Who we are
Hubba Training Limited runs the Hubba platform, website, mobile app and Hubba Inspections. We decide what is collected and why, so the law calls us the controller of it. For anything in this policy, email info@hubbatraining.com and a person at Hubba will answer.
Hubba Inspections has its own, more detailed privacy and cookies notice, which you can read inside Hubba Inspections at any time, with or without an account.
What we collect
- Account details: name, work email, job title, the nursery you belong to.
- Training records: courses started and finished, scores, certificates and their dates.
- Community content: posts, replies, reactions and saved items. Anonymous posts are stored with the author separated from the post and visible only as described below.
- Usage: pages opened, device and browser, so the app works and we can fix problems. On our website and in Hubba Inspections we only count visits once you have said yes to visit statistics.
- Emails: a record of each email we send you, and whether it was opened or a link in it was clicked, with when, the kind of device and mail app, a rough town and the internet (IP) address it was opened or clicked from. This shows our emails are reaching people, and gives your nursery a record that an important email, such as a contract or a policy, was received and opened.
- Billing: the nursery's billing contact and invoices. Card details are held by our payment provider, never by us.
- In the Hubba app: if you allow notifications, an address for your phone so we can send them. When the app goes wrong, a crash report with what happened, the app version, the kind of phone and your Hubba account number, so we can fix it; never your name, email, anything you typed or a picture of the screen. Pictures and files are only taken when you choose to add them, for example a profile picture or a Community post.
- Trying Hubba Inspections without an account: the address your connection comes from, a rough place worked out from it (town, region, country), the kind of device, browser and operating system, and the minutes you have used. If you say yes to the free-minutes counter on your device, we also keep a random number in your browser and a fingerprint made from plain facts about it (screen size, time zone, languages and similar). We use this to count your free minutes fairly, to tell one visitor from another and to see whether people go on to create an account. If you create an account or sign in, we link it to your account.
Why we use it
- To run your training, issue certificates and keep the matrix accurate.
- To show your manager your training record. Managers never see community conversations.
- To send assignments, reminders, replies and webinar notices, by email, push and in the app.
- To keep the community safe. An anonymous post can be unmasked only by a Hubba director, only for a safeguarding reason, and every unmasking is recorded.
- To keep accounts safe, stop misuse, and see which pages are used so we can make them better.
Where it lives
Our database and our website's servers are in London. Safety copies of the database are taken several times a day and kept in Ireland, inside the European Union. Everything is encrypted when it travels and when it is stored.
Who we share it with
Only the companies we need to run Hubba, each for its own job and each under a data processing agreement: Vercel (runs the website and servers), Supabase (keeps the database and looks after signing in), Amazon Web Services (keeps the safety copies), Resend (sends our emails), Stripe (takes card payments), Expo (passes notifications on to your phone, with Apple and Google), Sentry (receives error reports from the website and crash reports from the app, kept in Germany) and Anthropic (Hubba's AI, below). Some of these companies are based in the United States, so some information can be handled outside the UK. When it is, it is protected by the safeguards UK law requires. We never sell data and we never share it with advertisers.
Hubba's AI
Some parts of Hubba use AI from Anthropic, a company based in the United States. Each time, it is sent only what one job needs, and nothing else from your account:
- Hubba HR: the pages of a contract that is a photo or a scan, with the names of the member of staff, the manager and the nursery, to find where people sign; and the words of an improvement plan a manager asks for help with.
- Hubba Journeys: the words of a report a member of staff asks for help with, and a document or a reply to be put into a family's home language.
- Chats with the Hubba team: the chat, to write a one-line summary for the person who answers it.
- Hubba Inspections: the published inspection reports, to find the topics in them. Nothing about you is sent.
Anthropic does this for us under a data processing agreement. It does not use what we send to train its AI, and it keeps it only for a short time to keep its service safe before deleting it. The AI never decides anything about you on its own: what it finds or writes is shown to a person, who checks it and chooses whether to use it.
Your rights
You can ask for a copy of your data, ask us to correct it or delete it, ask us to stop using it or to pause using it, and ask for what you gave us in a file you can take elsewhere. When a member of staff leaves a nursery their certificates stay with them and move to their next nursery on Hubba. Email info@hubbatraining.com and we reply within five working days. It costs nothing.
You can delete your Hubba account yourself at any time, on the website under Your account or in the Hubba app under Sign-in and security. It happens straight away: you can no longer sign in, and your picture, mobile number, profile details, points, notifications and devices are removed. You choose whether what you wrote in Community and private chats is removed or stays without your name. What the law needs us to keep is listed below; nothing else is kept.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first, so please tell us too.
How long we keep it
- Training records (certificates and training history, with your name and job title): for as long as the account exists and for six years after it is deleted, because inspectors and employers can ask for them.
- Your email address and mobile number after you delete your account: six years, kept apart from everything else and used only to check a certificate or send you a copy if you ask.
- Your chats with the Hubba team: six years after the account is deleted, in case of a complaint or a claim.
- Community posts and private messages: until you delete them. When you delete your account you choose: either they are removed, or they stay so conversations still make sense, shown as "Deleted account" with no name or picture. Where they are removed and somebody else had replied, an empty post marked "Deleted account" stays in its place.
- Community posts or messages somebody reported to Hubba: a copy is kept for six years, seen only by the Hubba team, in case it is needed for a safeguarding concern or a claim.
- Safeguarding and HR records your nursery keeps about you belong to your nursery and follow its own rules, which the law sets.
- Sign-in records (when you signed in, from which device and connection): 13 months.
- Visit statistics from our website and Hubba Inspections, and the records of using Hubba Inspections without an account: 13 months, then deleted automatically.