Hub and Hub Bot Privacy Policy

Last updated: 5 October 2026

This policy explains our processing of data in Hub Studio, Hub Flow and Hub Bot, including email, AI employees, the work computer and Google connections. It is publicly available without an account.

Google data and permissions · AI processing · Disconnection and deletion · Your rights

1. Who processes your data

The service provider is Iluzona Innova SL, tax ID B75648386, at Av. de Canarias, 10, 35002 Las Palmas de Gran Canaria, Las Palmas, Spain (Canary Islands). Privacy and support contact: team@iabot.io; telephone +34 613 06 06 51.

We are the controller for account, contracting, billing, security and customer support data. When a business instructs Hub to process emails, documents or other personal data for its purposes, that business is the controller and we act as its processor for that service. Workspace access depends on the business's configuration and authorizations. Any required data processing agreement must be concluded with the customer; this policy does not replace it.

2. Data and sources

Account and commercial information: name, email, business details, authentication, preferences, support and billing information. Stripe processes payments; Hub does not store your full card number.
Requested work: instructions, conversations, files, audio, images, results, drafts, routines and AI employee action records.
Connected services: data you authorize us to access or use, account identifiers and credentials or tokens needed to maintain the connection.
Work computer: files, sessions and screenshots needed by the agent to perform a task in the business environment.
Operations and security: IP addresses, browser details, sessions, errors, usage and access/execution logs. We do not need your email content for advertising.

Data comes from you, authorized workspace users, your tasks and the services you connect. You must have a lawful basis for providing other people's data and inform them where required.

3. Google connections: data, permissions and purposes

Connecting Google is optional. You start in Hub and authorize permissions on Google's OAuth screen, without giving us your Google password. Access and refresh tokens may be stored to run authorized functions while connected, including configured syncs and routines. A Google account does not necessarily have Gmail enabled.

Identity (openid and email): identify the authorized account and associate it with the workspace connection.
Gmail (gmail.readonly and gmail.send): read messages, senders, recipients, subjects, dates, labels, bodies and available attachments; display Hub Mail; search or summarize email and prepare replies on request; send messages following user instructions or authorized automations. Drafts may be saved in Hub. These permissions do not allow changing or deleting the original Gmail messages.
Drive (drive.readonly): find files and read names, identifiers, types, dates and other metadata. The granted scope provides read access to files accessible to the account; the current connector offers search and metadata retrieval.
Calendar (calendar.calendarlist.readonly and calendar.events.readonly): read calendars and events, including titles, times, descriptions, locations and participants present in responses, to answer schedule questions.
Sheets (spreadsheets.readonly): inspect workbook structure and read cell ranges for requested queries and reports.
Docs (documents.readonly): read documents to answer questions, extract information or prepare summaries as requested.

The current Drive, Calendar, Sheets and Docs connectors are read-only. Connecting one service does not automatically authorize all others. Connections belong to the workspace and administrators decide which AI employees may use them. Browser actions with a signed-in session are a separate access mechanism, governed by that session and the user's instructions and permissions.

4. AI processing

When you ask an AI employee to work with an email, event or document, necessary content may be sent in the context to the model provider to generate a response. Results, summaries and evidence may also be stored in task history or workspace working memory. Mailbox synchronization and running an AI model are separate operations.

We use AI infrastructure and gateways such as OpenRouter and the selected model's providers, which may include OpenAI, Anthropic, Google, Groq or BytePlus. Processing depends on the model and feature; each task is not sent to every provider. The work computer may use Daytona infrastructure. You can request information about providers applicable to your service through our privacy contact.

We do not use or authorize the use of data obtained from Google APIs, or derived data, to create, train or improve general-purpose AI or machine learning models. Using data as context to perform your request does not grant a model-training licence. We also do not use it for advertising, advertising profiles or data sales.

5. Google Limited Use commitment

Hub and Hub Bot's use and transfer of information received from Google APIs are subject to the Google API Services User Data Policy and the Google Workspace user data policy, including their Limited Use requirements.

We use this information for the visible productivity features you authorize. Transfers are limited to what is needed for those features with your consent, security, legal obligations, or a corporate transaction with the prior consent required by Google. We do not sell it, provide it to data brokers or use it for creditworthiness or lending. These restrictions also cover derived information.

Hub personnel do not read Google content except with your explicit authorization for specific data, as necessary for security or legal obligations, or for aggregated and anonymized information as permitted by Google's policy. A general support request does not authorize access to your entire mailbox.

6. Purposes and legal bases

Service delivery and requests: performance of the contract, including accounts, tasks, chosen integrations and support.
Billing and applicable requirements: compliance with legal obligations.
Security and fraud prevention: legitimate interests balanced against individual rights, and legal obligations where applicable.
Marketing and optional cookies: consent where required, which may be withdrawn. See our Cookie Policy.

OAuth authorization controls access; it does not replace a business's lawful basis for processing customer or employee data. Withholding necessary information or permissions makes the corresponding feature unavailable.

7. Recipients and international transfers

Data may be processed by hosting, database and storage providers including Supabase, the AI and computer providers described above, Stripe for payments and services you connect. They should receive only what is needed for their role. Sent email is disclosed to your chosen recipients. Sharing with other applications depends on your instructions and Google's restrictions.

Some providers may process data outside the European Economic Area. Where applicable, transfers must rely on an adequacy decision or valid safeguards such as standard contractual clauses and necessary supplementary measures. You can request details of destinations, providers and safeguards applicable to your account. We do not claim that all processing takes place in Europe.

8. Storage, retention and security

Account data is retained as needed for the contractual relationship. Imported content, chats, documents and results remain in the workspace to provide the service and its history until deleted or a deletion request is processed, subject to legal retention requirements. Security and usage records are retained as needed for their purposes; accounting records are retained for applicable statutory periods, with restricted access where appropriate.

We use HTTPS for web connections, encrypted stored OAuth tokens, authentication and business-level access controls. Content may be held in databases, files, execution records and backups; the service does not provide end-to-end encryption against AI processing. No system eliminates every risk.

Backups may retain residual information until replacement or purging within the applicable retention cycle. They are not active data for new tasks; deletion requests must be reapplied if a backup is restored. When handling a request we will explain its scope and any applicable exceptions or timeframes.

9. Disconnecting and requesting deletion

Disconnect Gmail in Hub: Hub Mail → select mailbox → Edit → Disconnect account (Spanish interface: Editar → Desconectar cuenta), or Applications → Gmail → Disconnect. This removes that connection's credentials and associated mailbox. Previously imported email and history are not automatically deleted.
Revoke access at Google: open your Google account connections and remove Hub Bot's access. This may affect other Google services authorized for the same app. Also sign out of any separate Google browser session on the Hub computer to end that independent access.
Delete imported data or close an account: email team@iabot.io from your linked address, identifying the workspace, connected account and whether you request deletion of email, files, histories or the whole account. Do not send passwords, tokens or mailbox contents. For business accounts we verify your authority and coordinate with the controller.

Disconnection prevents new operations using that connection; it cannot undo a completed send or other action. Deleting a Hub copy does not delete the original at Google or copies you sent elsewhere.

10. Rights and complaints

You may request access, correction, deletion, restriction, objection and portability where applicable, and withdraw consent without affecting prior lawful processing. Contact team@iabot.io. We ask only for information necessary to verify identity and authority.

We generally respond within one month of receiving a request. If a legally permitted extension is necessary, we notify you within that month. You may complain to the Spanish Data Protection Agency or the competent authority. When processing on behalf of your business, we assist it in responding.

11. Decisions, age and changes of purpose

Hub Bot generates results and executes tasks according to user configuration. It should not be the sole basis for decisions producing legal or similarly significant effects without appropriate safeguards and oversight. The service is intended for adults and organizations, not children.

Updated versions are published with their date. Material changes are communicated through service channels. A new use of Google data requires prior information and any required authorization; publication alone does not expand existing permissions.

See our Terms and Conditions and the Spanish version.