Privacy policy
Last updated 31 August 2026. This policy covers luuphub.com, the hosted feedback portals, and the embeddable widget.
Who we are
Luuphub is a feedback platform: teams embed our widget on their site, and their users submit feedback that appears on a hosted portal and dashboard. Questions about this policy go to hi@aina.rs.
We act as a controller for the data of account holders who sign up to Luuphub, and as a processorfor the feedback data that account holders’ end users submit through the widget and portals.
What we collect
Account holders: name, email address, and profile picture from Google Sign-In (the only sign-in method we offer); billing details handled by our payment provider, Polar; and usage of the dashboard itself.
End users submitting feedback: the feedback text, an email address, and — when the submitter opts in — screenshots and console logs attached to a report. The widget shows a consent line before storing any visitor token; declining still allows reading and submitting.
Google user data
When you sign in with Google we receive your name, email address, and profile picture. We use them solely to create and identify your account. We do not request access to any other Google data, we never sell this data, and we never share it with third parties except the infrastructure providers listed below. Luuphub’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use data
To run the product: showing feedback to the team that owns the site, notifying subscribers who opted in to updates, triaging and deduplicating feedback with AI (your data is never used to train AI models), billing, and preventing abuse. We do not sell personal data or use it for advertising.
Where it lives, who processes it
Application data is hosted in the EU. Our sub-processors are: Vercel (hosting), Hetzner (database, EU), Resend (email), Polar (payments), OpenAI (transient AI processing, no training retention), QStash by Upstash (job queue), Google Cloud (batch processing, EU region), and PostHog (product analytics, EU). Full details are on Data processing & GDPR.
Your rights
You can export or delete your data at any time: account owners from Settings → Privacy & data (full JSON export; account deletion with a 30-day grace window), and feedback submitters from the portal footer (edit, delete, or full identity erasure). EU residents additionally hold all GDPR rights — access, rectification, erasure, restriction, portability, and objection — exercisable via the tools above or by emailing hi@aina.rs.
Cookies
We use a session cookie for signed-in dashboard users and — only with consent — a visitor token for widget submitters. No third-party advertising cookies.
Changes
If this policy changes materially, we will note it here and update the date above. Continued use after a change constitutes acceptance.