed up daily with point-in-time recovery.

4. Data Hosting & Transfers

Your data is hosted on Supabase (AWS EU region). The application is served via Vercel (global CDN). Both providers maintain EU-adequate data protection standards and process data under Standard Contractual Clauses where applicable.

5. Your Rights (GDPR)

Under EU GDPR, you have the right to:

• Access your personal data — request a copy of everything we store about you.
• Rectification — correct inaccurate data in your profile.
• Erasure — request deletion of your account and all associated data.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interest.

To exercise any of these rights, contact privacy@hubkard.com. We will respond within 30 days.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data is permanently deleted within 30 days. Backups are purged within 90 days.

7. Cookies

HUBKARD Suite uses only essential cookies for authentication (httpOnly session cookies managed by Supabase). We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required because we only use strictly necessary cookies.

8. Third-Party Services

9. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify you via email or in-app notification of any material changes.