Legal
Data Processing Agreement
A summary of the terms under which Hubfolio processes personal data for your organisation, in line with GDPR Article 28.
Last updated: October 21, 2026
1. Parties and roles
Your organisation is the controller of the personal data entered into Hubfolio. Space in the Making AB (Smedsbacksgatan 7, SE-115 39 Stockholm, Sweden) is the processor and processes it only on your documented instructions.
2. Purpose
Providing Hubfolio: project and service management, documents, procurement, invoicing workflows, email notifications and AI-assisted suggestions.
3. Data subjects and data types
Users, client contacts, consultants, contractors and suppliers. Names, work email and phone, company, role, sign-in and activity records, and personal data contained in uploaded documents and photos. No special categories of data are intended to be processed.
4. Confidentiality
Everyone with access to the data is bound by confidentiality.
5. Security measures
Encryption in transit and at rest, database-enforced access per organisation, mandatory two-step sign-in, private file storage with short-lived signed links, logged approvals and least-privilege staff access.
6. Sub-processors
You authorise the sub-processors listed below. We notify you by email at least 30 days before adding or replacing one, and you may object.
7. Transfers outside the EU/EEA
Only with an adequate safeguard, such as the EU Standard Contractual Clauses.
8. Assistance
We help you answer data subject requests (access, correction, deletion, export) and with impact assessments where relevant.
9. Personal data breaches
We notify you without undue delay and no later than 72 hours after becoming aware of a breach, with the information you need to meet your own obligations.
10. Audits
We make available the information needed to show compliance and answer reasonable security questionnaires. On-site audits by agreement, with reasonable notice.
11. End of the agreement
You can export your data at any time. Within 30 days of the end of the agreement we delete or return the personal data, unless the law requires us to keep it.
12. Governing law
Swedish law. Stockholm District Court (Stockholms tingsrätt) is the court of first instance.
Approved sub-processors
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
Lovable Cloud hosted on Amazon Web Services | Application hosting, database, user accounts and file storage | EU (Ireland) | Encryption in transit and at rest; database-level access control |
Cloudflare | Website delivery, network security and DDoS protection | Global network, SCCs | TLS encryption; no storage of Hub content |
Lovable Emails with its underlying email delivery provider | Account and service email (invitations, sign-in codes, notifications) | EU/US, SCCs | Only recipient address and message content |
Lovable AI Gateway with underlying AI model providers | AI-assisted document reading and in-app assistance | EU/US, SCCs | Client data is not used to train AI models |
Questions: hello@hubfolio.ai. See also the Trust page and Privacy Policy.