Privacy Policy

Hub Data, Inc. is the data controller for personal information collected through the Services.

For questions about this Policy or to exercise your privacy rights, contact us at the email above.

We collect the following categories of personal information when you use the Services:

2.1 Account information

• Email address
• OAuth identifiers (Google, Apple or Discord) when you sign in via a third-party provider
• Username and password (if you create an account with email/password)
• Date of account creation

2.2 Profile information (provided by you)

• Age, gender, height
• Skin tone, hair color, eye color
• Languages spoken
• Dominant hand
• Education level, job, skills
• Country and region
• Any other profile fields you choose to complete

This information is optional but enables eligibility for a broader set of tasks. You control what you share and can edit or delete profile fields at any time.

All physical descriptors (such as skin tone, hair color, and eye color) are voluntarily self-reported by you and are not derived through biometric analysis, facial recognition, or any automated measurement.

2.3 Identity verification information (KYC)

• If you choose to verify your identity, we use Didit, a third-party KYC provider, to perform verification.
• During verification, Didit collects identity documents (government ID, selfie, liveness check) and processes them on our behalf.
• Hub does not store your identity documents. We only store the verification status (verified / not verified) and the date of verification.
• For Didit's own privacy practices, see https://didit.me/privacy.

2.4 Uploaded content

• Photos, videos, and other media you submit through the App as part of completing tasks
• Descriptions, captions, bounding boxes, and metadata you add to uploads
• Egocentric video recordings made within the App
• Sensor data captured while you record and stored alongside the video so each take can be checked against your head movement: accelerometer, gyroscope, magnetometer, compass, barometer and device-orientation readings, the camera's exposure settings and the phone's battery level.
• Microphone audio: the sound recorded with each video, so the dataset keeps the full context of the task.
• Equipment metadata you provide (camera model, device used)

2.5 Camera and camera roll access

• When you choose to upload from your camera roll, the App accesses photos you select. We do not access photos you have not selected.
• When you use in-app capture (camera or video recording), the App accesses your device's camera while recording.
• You can revoke these permissions at any time in your device settings.

2.6 Location information

• To record, the App needs access to your device's location: the programs and rates open to you depend on the country your phone is in, and while you record, the App stores the location readings your phone provides with the recording, normally about once a second, including altitude, speed and direction when available. Location may be precise or approximate, depending on your device settings and the available signal (see Section 4.1). Without location access you can still use the App, but you cannot record.
• Location access is only requested when needed and only with your explicit permission.
• You can revoke location access at any time in your device settings.

2.7 Device and technical information

• Device model and manufacturer (e.g., iPhone 14, Samsung Galaxy S23)
• Operating system and version
• App version
• Device identifiers used for analytics, crash reporting and ad measurement, including a random identifier that Meta's software creates for each installation of the App (see Section 10.2)
• Your device's advertising identifier, when available: Google's Advertising ID on Android, and Apple's IDFA on iPhone and iPad only while you allow tracking (see Section 10.2)
• On Android, if the Facebook app is installed on your device, an identifier the Facebook app provides to help measure which ads led people to use Hub (see Section 10.2)
• IP address (collected automatically when you access the Services)
• Push notification tokens (only if you grant notification permission)

2.8 Financial information

• Wallet address — the EVM-compatible cryptocurrency wallet address you provide to receive USDC payouts on the Base network. You can edit this at any time.
• Transaction history — records of rewards earned, bonuses, and payouts processed through the Services.
• Pix key — the Pix key you provide to receive payouts in Brazil: your CPF, CNPJ, email address, phone number or a random key. You can change it at any time.
• Apart from a Pix key you choose to give us, which can be your CPF or CNPJ, we do not collect bank account information, credit card numbers, or government-issued financial identifiers.

2.9 Usage and interaction data

• Tasks you've viewed, started, completed, or skipped
• Upload submission history and review outcomes
• Time spent in the App, screens viewed, features used
• In-app notifications you've received and interacted with

We use the information we collect for the following purposes:

3.1 To provide the Services

• Create and manage your account
• Match you with tasks for which you are eligible
• Process and review your uploads
• Track your contribution history, reliability score, and earnings
• Process payouts, for example Pix payouts in Brazil and USDC payouts to your wallet on the Base network
• Send transactional notifications (upload approved, reward credited, etc.)

3.2 To improve the Services

• Analyze how users interact with the App to identify bugs, performance issues, and opportunities for improvement
• Develop and test new features
• Diagnose technical problems
• Measure and improve Hub's own ads, using activity on the website and in the App (see Sections 10.1 and 10.2). We do not show ads in the App.

3.3 To communicate with you

• Send service-related notifications (in-app, push, email)
• Respond to support requests and inquiries
• Notify you of important account changes, policy updates, or service announcements
• Send communications about Hub programs, bonuses, and news by email, through our official channels, and through ads shown to existing users on third-party platforms (see Section 4.6). You can opt out at any time via the unsubscribe link in our emails or at privacy@hub.xyz

3.4 To protect the Services and our users

• Detect and prevent fraud, abuse, and policy violations
• Enforce our Terms of Service
• Comply with legal obligations

3.5 For research and AI development

• Uploaded content (images, videos, audio, and accompanying metadata) is the core data product of the Services. With your consent provided through these Terms, we use this content to:
  • Build and improve AI training datasets
  • License datasets to enterprise clients (see Section 4)
• Profile data you provide may be associated with your uploads to add demographic context to datasets. In those datasets, that data is linked to a pseudonymous code instead of your name or contact details (see Section 4).

3.6 Automated processing

We use automated systems to support the operation of the Services, including:

• Task matching — algorithms determine which tasks you are eligible for based on your profile information, location, device capabilities, and task requirements.
• Reliability scoring — automated systems calculate a reliability score based on your submission history, review outcomes, and platform activity. This score affects the tasks available to you and your standing on the platform.

These automated processes are necessary for the efficient operation of the Services. If you have questions or concerns about how automated processing affects your account, contact us at privacy@hub.xyz.

We share information in the following ways:

4.1 With enterprise clients

Hub licenses AI training datasets to enterprise clients (such as research labs and technology companies). When we share data derived from your uploads:

• Uploaded content (the images, videos, audio you submitted) may be included in these datasets, since this content is the purpose for which it was collected and submitted.
• The App requires access to your location before each recording. When we license a recording, clients also receive the sensor data captured with it (see Sections 2.4 and 2.6), including motion and orientation readings and the full, unrounded GPS readings recorded throughout it, approximately once per second.
• Recording details (the date and time of each recording, and your phone's make, model, operating system and app version) may accompany that recording.
• Demographic metadata (age range, gender, language, country, dominant hand) may accompany each recording, linked to a pseudonymous code instead of your name or contact details.
• We do not add your account's name, email address, wallet address, IP address, credentials or identity-verification documents to client datasets. Recordings and their location and demographic data may still identify you or other people. A pseudonymous code does not make these data anonymous.

We require all enterprise clients to agree to data handling terms that restrict use of the data to the purposes described in their contract. A Data Processing Agreement (DPA) is executed with each enterprise client, and a list of subprocessors is available on request at privacy@hub.xyz.

4.2 With service providers

We share information with third-party service providers who help us operate the Services. These providers are contractually bound to handle your information securely and only as instructed by us. They include:

• Didit — identity verification (KYC)
• Cloud hosting providers — to store and process data
• Payment processors — to make payouts, for example Pix in Brazil and USDC on the Base network
• Analytics and crash reporting tools — to monitor app performance
• Email delivery providers — to send transactional emails
• Push notification providers — to deliver push notifications to your device

A current list of subprocessors is available on request at privacy@hub.xyz.

4.3 For legal reasons

We may disclose information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable law
• Protect the rights, property, or safety of Hub, our users, or others
• Investigate and prevent fraud or security incidents

4.4 Business transfers

If Hub is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (via in-app notification or email) before your information is transferred and becomes subject to a different privacy policy.

4.5 With your consent

We may share information for other purposes with your explicit consent.

4.6 With advertising platforms (custom audiences)

To reach people who already use the Services with communications about our programs and bonuses, we may send advertising platforms, such as Meta (Instagram and Facebook), a list of contact details of existing users: email, phone number, name, city, state, postal code, and country. These values are converted to hashes (SHA-256) before they leave our systems. The platform uses the hashes only to identify which users hold an account with it and to show them our communications; it does not receive the data in readable form and, under its terms, deletes the hashes once matching is complete. We never put uploaded content, earnings, identity-verification data, or tax identifiers in these lists.

We do this on the basis of our legitimate interest in communicating with existing users about programs they already take part in. You can object at any time via the unsubscribe link in our emails or at privacy@hub.xyz, in which case you are removed from subsequent lists. You can also hide Hub's ads in the platform's own ad settings.

4.7 With Meta, to measure Hub's ads

The App sends Meta information about how you use it and technical information about your device, to measure and improve Hub's own ads. On iPhone and iPad this starts before the tracking prompt appears and may continue after you decline tracking; Android has no tracking prompt. Some identifiers depend on your tracking choice or your device settings. Section 10.2 explains what is sent and what those settings change.

We do not sell your personal information to third parties.

Depending on where you live, you may have the following rights regarding your personal information:

5.1 Universal rights (available to all users)

• Access — request a copy of the personal information we hold about you
• Correction — update or correct inaccurate information through your profile, or by contacting us
• Deletion — request that we delete your account and associated personal information (see Section 5.4 for limitations)
• Portability — request a copy of your information in a portable format
• Withdraw consent — withdraw consent for processing where consent is the basis (e.g., revoke camera, location, or notification permissions in your device settings)
• Object — object to certain types of processing
• Restrict — request restriction of processing in certain circumstances

5.2 For users in the European Economic Area, UK, and Switzerland (GDPR)

• You have all the rights listed above
• You have the right to lodge a complaint with your local data protection authority
• Our legal bases for processing are: (a) performance of a contract (providing the Services), (b) your consent (for location access and notifications), (c) our legitimate interests (improving the Services, preventing fraud), and (d) compliance with legal obligations

5.3 For California residents (CCPA / CPRA)

• You have the right to know what personal information we collect, use, share, or sell
• You have the right to delete personal information we have collected from you
• You have the right to correct inaccurate personal information
• You have the right to opt out of the "sale" or "sharing" of personal information (we do not sell personal information). The ad measurement in the App described in Section 10.2 may count as "sharing" under California law. The settings described in Section 10.2 affect only certain identifiers: on iPhone and iPad, declining tracking stops the App from sending your advertising identifier and account details to Meta; on Android, deleting the advertising ID stops it from being sent, while resetting it replaces it with a new one. Activity events, technical information and other identifiers may still be sent to Meta.
• You have the right not to be discriminated against for exercising your privacy rights

5.4 Exercising your rights

To exercise any of these rights, contact us at privacy@hub.xyz. We will respond within 30 days (or sooner if required by your jurisdiction). You can also delete your account directly at https://platform.hub.xyz/settings or in the App by going to Profile → Account → Delete account. Step-by-step instructions are at hub.xyz/delete-account.

5.5 Limitations on deletion

When you delete your account:

• We delete your personal account information (email, profile data, wallet address) within 30 days.
• We retain certain information where required by law (e.g., transaction records for tax and regulatory purposes).
• Uploaded content that has already been included in datasets licensed to enterprise clients cannot be retracted from those clients' copies, since you agreed to its use in datasets at the time of upload. Future use is stopped, and any unfulfilled licensing of that specific content ceases.

5.6 For users in Brazil (LGPD)

You have the rights provided by the Brazilian General Data Protection Law (Law No. 13,709/2018), including those listed in Section 5.1, and you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Our legal bases are: (a) performance of a contract (providing the Services and paying you), (b) your consent (location access and notifications), (c) our legitimate interests (improving the Services, preventing fraud, and communicating with existing users about programs they take part in, see Section 4.6), and (d) compliance with legal obligations. The Brazil Privacy Policy (see Section 14) prevails over this subsection.

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected personal information from a person under 18, we will delete it promptly.

If you believe we may have collected information from someone under 18, contact us at privacy@hub.xyz.

Hub Data, Inc. is located in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and in other countries where our service providers operate.

For transfers from the European Economic Area, UK, and Switzerland, we rely on the European Commission's Standard Contractual Clauses or other approved transfer mechanisms.

For users in Brazil, international transfers follow the LGPD and ANPD Resolution CD/ANPD No. 19/2024, relying on standard contractual clauses or another mechanism recognized by the ANPD.

We retain your personal information for as long as your account is active and for the periods described below:

We take reasonable and appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication for our systems
• Regular security reviews and audits
• Restricted access to personal information on a need-to-know basis

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your information using industry best practices.

10.1 Cookies

The App does not use cookies. The Hub website (platform.hub.xyz) uses cookies and similar technologies as described below:

The website may use measurement pixels from advertising platforms, such as the Meta Pixel, to measure the results of our own campaigns. We do not serve third-party ads on the Services.

You can manage or disable cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using certain features of the website.

10.2 Tracking and ad measurement in the App

The Hub App uses Meta's software, called the Meta SDK, to measure and improve Hub's own ads. For example, it helps show which ad led someone to install the App, create an account or send a first recording. We do not show ads in the App.

Through the SDK, the App sends Meta information about actions you take, called events. These include installing or opening the App, creating an account, completing your profile, opening a task and searching for tasks. Events also report sending a recording, completing identity verification, adding a Pix key and the steps of a withdrawal. These events say that a step happened; they never include your identity documents, your Pix key or any amount. Screen views are sent as general screen names, without the individual IDs in them. The events never include your recordings, your device's GPS location, your earnings, payout amounts or balances. The App does not send Meta the text you type into its fields, and we keep Meta's automatic advanced matching turned off for the App.

Each event also carries technical information, such as your device model, operating system and app version, language and time zone settings, mobile carrier and screen size, your IP address, and a random identifier the SDK creates for this installation of the App. The App sends these events and this information from the first time you open it. On iPhone and iPad this starts before the tracking prompt appears and may continue after you decline tracking; Android has no tracking prompt.

• iPhone and iPad: the App asks for your permission with Apple's App Tracking Transparency prompt. Only while you allow tracking does the App also send Meta Apple's advertising identifier (IDFA), your Hub account ID, your email address and your name. Before sending your email address and name, Meta's software turns them into coded values called hashes on your device; these values are not anonymous. If you have not been asked yet, or you choose Ask App Not to Track, these identifiers are not sent, but the events and technical information above may still be. You can change your choice at any time in Settings > Privacy & Security > Tracking (Settings > Privacy > Tracking on iOS 15).
• Android: there is no tracking prompt. Events are sent with your device's advertising ID when it is available. If the Facebook app is installed, events also include an identifier it provides to help measure which ads led people to use Hub. The App does not send Meta your Hub account ID, email address or name. You can reset or delete your advertising ID in your device's settings (usually under Privacy, Security & privacy, or Google, then Ads). Resetting replaces it with a new advertising ID; deleting it stops that ID from being sent. Events, technical information, the identifier for this installation of the App and the Facebook app's identifier may still be sent after either change.

Apple calls sharing these identifiers for advertising "tracking", which is why the App asks before it shares them on iPhone and iPad. Changing these settings does not delete information Meta has already received. Meta handles the information it receives under its own terms and privacy policy (https://www.facebook.com/privacy/policy). Separately, Section 4.6 describes lists of hashed contact details that we may send to Meta from our own systems. Your choices about tracking and advertising identifiers do not change which App features you can use.

The Services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party service you interact with.

Key third parties we integrate with:

• Didit (identity verification) — https://didit.me/privacy
• Google (OAuth sign-in) — https://policies.google.com/privacy
• Apple (Sign in with Apple) — https://www.apple.com/legal/privacy/
• Discord (OAuth sign-in) — https://discord.com/privacy
• Meta Platforms (reaching existing users with ads about Hub, and measuring Hub's ads using website and App activity) — https://www.facebook.com/privacy/policy
• PostHog (product analytics: which screens are opened and which actions are taken in the app) — https://posthog.com/privacy
• Sentry (crash and performance reports) — https://sentry.io/privacy/

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this Policy
• Notify you of material changes via in-app notification, email, or other appropriate means
• For significant changes affecting how we use your existing information, we will obtain renewed consent where required by law

Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us:

For European users, you may also contact your local data protection authority.

If you are in Brazil, the Brazil Privacy Policy governs how Hub processes your personal data. The Brazil Contributor Terms set out the rules for taking part on the platform in Brazil and apply once you accept them. Both are written in Portuguese and have an English courtesy translation; if the two versions differ, the Portuguese version prevails.

Where this Policy and the Brazil Privacy Policy differ, including on consent, legal bases, the controllers, and changes to the policy, the Brazil Privacy Policy prevails for users in Brazil. The choice of Delaware law at the end of this Policy does not limit the rights that Brazilian law, including the LGPD, gives users in Brazil.

• Brazil Privacy Policy: hub.xyz/pt/privacypolicy/brasil (Portuguese) and hub.xyz/privacypolicy/brasil (English)
• Brazil Contributor Terms: hub.xyz/pt/terms/brasil (Portuguese) and hub.xyz/terms/brasil (English)
• Data Protection Officer (Encarregado) for Brazil: Tim Sprecher, privacy@hub.xyz