Privacy Policy

1. Who we are

Hubbub is provided by Growthology Technologies LLP, a limited liability partnership registered in India (LLPIN ACD-7804), with its registered office in Mumbai, Maharashtra, India. Hubbub is an endorsed brand of SmallBigGrowth. In this policy, “Hubbub”, “we”, “us” and “our” mean Growthology Technologies LLP.

For the personal data described here, we are the “controller” (or “data fiduciary” under India’s Digital Personal Data Protection Act, 2023), except where section 2 says we act for a customer. You can reach us about privacy at hubbub@smallbiggrowth.com.

2. What this policy covers

This policy covers personal data about:

visitors to our website at hubbub.smallbiggrowth.com;
people who sign up for and use Hubbub, and teammates they invite; and
people whose public posts in online communities appear in Hubbub (see section 5).

When we act for a customer. Our customers are businesses. When a customer puts personal data into their workspace, for example a teammate’s details or personal information inside their own notes, we process it on the customer’s behalf and on their instructions, as their “processor”. The customer is responsible for that data, and requests about it should go to them. We will help them respond. A data processing agreement is available on request.

3. Information we collect

Information you give us

Account details: your name, email address and password. We store your password only as a one-way hash, never in readable form.
Workspace information: your company name, website address, product description, target audience, keywords, communities to watch, brand voice settings, the drafts you edit and approve, and links to replies you tell us you posted.
Team details: the names, email addresses and roles of teammates you invite.
Messages: what you send us through the in-product help form or by email.

Information we collect automatically

Usage records: actions in the product, such as scans run, drafts created and features used, with timestamps. We use these to run, meter and improve the Service.
Technical and security data: IP address, browser and device type, and request logs. We record IP addresses for short periods to limit repeated sign-in, sign-up and password reset attempts.
Cookies and similar technologies: see section 8.

Information from other sources

Public community posts: the title, text, author username, link, time and community of public posts, and public engagement counts. See section 5.
Your website: when you give us your website address, we read your public landing page to suggest your audience and the communities to watch.
Our payment provider: if you buy a plan, our Merchant of Record tells us your plan, subscription status, billing country and transaction references. It handles your card details itself; we never receive your full card number.

We do not ask for, and ask you not to give us, sensitive information such as health, religious beliefs or government identity numbers.

4. How we use it and our legal bases

Data protection laws such as the GDPR and UK GDPR require a legal basis for each use of personal data. Here is what we do and why.

What we do	Legal basis
Create and run your account and workspace, run scans, score conversations and generate drafts	Performance of our contract with you
Send service emails, such as address confirmation, password resets, alerts and billing notices	Performance of our contract with you
Answer your help requests	Performance of our contract, and our legitimate interest in supporting users
Keep the Service secure, prevent fraud and abuse, and limit repeated attempts	Our legitimate interest in protecting the Service and its users
Understand how the Service is used, fix problems and improve it	Our legitimate interest in improving the Service; consent where the law requires it for analytics cookies
Collect and show public community posts relevant to a customer (section 5)	Our and our customers’ legitimate interest in finding and joining relevant public conversations
Handle billing, tax and accounting	Performance of our contract, and compliance with legal obligations
Send product news and updates	Our legitimate interest in telling business users about the Service, or consent where the law requires it. You can opt out at any time.
Comply with the law, respond to lawful requests, and establish or defend legal claims	Compliance with legal obligations, and our legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights and you can object (see section 12). Where we rely on consent, you can withdraw it at any time, without affecting what we did before.

We do not make decisions about people that have legal or similarly significant effects using only automated processing. Hubbub’s scores rate conversations for relevance to a business, not people.

5. Public posts from online communities

This section is for anyone whose public post appears in Hubbub, for example on Reddit.

What we collect. Only publicly available posts and their public details: the title, text, author username, link, time, community and public engagement counts. We do not access private messages, email addresses or any other non-public content.
How. Through platforms’ official interfaces and through third-party data collection providers that retrieve publicly available content.
Why. To show our business customers public conversations where they may be able to help, so that a person at that business can decide whether to reply in the open, in the same thread.
What we do not do. We do not build profiles of individuals, sell this data, or contact authors. Our Terms forbid customers from using Hubbub to do so. We never post, vote or message on anyone’s behalf.
Deleted content. When we learn that a post has been deleted or removed, we stop showing it and remove it in the normal course. We follow the terms of the platforms we collect from.
Your choices. You can ask us to remove your posts from Hubbub, or to exclude your username from future scans, by emailing hubbub@smallbiggrowth.com with the username and, if you have it, a link to the post. You can also object to this processing (section 12).

6. How we use AI

To score conversations and draft replies, we send the text of the relevant public post and the workspace settings needed for the task, such as your product description and brand voice, to AI model providers. They process it to return a result to us. We use providers whose terms for business use do not permit them to train their models on the data we send them. They may keep it for a limited time for security and abuse monitoring, under their own obligations of confidentiality.

AI output can be wrong. That is one reason a person at the customer always reviews a draft before anything is posted.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share personal data only as follows.

Service providers who process it for us, under contract, and only to provide their service to us:

cloud hosting, database and infrastructure providers;
email delivery providers, for service emails;
AI model providers, to score conversations and generate drafts (section 6);
third-party data collection providers that retrieve publicly available content;
our payment provider and Merchant of Record, for checkout, billing and tax;
business email and productivity tools we use to run the company and answer support; and
web analytics, namely Google Analytics on our website (section 8).

A current list of our service providers (sub-processors) is available on request from hubbub@smallbiggrowth.com.

Other recipients:

Your team. People in your workspace can see the workspace’s data, according to their role.
Legal and safety. Authorities, courts or others where we must by law, or where needed to protect the rights, property or safety of our users, the public or us.
Business transfers. A buyer or successor if we are involved in a merger, acquisition, financing or sale of assets, subject to this policy.
With your consent or at your direction.

8. Cookies and analytics

Cookies are small files stored by your browser. We keep them to a minimum.

Type	What it does	Consent needed?
Strictly necessary	Keeps you signed in, protects forms against forgery, remembers which workspace you are in, and holds your email address briefly while you confirm it	No. The Service cannot work without them.
Preferences	Remembers whether you chose the light or dark theme	No. Set only when you choose.
Analytics	Google Analytics on our website measures visits, pages viewed, how visitors arrived, device type and approximate location	Yes, where the law requires it, including in the EEA and UK. Not set until you agree.

The product also uses your browser’s session storage to keep unsaved work if a page reloads. It is cleared when you close the tab.

Google Analytics. Google processes analytics data on our behalf. We use it to understand and improve our website, not for advertising. Where consent is required, you can accept or decline analytics in our cookie banner and change your mind at any time. You can also block these cookies in your browser settings or with Google’s opt-out browser add-on. See how Google uses information from sites that use its services.

We treat a Global Privacy Control signal from your browser as a request to opt out of any sale or sharing of personal information.

9. How long we keep it

We keep personal data only as long as we need it for the purposes in this policy.

Account and workspace data is kept for as long as your account exists, or as needed to provide the Service. This includes after a free trial ends or a paid plan is cancelled: the workspace is locked, but its data is kept so you can pick up where you left off if you upgrade. We may delete data from inactive or locked accounts after a period we will tell you about in advance.
When you delete. When the account owner deletes a workspace or account in the product, we delete its data promptly. If we offer a short window to undo a deletion, we will tell you at the time. Copies in backups are overwritten in the normal course of our backup cycle.
Free trial record. To keep free trials to one per person and per company website, we keep a one-way fingerprint (a keyed hash) of the email address and website domain used for a trial, for 12 months, including after the account is deleted. It cannot be turned back into the email address or domain, and we use it for nothing else.
Public community posts are kept while they are relevant to the workspace that found them, and deleted with that workspace, or sooner on request (section 5).
Help messages you send us are kept as a record of support, including after your account is deleted, unless you ask us to delete them.
Security records, such as IP-based rate limit entries, are short-lived and are normally deleted within a day. Server logs are kept for a limited period for security and troubleshooting.
Billing records are kept for as long as tax and accounting laws require.

We may keep data for longer where the law requires it, or where it is needed to resolve disputes or enforce our agreements.

10. Security

We protect personal data with measures appropriate to the risk, including encryption in transit, one-way hashing of passwords, encryption of sensitive credentials at rest, separation of each customer’s workspace data, and access limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the authorities as the law requires.

11. International transfers

We are based in India, and our service providers operate in several countries, including the United States. Your personal data may therefore be processed outside the country where you live.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that does not have an adequacy decision, we use a lawful transfer mechanism, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or our providers’ certification under an approved framework, together with appropriate safeguards. You can ask us for more information, or a copy of the relevant safeguards, at hubbub@smallbiggrowth.com.

12. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and get a copy;
correct it if it is inaccurate or incomplete;
delete it;
port it, meaning receive it in a structured, machine-readable format;
object to processing based on legitimate interests, and to direct marketing at any time;
restrict how we use it in some circumstances;
withdraw consent where we rely on it; and
complain to a data protection authority.

How to use them. You can update your details and delete your workspace or account inside the product. For anything else, email hubbub@smallbiggrowth.com from the address on your account, or tell us which username or post your request is about. We may need to confirm your identity before acting. We will respond within one month, or sooner where the law that applies to you requires, and we will tell you if we need longer and why. There is no charge, unless a request is clearly unfounded or excessive.

If we hold your data on behalf of one of our customers (section 2), we will pass your request to that customer, or ask you to contact them.

13. Extra information for your region

European Economic Area and United Kingdom

You have the rights in section 12 under the GDPR or UK GDPR. You can complain to the data protection authority in the country where you live or work, or where you think a breach happened. In the UK, that is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to address your concern first.

California and other US states

In the last 12 months we have collected the categories of personal information described in section 3: identifiers (such as name, email address and IP address), commercial information (plan and billing status), internet activity (usage records and analytics), and professional information (company details). We use them for the business purposes in section 4 and disclose them only to the recipients in section 7.

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics about you. You have the right to know, access, correct and delete your personal information, and to opt out of any sale or sharing. You can use an authorised agent, and we will not discriminate against you for using your rights.

India

Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of your personal data and how we process it, ask us to correct, complete, update or erase it, withdraw consent where we rely on it, and nominate another person to exercise your rights if you die or become unable to. Contact our Grievance Officer (section 15) first. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

14. Children

Hubbub is a business tool for people aged 18 and over. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact hubbub@smallbiggrowth.com and we will delete it.

15. Grievance Officer

In line with Indian law, our Grievance Officer handles concerns about how we process personal data:

Grievance Officer: Priyesh Thakkar, Designated Partner
Email: hubbub@smallbiggrowth.com
Address: Growthology Technologies LLP, Mumbai, Maharashtra, India

We will acknowledge your grievance promptly and resolve it within one month.

16. Changes to this policy

We may update this policy as the Service or the law changes. The version number and date at the top show which version is current. If a change is material, we will tell you by email or in the product before it takes effect.

17. Contact us

Questions or requests about privacy: hubbub@smallbiggrowth.com
Growthology Technologies LLP, Mumbai, Maharashtra, India