Privacy policy

This policy explains how Business Utility Hub ("we") handles personal data. It is written with the EU and UK General Data Protection Regulation (GDPR) in mind.

Who is responsible

For account data of our customers (the businesses that use the service), we are the controller. For the content of files you upload, you remain the controller and we process them only to perform the task you request.

What we collect

Account details (name, email, password hash or Google account identifier), workspace settings, the files you upload for processing and the results, billing status from Stripe (we never see full card numbers), and security logs such as IP addresses of sign-in attempts. Uploaded files are processed on our own server and never sent to third-party or AI services. Uploads are deleted immediately after processing; results are deleted automatically after the retention period of your plan (a few hours without an account, 7 days on Free, 90 days on Pro). Visitors without an account are counted for daily limits using an anonymised, daily-changing hash of their IP address.

Why we use it

To provide the service (contract), to keep it secure and prevent abuse (legitimate interest), to perform the file task you request, and to meet legal obligations such as tax records.

Cookies

We use only strictly necessary cookies: a session cookie to keep you signed in, a security token against forged requests, and an optional "remember me" cookie. We do not use advertising or analytics cookies, third-party fonts or trackers, so no cookie banner is needed.

Who we share it with

Service providers that help us run the service: our hosting provider, our email provider, Stripe for payments, Google if you choose Google sign-in. Each is bound by a data processing agreement. Where data leaves the EU/UK, standard contractual clauses or an adequacy decision apply.

How long we keep it

While the account is active. After an account is closed we delete workspace data within 90 days, except records we must keep by law. Security logs are kept for up to 12 months.

Your rights

You can access, correct, export, restrict or delete your data, object to processing and withdraw consent at any time. You can delete individual results or your whole account at any time from your account page. You can also complain to your data protection authority.

Security

Encrypted connections (HTTPS), hashed passwords, two-factor sign-in for our staff, strict access controls between workspaces, and nightly backups.

Contact

Email support@diagnostack.cloud. Last updated October 2026.