Privacy Policy

Last updated: 11 June 2026

1. Who we are

hub-ai.dev (the “Service”) is operated by Sebastian Moreira, an individual based at Roletti 3618, Montevideo, Uruguay (“we”, “us”). The same operator runs cognisautomation.com. This policy explains what we collect, why, and your choices. Questions or requests: sebastian.moreiradl@gmail.com.

2. What we collect

Account data: your email, and (if provided) display name and profile picture — including name and profile picture from Google if you choose Google sign-in.
Billing data: your credit balance and a record of your purchases. Card details are handled by our payment provider; we never see or store them.
Usage data: basic, aggregated analytics (page views, key events) to improve the product — collected only if you consent to analytics cookies (see section 7).
Content you process: for local (in-browser) jobs, your data and your own model API key stay on your device and are never sent to us. For paid async jobs, only the inputs you choose for that job are forwarded to the model provider to produce results (see sections 4 and 5).

3. How we use it

To provide and secure the Service, run the jobs you request, process payments, send transactional email (verification, password reset, receipts), prevent abuse, and improve the product. We do not sell your personal data, and we do not send marketing email.

4. Async job content & retention

When you run a paid async job, the inputs and results for that batch are held only in our in-memory queue (Redis) with an automatic 24-hour expiry, after which they are permanently deleted. Async job content is never written to our database. Local jobs never reach our servers at all.

5. AI processing (OpenRouter)

Paid async jobs run on our platform key through OpenRouter, which routes your chosen inputs to the selected model. We use OpenRouter configured so that forwarded content is not retained and not used to train models. We send only what the job needs and never include your account password or payment details.

6. Processors we use

Lemon Squeezy — payments and merchant of record.
OpenRouter — model inference for paid async jobs.
Brevo — transactional email.
Google — optional sign-in (OAuth).
Google Analytics — usage analytics (only with your consent).
Amazon Web Services (AWS) — hosting (United States, region us-east-2).

7. Cookies & local storage

We use browser local storage to keep you signed in and remember preferences, and a short-lived cookie during the Google sign-in flow — these are strictly necessary and always on. Analytics cookies (Google Analytics) are set only after you accept them in our consent banner; you can decline or change your choice at any time, and you can clear all of these in your browser.

8. International transfers

We host the Service in the United States (AWS, region us-east-2), and our processors operate in the United States and elsewhere. If you use the Service from outside the United States, your data will be processed in the United States and other countries where our processors operate.

9. Retention & deletion

We keep account data while your account is active. You can delete your account from the account page, which removes your profile (including profile picture), sessions, and API keys. Async job content is auto-deleted within 24 hours (section 4). Our server logs do not retain IP addresses or email content. Some records (e.g. payment and tax records held by our payment provider) may be retained where required by law.

10. Your rights

Subject to applicable law, you may request to access, correct, export, or delete your personal data, or object to certain processing. You can do most of this directly from the account page, or contact sebastian.moreiradl@gmail.com and we will respond within a reasonable time.

11. Security

Passwords, sessions, and API keys are stored only as salted hashes, never in plain text. We take reasonable technical measures to protect your data, but no system is perfectly secure.

12. Children

The Service is intended for users aged 18 or older. We do not knowingly collect personal data from anyone under 18; if you believe a minor has used the Service, contact us and we will remove the data.

13. Changes

We may update this policy; material changes will be posted here with a new “last updated” date.