Hubbub advocacy programme · Privacy notice 2026-10-18-v3
Beta rollout review: Hubbub must confirm the lawful basis, retention schedule and provider safeguards described below before wider rollout.
For this Hubbub Labs beta, Hubbub Labs, S.L. is the controller. Contact George Chilton at george@hubbublabs.com with questions or requests about your data. This notice covers the Hubbub advocacy programme; a separate client programme needs its own controller and approved notice.
Your invitation email, login/account identifier, workspace role and access status; the display name, optional job title and optional profile photo you provide; your programme start date and baseline; individual monthly and daily LinkedIn analytics, follower counts, post links, dates, titles or labels and their performance figures; uploaded Excel exports and engagement screenshots; posts, notes, categories, internal comments and mentions you add; invitation, acknowledgement, withdrawal and security records.
No. The app does not log into LinkedIn, scrape profiles or posts, read direct messages, or automatically collect lists of followers, contacts or people who react to your posts. It reads analytics files and screenshots that you choose to upload, plus links and text you enter. Post links themselves may identify you. The full original individual workbook and sanitised screenshot are retained, so any extra personal information in those files is also stored even if it is not extracted into a chart. Upload only the analytics requested and avoid unrelated personal information. Company exports are parsed into analytics and post records; their original files are not retained by this import route. Screenshot text recognition runs in your browser using the app’s OCR files; it is not sent to an external AI service.
The platform stores links to LinkedIn posts shown in the Feed and Hall of Fame. We do not automatically retrieve the full text of those posts, but following a link may reveal information you have shared publicly, including political or religious views, health details or financial information. Notes, comments, post titles and information contained in uploaded files may also be stored. Please avoid adding unnecessary sensitive information about yourself or others. We do not use linked posts to infer or classify sensitive personal characteristics. Public availability does not remove applicable data-protection obligations.
Only to operate, measure and secure the advocacy programme: record your results, calculate personal and team trends and baselines, show Hall of Fame posts, support internal sharing and engagement, manage invitations and access, correct mistakes, respond to rights requests and maintain security and recovery backups. Programme data is not sold or used by this app for unrelated advertising, AI model training or automated employment decisions. Do not use this beta for disciplinary decisions or employee performance scoring.
Clerk manages your sign-in email, authentication and sessions. Cloudflare runs the platform and stores your profile, programme analytics, supporting files and Feed contributions. Deleting programme data does not automatically delete your Clerk account. Access, correction and deletion requests must consider relevant records across both services. Clerk account records can relate to a shared application login rather than one workspace. Clerk publishes US hosting and international-transfer safeguards; the actual Cloudflare storage jurisdiction still needs confirmation for this programme.
You and authorised programme admins can access your individual reports and uploaded evidence. Workspace members see shared feed contributions, mentions, Hall of Fame entries and team/company results. Team totals can still reveal someone’s results in a small team; they are not guaranteed anonymous. Profile names and photos can accompany shared contributions. Emails are masked in routine member lists, but retained in full for access management and included in the relevant person’s admin data copy. Cloudflare hosts the app, database and file storage; Clerk handles login and invitations. Authorised admins may download data copies and backups and must protect them.
The proposed basis for core programme operation and necessary security is Hubbub’s legitimate interests in running a voluntary advocacy programme, subject to a documented assessment of necessity, employee expectations and impact. Rights requests and any required record-keeping may also involve legal obligations. The acknowledgement below records that you have read the notice and chosen to participate; it is not a waiver of rights or blanket GDPR consent. Because of the employment relationship, agreement alone does not establish that processing is lawful. Hubbub must confirm and document the applicable basis before rollout.
Programme records and original uploads are currently retained until deleted by the relevant app controls; membership archive identity can remain after reports and feed contributions are deleted. Security audit entries are removed after 90 days when the audit cleanup runs, and expired request-limit counters are cleaned then too. Acknowledgement and withdrawal records are retained for accountability. Downloaded backups and copies, and provider-side account or log records, are separate and are not erased by an app deletion. Hubbub must approve and apply a retention schedule, including archive, file, agreement and backup expiry, before wider rollout; this beta does not yet automatically expire all personal data.
Participation is voluntary. You can withdraw from the programme at any time through My profile. You can also request a copy of the personal data held about you, ask for corrections or request deletion, subject to applicable GDPR requirements. Contact george@hubbublabs.com to exercise these rights. Leaving the programme does not automatically delete existing records or your login account. Withdrawal blocks further programme access until you choose to rejoin. You may request access and a copy, correction, erasure, restriction or object to processing; portability applies where legally applicable. Contact george@hubbublabs.com even if you no longer have access. Requests are normally answered within one month; lawful exceptions and extensions may apply. You can complain to the Agencia Española de Protección de Datos (aepd.es). Agreeing does not remove these rights. You do not have to upload a photo or unrelated personal information.
Cloudflare and Clerk process relevant data to provide hosting, storage, login and invitations. Their processing locations, subprocessors, retention terms and any transfers outside the EEA must be checked against the live account configuration and contracts. Hubbub must confirm the applicable safeguards before rollout; this notice does not promise EU-only storage. Essential login/session storage and locally saved display preferences support the app. This code does not add advertising trackers.
I have read the privacy notice and understand what data I share, how it is used and how to exercise my rights. I choose to participate in the Hubbub advocacy programme.
Contact George about your data · AEPD (Spanish) · AEPD (English)