Privacy Policy

1. Who we are

PrivoHub ("we", "us", "our") operates the managed hosting services (PrivoHub Photos, Drive, and Vault) available at privohub.com. We are the data controller for the personal data you provide when using these services.

Contact: privacy@privohub.com

2. Data we collect and why

Account data

When you sign in, authentication is handled by our identity provider, from which we receive your email address and a unique user identifier. This is used to associate your subscription and services with your account.

Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract.

Photos and files you upload

The photos, videos, files, and metadata you upload to the service are stored on servers located within the European Union. We do not access, analyse, or process your content for any purpose other than storing it and making it available to you.

Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract.

Storage usage metrics

We periodically measure the total storage used by your instance to enforce quota limits and calculate billing. These measurements store only a byte count and a timestamp, not the content of your files.

Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract.

Payment data

Payments are processed by Stripe, Inc. We receive a customer ID and subscription ID from Stripe to link your payment status to your account. We do not store card numbers or full payment details. Stripe's privacy policy applies to data processed by Stripe.

Legal basis: Article 6(1)(b) GDPR, necessary for the performance of a contract.

Technical logs

Our servers generate standard access logs (IP address, request path, timestamp, HTTP status). These are used solely for security monitoring and debugging and are retained for a maximum of 30 days.

Legal basis: Article 6(1)(f) GDPR, legitimate interest in maintaining secure and reliable services.

Website analytics

If you allow it, on privohub.com we count page visits using Umami, an open source analytics tool that we host ourselves, so that we can see which pages are useful, how people find us, and whether signup and sign in work. We record the page address (without its query string), page title, previous page or referring site, screen size, browser language, browser and operating system, and an approximate location derived from your IP address. We also count that a sign in happened and that a signup was submitted (with the plan chosen), without any identity attached. Your IP address itself is never stored. Visits are grouped using a one way hash whose secret rotates daily, so the records cannot be linked to you or joined across days. The results are seen only by the PrivoHub team, as totals, and are never shared, sold or combined with account data. Analytics runs only after you choose to allow it in our cookie banner, and you can withdraw that at any time with Cookie settings at the bottom of every page. The Cookies and Analytics policy lists every field and explains why.

Legal basis: your consent, Article 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawing it does not affect the lawfulness of what was recorded before.

3. Where your data is stored

All data, including photos, account information, and backups, is stored exclusively on servers located within the European Union. Data never leaves the EU. Our infrastructure providers are established in the EU and subject to EU law and GDPR.

Our infrastructure providers act as our data processors. We have Data Processing Agreements in place with them as required under GDPR Article 28.

4. How long we keep your data

• Account data and files: retained for as long as your account exists. Cancelling a paid plan does not delete anything: your account continues on the free plan and your data is kept. When you delete your instance yourself from the portal, all associated data (photos, database, configuration) is deleted immediately. Where we close an account for non-payment, data is deleted at the end of the schedule set out in our Terms of Service, 74 days after the first failed payment. In any other case of termination, deletion happens within 30 days.
• Backups: we keep encrypted backups, stored in the EU, so your data can be recovered if something fails. When data is deleted, its copies in those backups expire automatically as the backups rotate: within 6 months for photos and files, and within 12 months for databases. Backups are used only to recover from a failure, never to bring back data that was deleted.
• Storage measurements: retained for 90 days for billing and quota management.
• Access logs: retained for 30 days, then automatically deleted.
• Website analytics: retained for 12 months, then automatically deleted.
• Billing records: retained for up to 10 years as required under applicable commercial and tax law.

5. Data sharing

We do not sell, rent, or share your personal data with third parties for commercial purposes. Data is shared only with the following processors, strictly as necessary to provide the service:

• EU-based infrastructure providers: servers, storage, and network
• Stripe, Inc.: payment processing (applies only to paid plans)

We do not use your data to train AI or machine learning models. We do not share data with advertising networks, data brokers, or any third party analytics service. Our website analytics runs on software we host ourselves, so no external analytics provider receives anything. See our Cookies and Analytics policy.

6. Your rights under GDPR

You have the following rights with respect to your personal data:

• Right of access (Art. 15): You can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You can ask us to correct inaccurate data.
• Right to erasure (Art. 17): You can request deletion of your account and all associated data. You can also do this directly from your portal at any time.
• Right to data portability (Art. 20): You can download your photos, files, and data in standard formats at any time from within the service.
• Right to restriction (Art. 18): You can ask us to restrict processing of your data in certain circumstances.
• Right to object (Art. 21): You can object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where we rely on your consent, such as for website analytics, you can withdraw it at any time, as easily as you gave it, with Cookie settings at the bottom of every page.

To exercise any of these rights, contact us at privacy@privohub.com. We will respond within 30 days.

7. Cookies, local storage, and analytics

We use no advertising or tracking cookies. The cookies and browser storage we do use are strictly necessary: they keep you signed in, protect the sign in against forgery, authorise a data export download, and remember your cookie choice.

With your consent, we measure page visits on privohub.com using Umami, an open source analytics tool that we host ourselves on our own EU infrastructure. It sets no cookies, never stores your IP address, and cannot follow you across websites or link a visit to your account. No advertising or third party analytics service is involved.

On your first visit we ask whether you allow analytics, with Accept and Reject offered side by side. Nothing optional is loaded until you choose, and you can change your choice at any time with Cookie settings at the bottom of every page. Every cookie and storage entry, every analytics field, and the reasons behind them are listed in our Cookies and Analytics policy.

8. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement, if you believe our processing of your personal data infringes the GDPR.

A list of national supervisory authorities in the EU is available from the European Data Protection Board: edpb.europa.eu.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address associated with your account at least 30 days before they take effect.