Privacy policy
Last updated 22 September 2026. This policy covers luuphub.com, the hosted feedback portals, and the embeddable widget.
Who we are
Luuphub is a feedback platform: teams embed our widget on their site, and their users submit feedback that appears on a hosted portal and dashboard. Questions about this policy go to hi@aina.rs.
We act as a controller for the data of account holders who sign up to Luuphub, and as a processorfor the feedback data that account holders’ end users submit through the widget and portals.
What we collect
Account holders: name, email address, and profile picture from Google Sign-In (the only sign-in method we offer); billing details handled by our payment provider, Polar; and usage of the dashboard itself.
End users submitting feedback:the feedback text, an email address, and, sent with each message, the address of the page they were on (without its query string), their browser, operating system and screen size, which only the site’s team sees. When the submitter chooses to add them: screenshots and files attached to a message, and voice notes and videos (from their camera or their screen) they record, and, where the site has it on, a written transcript of each. The widget shows a consent line before storing any visitor token; declining still allows reading and submitting.
Google user data
When you sign in with Google we receive your name, email address, and profile picture. We use them solely to create and identify your account. We do not request access to any other Google data, we never sell this data, and we never share it with third parties except the infrastructure providers listed below. Luuphub’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use data
To run the product: showing feedback to the team that owns the site, notifying subscribers who opted in to updates, transcribing recordings so the team can read them, triaging and deduplicating feedback with AI (your data is never used to train AI models), billing, and preventing abuse. We do not sell personal data or use it for advertising.
Who processes it
Our sub-processors are: Vercel (hosting), Hetzner (database), Resend (email), Polar (payments), OpenAI (AI triage and speech-to-text for recordings, not used for training), xAI (speech-to-text for recordings on the Free plan, not used for training), QStash by Upstash (job queue), Google Cloud (batch processing), and PostHog (product analytics). Full details are on Data processing & GDPR.
Your rights
You can export or delete your data at any time: account owners from Settings → Privacy & data (full JSON export; account deletion with a 30-day grace window), and feedback submitters from the portal footer (edit, delete, or full identity erasure). EU residents additionally hold all GDPR rights — access, rectification, erasure, restriction, portability, and objection — exercisable via the tools above or by emailing hi@aina.rs.
Cookies
We use a session cookie for signed-in dashboard users and — only with consent — a visitor token for widget submitters. No third-party advertising cookies.
Changes
If this policy changes materially, we will note it here and update the date above. Continued use after a change constitutes acceptance.