Privacy Policy

Last updated: 2026-10-09.

1. Controller

HUBBLR Group GmbH
Budapester Str. 47, 20359 Hamburg, Germany
Managing directors: Florian Greinus, Cedric Bals
Commercial register: Amtsgericht Hamburg, HRB 200634
Email: privacy@hubblr.io

This policy covers the website hubblr.io and its subdomains (including auth.hubblr.io, clients.hubblr.io and api.hubblr.io).

2. Hosting and server logs

The website is built and hosted with Framer (Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands). When you open a page, Framer’s servers process the data your browser sends: IP address, date and time, requested page, referrer, browser and operating system. These logs are used to deliver the site and to keep it secure and are deleted after a short period by the provider. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable, secure website). We have a data processing agreement with Framer.

Our own application services (sign-in pages, the client area API and the analytics proxy under api.hubblr.io) run on Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA) in the Frankfurt region. Vercel processes the same kind of connection data. Vercel is certified under the EU-US Data Privacy Framework; we also have a data processing agreement with Vercel.

3. Cookies, consent and how to change your choice

We only set cookies and similar technologies that are not strictly necessary after you have agreed in the consent banner. You can choose categories:

• Necessary — always active. Includes the cookie that stores your consent choice (hubblr_consent, 180 days), the sign-in session for the client area (Clerk, see section 6) and the booking widget when you open it.

• Analytics — PostHog and Google Analytics (sections 4 and 5).

You can change or withdraw your choice at any time via “Cookie settings“ in the footer. Withdrawal does not affect the lawfulness of processing before the withdrawal. If your browser sends a Global Privacy Control signal, we treat it as “necessary only“. Legal basis: § 25 (1) TDDDG together with Art. 6(1)(a) GDPR for everything that needs consent, § 25 (2) TDDDG for strictly necessary technologies.

4. Analytics: PostHog

We use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA) to understand how the site is used. Our PostHog project runs on PostHog Cloud EU, hosted in Frankfurt, Germany, and all analytics requests go through our own domain (api.hubblr.io).

With your consent (Analytics): PostHog stores an identifier in your browser (ph_… cookie and local storage, up to one year) and records page views, clicks, scrolling, technical data (browser, device, screen size, approximate region) and session recordings of how you interact with the pages. Form inputs and email addresses are masked in recordings. If you sign in to the client area and have given consent, your usage is linked to your account (email address, client status). Session recordings are deleted after 30 days. Event data is kept for up to 1 year under our PostHog plan, and we delete an individual’s data on request.

Without consent: nothing is stored on your device. To count visits we send page views with a short-lived, non-reversible hash derived from your IP address and browser, calculated on PostHog’s servers and rotated daily; the IP address itself is not stored. Legal basis: Art. 6(1)(f) GDPR (reach measurement without identifying you).

We have a data processing agreement with PostHog. PostHog Inc. is certified under the EU-US Data Privacy Framework; however, the data of this project stays in the EU.

5. Analytics: Google Analytics 4

With your consent (Analytics) we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (_ga, _ga_…, up to 2 years) and collects page views, events, technical data and an approximate location. IP addresses are shortened before storage. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework and we have accepted Google’s data processing terms. Retention in Google Analytics is set to 14 months - We use Google’s Consent Mode: without consent, Google Analytics is not loaded at all.

Legal basis: Art. 6(1)(a) GDPR. You can withdraw consent via “Cookie settings“. More: https://policies.google.com/privacy

6. Client area and sign-in (Clerk)

The contact details of our team members and the client portal are only shown to signed-in visitors. Sign-in is provided by Clerk (Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA). Clerk processes your email address, name, password or one-time code, and sets strictly necessary session cookies (_session, clientuat). Clerk stores this data in the USA. When you sign in for the first time we ask for your company, company size and how we met; these answers and your email address are stored in our CRM system, which we host ourselves in Germany (Hetzner). Phone numbers are only shared with clients or after an individual request.

Purpose: to provide the client area and to answer your requests. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps and contract) and Art. 6(1)(f) GDPR (protecting our team’s contact details from misuse). Clerk is certified under the EU-US Data Privacy Framework and we have a data processing agreement with Clerk.

7. Contact form

When you use the contact form we process your name, email address, company, your message and the page you sent it from. The data goes through our own automation system to our CRM, both hosted by us in Germany (Hetzner), and is used to answer your request. Legal basis: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. We delete requests when they are no longer needed, unless retention periods apply.

8. Meeting booking (Cal.com)

If you click “Book a meeting“, we load the booking widget of Cal.com (Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA). Only then does your browser connect to Cal.com. Cal.com processes your name, email address, the chosen time slot and technical data. Legal basis: Art. 6(1)(b) GDPR. Cal.com’s privacy policy: https://cal.com/privacy (USA, standard contractual clauses)

9. Fonts, images and external links

Fonts and images are delivered from Framer’s content network (framerusercontent.com); no connection to Google Fonts is made. Links to LinkedIn and other external sites only transfer data to those providers when you click them.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. Where processing is based on consent you can withdraw it at any time. To exercise your rights, write to privacy@hubblr.io. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.