Hubia Privacy Policy for website and booking data

Data controller

Lovy Studio HŪBIA / Hubia is a product and brand of Lovy Studio P.IVA 18576191003 Registered office: Via Angelo Messedaglia 56, 00191 Roma RM, Italia Email: support@hubiaapp.com PEC: lovystudio@pec.it

Scope of this notice (website)

This notice covers data processing on hubiasystem.com, website contact forms and communications started from here. Use of the Hubia app, venue PWA or business area may be governed by additional notices or by your agreement with the venue.

Required and optional data

Fields marked as required in a form are needed to answer the commercial request or create the requested service; without them we may be unable to proceed. Telephone, free-text messages, marketing consent, feedback and analytics are optional unless the form specifically states otherwise.

Cookies and analytics

Essential cookies and consent preference are required for the site to work. Google Tag Manager, Google Analytics 4 and Microsoft Clarity load only after explicit consent. Details and preference management: Cookie Policy page.

Coach (venue data analytics)

The Coach plan is an internal analytics and suggestion engine: it reads only the venue’s own historical data in Hubia (bookings, customers, revenue, slots). It does not use external generative models, does not send data to third-party AI providers and does not train models on other venues’ data. Suggestions are assistive; the venue owner decides what to do. hubiasystem.com does not make automated decisions with legal effects on visitors.

1. Introduction

Lovy Studio, through the HŪBIA brand ("we", "our", "us"), respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, store and protect your information when you use our service. It applies to all users of our services: visitors to our website, users of the Hubia customer app (for booking at partner venues), and business or shop accounts.

Bookings at partner venues: roles and responsibilities

When you book at a venue that uses Hubia (salon, barbershop, beauty center), the data controller for your booking data is the venue itself. Lovy Studio processes that data only on behalf of the venue, as processor under Article 28 GDPR, based on a data processing agreement. For information about how your booking data is processed, including purposes, retention and rights, refer to the privacy notice of the venue where you booked. To exercise your rights on this data, contact the venue directly; if you contact us, we will forward the request to the controller.

2. Data we collect

We collect the following types of personal data:

• Contact data: name, email address, phone number
• Business data: business name, type of business, billing information
• Usage data: how you use our service, access logs, preferences
• Technical data: IP address, browser type, operating system, device information
• Booking data (when you book at a Hubia venue): booked service, date and time, venue and optional notes. For this data, Lovy Studio acts as processor on behalf of the venue; see the booking roles section above.

3. How we use your data

We use your personal data to:

• Provide and improve our service
• Process your requests and manage your account
• Communicate with you about the service, updates and support
• Comply with legal and regulatory obligations
• Prevent fraud and ensure security

4. Legal basis for processing

We process your personal data on the basis of:

• Contract performance: to provide the requested service
• Consent: when you have given explicit consent
• Legitimate interest: to improve the service and ensure security
• Legal obligation: to comply with legal requirements

5. Data sharing

We do not sell your personal data. We may share your data only with:

• Providers needed for the service: Supabase; Vercel; Stripe; Resend; Twilio; Meta/WhatsApp if enabled; Expo, APNs and FCM for push; Upstash for rate limiting with HMAC identifiers; Sentry; Google Analytics/Tag Manager and Microsoft Clarity only after website consent
• Legal authorities: when required by law or to protect our rights
• Business partners: only with your explicit consent

6. Data retention

Unconverted website leads are deleted after 180 days. Data for a deleted Hubia account is removed or anonymised without undue delay; bookings remain under the venue's responsibility and notice. Inactive customer profiles initially use 24 months, configurable by the venue from 6 to 120 months. Completed notification and WhatsApp payloads: 180 days; security and audit logs: up to 24 months; tax and accounting data: 10 years where required. Google and Microsoft apply the retention stated in the Cookie Policy.

7. Your rights

You have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data
• Request restriction of processing or object to processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority (e.g. Data Protection Authority)

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption, limited access, regular backups and ongoing monitoring.

9. International transfers

The operational Supabase database is in the EU, Ireland (AWS eu-west-1). The current Vercel runtime is in the USA, Washington, D.C. (iad1); other providers, including Stripe, Google, Microsoft, Meta, Twilio, Resend, Expo and Upstash, may involve processing outside the EEA. We use adequacy decisions, Standard Contractual Clauses and supplementary measures where needed.

10. Changes to this policy

We may update this policy from time to time. We will notify you of any significant changes by email or via a notice in the service.

11. Contact

To exercise your rights or for privacy-related questions, contact us at:

Email: support@hubiaapp.com
PEC: lovystudio@pec.it