Privacy Policy

This Privacy Policy applies to the Hublink website builder and hosting service (the “Service”) and to our own websites. It describes how we handle personal data of account holders and visitors. Using the Service is also subject to our Terms of Service.

Nova Link (“Nova Link,” “we,” “us”) is the controller of personal data we process about our account holders. For personal data that account holders collect from visitors to the pages they build (for example, through contact forms), the account holder is the controller and Nova Link acts as a processor on their behalf — see Visitors to pages built on Hublink below.

Information you give us

• Account data — your name (optional), email address, and password (stored only as a secure hash).
• Your content — the pages, text, images, files, and other material you create or upload.
• Payment data — when you subscribe, our payment provider collects your payment details. We receive a customer and subscription reference and limited billing metadata, but not your full card number.
• Support and contact — messages you send us and information you include in them.

Information we collect automatically

• Usage and analytics — aggregate stats about your pages (such as views and clicks) and how you use the dashboard.
• Device and log data — IP address, approximate location (country), browser and device type, and timestamps, used for security, abuse prevention, and to operate the Service.
• Cookies — see Cookies and similar technologies.

We use personal data to:

• provide, maintain, and improve the Service, and host and serve your pages;
• process payments, manage subscriptions, and send billing and service messages;
• secure the Service, prevent fraud and abuse, and enforce our Terms;
• respond to your requests and provide support; and
• comply with legal obligations.

We do not sell your personal data, and we don’t use the content you host to build advertising profiles.

Where data-protection law such as the EU/UK GDPR or Thailand’s Personal Data Protection Act (PDPA) applies, we rely on these legal bases:

• Contract — to provide the Service you sign up for and process your payments.
• Legitimate interests — to secure and improve the Service and prevent abuse, balanced against your rights.
• Consent — where we ask for it (for example, certain optional cookies or communications); you can withdraw it at any time.
• Legal obligation — to meet accounting, tax, and other legal requirements.

We use strictly necessary cookies to keep you signed in and to keep the Service secure (including bot protection). We may use limited analytics to understand and improve how the Service is used.

When a published page embeds outside media (for example a YouTube or Vimeo player), that service loads with the page and may set its own cookies; those cookies are controlled by the third-party provider, not by Nova Link.

Separately, if you (as an account holder) add third-party analytics or marketing tools to your own pages — such as Google Analytics or Meta Pixel — those are set under your control and responsibility, and you are responsible for any consent or notices your visitors require.

We don’t sell your data. We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions. These currently include:

• Cloudflare — hosting, storage, content delivery, security, and bot protection (including Cloudflare Turnstile, which helps us tell real visitors from bots on the live-chat widget; use of Turnstile is subject to the Cloudflare Turnstile Privacy Addendum).
• Stripe — payment processing (including PromptPay).
• Email delivery — to send account, verification, and service emails.
• LINE (LY Corporation) — only for the live-chat feature: when an account holder connects their LINE account, we send them a LINE notification (with the visitor’s first message and a link to their dashboard Inbox) the moment a new chat starts, so they know to reply. The owner reads and replies in their Inbox, not in LINE. Notifications sent through LINE are also handled by LY Corporation under its own privacy policy. See Live chat below.
• Mailchimp — only if you connect it to sync email-list sign-ups you collect.

We may also disclose data if required by law, to protect our rights, users, or the public, or in connection with a merger, acquisition, or sale of assets (with continued protection of your data).

When someone visits a page built by an account holder, we process limited data to serve the page and produce aggregate analytics for the page owner (such as views, clicks, and country-level location). If a page includes a contact or sign-up form, the information a visitor submits is collected on behalf of the page owner, who is the controller of that data; Nova Link processes it on their instructions.

Form submissions are stored in the page owner’s Hublink inbox as well as emailed to them, so the owner can read, export and delete them. They are kept until the owner deletes them, and they are deleted with the page. This page is the plain-words disclosure of how those submissions are handled.

If a visitor separately ticks a box asking to receive updates, we record when they agreed and the exact sentence they agreed to, and they may then receive emails sent by the page owner through Hublink. Every such email says who it is from and why they are receiving it, and carries a one-click unsubscribe that we honour permanently and platform-wide. We never email a visitor anything else — no receipts, no marketing of our own. Contacts with no recorded consent are never emailed.

Votes on a poll card are stored as anonymous counts only — no identifier of any kind is recorded with a vote.

If you’re a visitor and want your form submission accessed or deleted, please contact the owner of the page you interacted with — they have a control that deletes it. You can also reach us and we’ll help route your request. To stop receiving a page owner’s emails, use the unsubscribe link in any of them; it works without an account and without a reply from anyone.

Account holders can turn on a live-chat widget on the pages they build. When a visitor sends a chat message, the account holder is the controller of that conversation and Nova Link acts as a processor on their behalf — the same relationship as contact forms described under Visitors to pages built on Hublink.

To run the widget we process the chat messages, any name or contact details a visitor chooses to share (for example if a chat goes unanswered and we ask how the owner can follow up), and a hashed form of the visitor’s IP address used only for abuse prevention — we do not store the raw IP with the conversation. A visitor’s contact details are shared only with the page owner (by email), never sent to LINE.

If the account holder has connected their LINE account, we send them a LINE notification (LY Corporation) when a new chat starts — it includes the visitor’s first message and a link to the owner’s Inbox. The owner reads and replies in their dashboard Inbox, not in LINE. Once a notification has been delivered to LINE, it also lives in the owner’s and Hublink’s LINE accounts under LY Corporation’s control, and that copy is beyond Nova Link’s ability to delete. The chat widget shows a short notice (“Messages are forwarded to the page owner”) with a link to this policy so visitors know before they write.

We keep chat conversations — messages and any captured contact details — for 90 days after the conversation’s last activity, then permanently delete them. If the account holder deletes their site, its conversations are deleted with it. To reach a page owner about a chat you had, or to ask us to help route a request, use the details under Visitors to pages built on Hublink.

We keep personal data for as long as your account is active and as needed to provide the Service. After you delete content or your account, we remove or anonymize your data within a reasonable period, except where we must keep certain records (for example, transaction records for tax and accounting) or where limited copies remain in routine backups for a short time.

Some data has a specific retention period: live-chat conversations are deleted 90 days after their last activity.

We use technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and bot protection. No system is perfectly secure, so we can’t guarantee absolute security, but we work to protect your data and will notify you of a significant breach where required by law.

We and our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect personal data transferred across borders.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data or complete incomplete data;
• delete your data, or restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent where processing is based on consent.

You can exercise these rights by contacting us. We’ll respond within the time the law requires. You also have the right to complain to your local data-protection authority.

The Service is not directed to children, and we don’t knowingly collect personal data from children under 16 (or the age of digital consent in your country). If you believe a child has provided us data, contact us and we’ll delete it.

We may update this policy from time to time. If we make material changes, we’ll post the updated policy here with a new “last updated” date and, where appropriate, notify you in the app.

To exercise your rights or ask a privacy question, reach us through our contact page and we’ll be glad to help.