Privacy Notice — Hubexo Reach

Effective date: 27 May 2026 · Version 1.0

This notice explains how Hubexo HQ AB processes personal data in connection with the Hubexo Reach app for iOS and Android. It is specific to the mobile app. The personal data in the wider Hubexo construction-project database that the app displays is controlled by a separate Hubexo group company (Hubexo Sweden AB) — see section 2.

1. Who we are (controller)

The data controller for the personal data described in this notice is:

Hubexo HQ AB (organisationsnummer 556605-9852)
Fälttelegrafplatsen 4, 169 71 Solna, Sweden
Email: daniel.olvebrink@hubexo.com

For matters specific to Hubexo Reach, including data-subject requests, account deletion, and privacy questions, email daniel.olvebrink@hubexo.com with the subject “Data protection inquiry”.

2. Who this notice covers

This notice covers personal data we process about:

• App users — employees of companies that subscribe to Hubexo services and who sign in to Hubexo Reach.

The app also displays personal data about decision-makers, contacts and other professionals listed on construction projects and companies (for example name, job title, work email and work phone). We do not collect that data from you when you use the app.

That data is part of the wider Hubexo construction-project database, which is held and controlled separately by Hubexo Sweden AB (organisationsnummer 556324-9100, Östernäsvägen 1, 827 32 Ljusdal). Hubexo Sweden AB holds a database publishing licence under the Swedish Freedom of the Press Act (utgivningsbevis för databas). Under Swedish constitutional law (Tryckfrihetsförordningen 1 kap. 9 §), some provisions of the GDPR — including most data-subject rights under Articles 15–22 — do not apply to personal data processed within the scope of that publishing licence. Hubexo Sweden AB nevertheless operates a contact channel for individuals listed in the database.

If you are a decision-maker listed in the database and want to ask a question, raise a correction, or request that your details no longer be shown in the app, contact us at the address in section 1 and we will forward your request to Hubexo Sweden AB. Hubexo Sweden AB will respond to you directly.

3. What we collect and why

3.1 Account data

When you sign in to the app we receive the following from our identity provider (AWS Cognito, hosted in the EU region eu-north-1, Stockholm):

• email address
• given name and family name
• internal user identifier (pid) and the identifier of the subscribing company you are associated with (cids)

We use this data to identify you in the app and to associate your actions (such as saving a project) with your account.

Legal basis: performance of the contract between Hubexo and your employer (Article 6(1)(b) GDPR), and our legitimate interest in operating, securing and supporting the service (Article 6(1)(f) GDPR).

3.2 Authentication tokens (stored on your device)

After sign-in, the app stores access, refresh and identity tokens locally in the secure storage of your device (iOS Keychain or Android Keystore). These tokens are kept on-device and are not transmitted elsewhere; they are deleted when you sign out.

3.3 Location data

If you grant location permission, the app uses your approximate location to show construction projects near you.

• We request foreground (in-use) location only. We do not request or use background location.
• We request coarse precision (approximately 1 km radius), even on devices that could provide finer accuracy. This is a deliberate choice to limit the granularity of location data.
• Your coordinates are sent to our backend in Sweden (eu-north-1, AWS) only when you open the “For you” recommendation screen, in order to retrieve nearby projects. They are used to compute the response and are not stored in our application database. Standard infrastructure logs (for example AWS load-balancer access logs) may briefly retain request metadata; those logs are subject to the retention period in section 7.
• Your coordinates are also used on-device to centre the map view. They are not written to disk by the app.
• You can revoke location permission at any time in your device’s system settings. The app will continue to work; you simply will not see “near me” results.

Legal basis: your consent given through the operating system permission prompt (Article 6(1)(a) GDPR). You may withdraw this consent at any time as described above.

3.4 In-app activity (saved projects, saved companies)

When you save a project or company to your leads, the app sends the identifier of the project or company to our backend so we can keep your saved list synchronised across sessions. The app does not allow you to enter free-text notes; we therefore do not receive notes or comments from you about projects or contacts.

Legal basis: performance of contract (Article 6(1)(b) GDPR).

3.5 Analytics (only with your consent)

We use PostHog (hosted in the EU at eu.i.posthog.com) to understand how the app is used so we can improve it. Analytics are disabled by default. The first time you sign in, the app asks you to accept or decline analytics. Until you accept, the analytics SDK is in an opted-out state and sends no data.

If you accept, we collect:

• a stable PostHog identifier associated with your user ID and your subscribing company’s ID
• interaction events such as which screens you visit, which projects or companies you tap on, and which projects you save
• technical context: platform (iOS or Android), app version, build number
• your IP address (anonymised at ingest by PostHog)

We have configured PostHog so that:

• IP addresses are anonymised at ingest
• session recordings are not captured
• user profiles are only created for users who have accepted analytics (personProfiles: "identified_only")
• surveys are disabled
• app lifecycle events are not captured automatically

You can decline analytics at first sign-in. If you accept and later wish to withdraw your consent, email us at the address in section 1. We will switch your account back to the opted-out state within 7 days and delete the analytics person profile associated with your user ID from PostHog within a further 30 days. A future version of the app will provide an in-app toggle to manage this directly.

Legal basis: your consent (Article 6(1)(a) GDPR). You may withdraw consent at any time.

3.6 Data we do not collect

Hubexo Reach does not collect or use:

• advertising identifiers (IDFA / GAID). We do not show advertising and we do not request App Tracking Transparency.
• your contacts, calendar, photos, microphone or camera.
• device push tokens (the app does not send push notifications).
• health, financial, biometric, political, religious or other special-category data.

4. Map tiles

When you view a map inside the app, the operating system fetches map tiles from a third party:

• on iOS: Apple MapKit (Apple Inc., USA — covered by Apple’s privacy practices)
• on Android: Google Maps (Google LLC, USA — covered by Google’s privacy practices)

These providers receive the approximate coordinates of the map area you are viewing in order to deliver the tiles. We do not transmit additional personal data to them.

5. Sub-processors and recipients

We share personal data with the following processors who act on our instructions:

We do not sell personal data and we do not share personal data with third parties for their own marketing.

6. International transfers

We process personal data inside the EU/EEA where possible. Where a recipient is established outside the EU/EEA, transfers take place on the following bases:

• Apple Distribution International Ltd. / Apple Inc. (USA): the EU−US Data Privacy Framework, with the EU Commission’s Standard Contractual Clauses as a backstop.
• Google LLC (USA): the EU−US Data Privacy Framework, with the EU Commission’s Standard Contractual Clauses as a backstop.
• PostHog, Inc. (USA, with EU hosting): the EU Commission’s Standard Contractual Clauses, together with the technical and organisational measures described in section 10.
• GitHub, Inc. (USA): the EU Commission’s Standard Contractual Clauses. GitHub Pages receives no personal data from app users beyond the IP address used to fetch this static page.

A copy of the relevant Standard Contractual Clauses and a description of the supplementary safeguards can be obtained by emailing the contact in section 14.

7. How long we keep your data

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• rectify inaccurate data
• request deletion (right to erasure, see section 9)
• request restriction of processing
• object to processing based on legitimate interest
• data portability for data you have provided to us
• withdraw consent at any time, where processing is based on consent (location, analytics)
• lodge a complaint with the Swedish supervisory authority Integritetsskyddsmyndigheten (IMY) if you believe your rights are not respected.

To exercise any of these rights, email daniel.olvebrink@hubexo.com with the subject “Data protection inquiry”. We will respond within one month.

Statutory or contractual requirement. Provision of your account data (section 3.1) is a contractual requirement; without it we cannot sign you in to the app. Provision of location data and analytics data is optional and based on your consent; declining either does not prevent you from using the app.

Automated decision-making. We do not use the personal data described in this notice to make decisions about you by automated means that produce legal or similarly significant effects on you.

9. Account deletion

Hubexo accounts are provisioned by your organisation. To request deletion of your account and associated personal data, email daniel.olvebrink@hubexo.com with the subject “Account deletion request”. We will confirm receipt and complete deletion within 30 days, subject to retention obligations under Swedish law (for example, bookkeeping records).

Note that deleting your account does not delete the underlying construction-project database that the app displays; that database is held under a separate legal basis as described in section 2.

10. Security

We protect personal data by, among other measures:

• storing authentication tokens in the device’s secure storage (iOS Keychain, Android Keystore);
• using TLS for all communications between the app and our backend;
• hosting authentication and backend services in AWS’s EU−Stockholm region;
• restricting employee access to personal data on a need-to-know basis.

11. Children

Hubexo Reach is a B2B service intended for employees of subscribing companies. It is not directed to children and we do not knowingly collect personal data from anyone under 16.

12. Cookies and similar technologies

Hubexo Reach itself does not use cookies. This support and privacy website (hosted on GitHub Pages) does not set any cookies or run any analytics, advertising or tracking scripts.

When you sign in, the app opens the Hubexo sign-in page (hosted by AWS Cognito) in a secure browser session. That sign-in page sets short-lived authentication cookies in the browser session, which are cleared when sign-in completes.

13. Changes to this notice

We may update this notice from time to time. Material changes will be announced in the app or by email. The effective date above tells you when the current version was published.

14. Contact and complaints

For questions, requests and complaints about Hubexo Reach and this notice, contact Hubexo HQ AB at daniel.olvebrink@hubexo.com or by post at Fälttelegrafplatsen 4, 169 71 Solna, Sweden.

Supervisory authority: Integritetsskyddsmyndigheten (IMY), imy@imy.se.

Looking for app support instead? See our support page.