Hub and Iabot Privacy Policy

Last updated: 9 November 2026

This policy explains our processing of data in Hub Studio, Hub Flow and Iabot, including email, AI employees, the work computer and Google and TikTok connections. It is publicly available without an account.

Google data and permissions · TikTok · AI processing · Disconnection and deletion · Your rights

1. Who processes your data

The service provider is Iluzona Innova SL, tax ID B75648386, at Av. de Canarias, 10, 35002 Las Palmas de Gran Canaria, Las Palmas, Spain (Canary Islands). Privacy and support contact: team@iabot.io; telephone +34 613 06 06 51.

We are the controller for account, contracting, billing, security and customer support data. When a business instructs Hub to process emails, documents or other personal data for its purposes, that business is the controller and we act as its processor for that service. Workspace access depends on the business's configuration and authorizations. Any required data processing agreement must be concluded with the customer; this policy does not replace it.

2. Data and sources

Account and commercial information: name, email, business details, authentication, preferences, support and billing information. Stripe processes payments; Hub does not store your full card number.
Requested work: instructions, conversations, files, audio, images, results, drafts, routines and AI employee action records.
Connected services: data you authorize us to access or use, account identifiers and credentials or tokens needed to maintain the connection.
Work computer: files, sessions and screenshots needed by the agent to perform a task in the business environment.
Operations and security: IP addresses, browser details, sessions, errors, usage and access/execution logs. We do not need your email content for advertising.

Data comes from you, authorized workspace users, your tasks and the services you connect. You must have a lawful basis for providing other people's data and inform them where required.

3. Google connections: data, permissions and purposes

Connecting Google is optional. You start in Hub and authorize permissions on Google's OAuth screen, without giving us your Google password. Access and refresh tokens may be stored to run authorized functions while connected, including configured syncs and routines. A Google account does not necessarily have Gmail enabled.

Identity (openid and email): identify the authorized account and associate it with the workspace connection.
Gmail (gmail.readonly and gmail.send): read messages, senders, recipients, subjects, dates, labels, bodies and available attachments; display Iabot Mail; search or summarize email and prepare replies on request; send messages following user instructions or authorized automations. Drafts may be saved in Hub. These permissions do not allow changing or deleting the original Gmail messages.
Drive (drive.readonly): find files and read names, identifiers, types, dates and other metadata. The granted scope provides read access to files accessible to the account; the current connector offers search and metadata retrieval.
Calendar (calendar.calendarlist.readonly and calendar.events.readonly): read calendars and events, including titles, times, descriptions, locations and participants present in responses, to answer schedule questions.
Sheets (spreadsheets.readonly): inspect workbook structure and read cell ranges for requested queries and reports.
Docs (documents.readonly): read documents to answer questions, extract information or prepare summaries as requested.

The current Drive, Calendar, Sheets and Docs connectors are read-only. Connecting one service does not automatically authorize all others. Connections belong to the workspace and administrators decide which AI employees may use them. Browser actions with a signed-in session are a separate access mechanism, governed by that session and the user's instructions and permissions.

4. AI processing

When you ask an AI employee to work with an email, event or document, necessary content may be sent in the context to the model provider to generate a response. Results, summaries and evidence may also be stored in task history or workspace working memory. Mailbox synchronization and running an AI model are separate operations.

We use AI infrastructure and gateways such as OpenRouter and the selected model's providers, which may include OpenAI, Anthropic, Google, Groq or BytePlus. Processing depends on the model and feature; each task is not sent to every provider. The work computer may use Daytona infrastructure. You can request information about providers applicable to your service through our privacy contact.

We do not use or authorize the use of data obtained from Google APIs, or derived data, to create, train or improve general-purpose AI or machine learning models. Using data as context to perform your request does not grant a model-training licence. We also do not use it for advertising, advertising profiles or data sales.

5. Google Limited Use commitment

Hub and Iabot's use and transfer of information received from Google APIs are subject to the Google API Services User Data Policy and the Google Workspace user data policy, including their Limited Use requirements.

We use this information for the visible productivity features you authorize. Transfers are limited to what is needed for those features with your consent, security, legal obligations, or a corporate transaction with the prior consent required by Google. We do not sell it, provide it to data brokers or use it for creditworthiness or lending. These restrictions also cover derived information.

Hub personnel do not read Google content except with your explicit authorization for specific data, as necessary for security or legal obligations, or for aggregated and anonymized information as permitted by Google's policy. A general support request does not authorize access to your entire mailbox.

6. TikTok connection: data, permissions and purpose

Connecting TikTok is optional. An authorised person in the company starts the connection from Apps and grants the permissions on TikTok through OAuth (Login Kit). You never give us your TikTok password. Administrators decide which AI employees may use the connection.

We request two scopes:

user.info.basic: read the account identifier (open_id), display name and profile picture, to identify the connected account and show it in Apps and on each approval.
video.publish: publish to that account's profile the videos a person approves in iabot.

Before each post we query TikTok, at that moment, for the account's nickname and username, profile picture, available privacy options, whether comments, duets and stitches are allowed, and the maximum video length. We use this to show the approval card and check that the post is possible.

Nothing is posted without human approval. An AI employee may prepare a post, but it is only sent when a person reviews the video and caption on the card, chooses who can see it and which interactions are allowed, declares commercial content and the AI-generated label where relevant, and presses Publish. None of these options is preselected.

When posting we send TikTok the caption, the privacy level and the chosen options, plus a temporary HTTPS link from which TikTok downloads the video. The link expires after 4 hours at most. We then check the post status to confirm it has finished.

We store the access and refresh tokens encrypted while the connection is active. We also store the name of the connected account and, in the task history, the approval with the chosen options and the post identifier returned by TikTok.

When an AI employee checks the account or a post status, that data may be part of the context sent to the model provider, as described in AI processing. We do not use TikTok data for advertising, we do not sell it, and we do not use it to train general-purpose AI models.

Disconnecting TikTok: go to Apps → TikTok → Disconnect. iabot revokes the access on TikTok and deletes the stored credentials. You can also remove the access from your TikTok account's security settings, under apps with access. Disconnecting does not delete videos already posted; manage them in TikTok. To delete the history stored in iabot, follow Disconnecting and requesting deletion.

Your account and posted videos remain subject to TikTok's Terms of Service and Privacy Policy. iabot is not endorsed by TikTok because it offers this connection.

7. Purposes and legal bases

Service delivery and requests: performance of the contract, including accounts, tasks, chosen integrations and support.
Billing and applicable requirements: compliance with legal obligations.
Security and fraud prevention: legitimate interests balanced against individual rights, and legal obligations where applicable.
Marketing and optional cookies: consent where required, which may be withdrawn. See our Cookie Policy.

OAuth authorization controls access; it does not replace a business's lawful basis for processing customer or employee data. Withholding necessary information or permissions makes the corresponding feature unavailable.

8. Recipients and international transfers

Data may be processed by hosting, database and storage providers including Supabase, the AI and computer providers described above, Stripe for payments and services you connect. They should receive only what is needed for their role. Sent email is disclosed to your chosen recipients. Sharing with other applications depends on your instructions and Google's restrictions.

Some providers may process data outside the European Economic Area. Where applicable, transfers must rely on an adequacy decision or valid safeguards such as standard contractual clauses and necessary supplementary measures. You can request details of destinations, providers and safeguards applicable to your account. We do not claim that all processing takes place in Europe.

9. Storage, retention and security

Account data is retained as needed for the contractual relationship. Imported content, chats, documents and results remain in the workspace to provide the service and its history until deleted or a deletion request is processed, subject to legal retention requirements. Security and usage records are retained as needed for their purposes; accounting records are retained for applicable statutory periods, with restricted access where appropriate.

We use HTTPS for web connections, encrypted stored OAuth tokens, authentication and business-level access controls. Content may be held in databases, files, execution records and backups; the service does not provide end-to-end encryption against AI processing. No system eliminates every risk.

Backups may retain residual information until replacement or purging within the applicable retention cycle. They are not active data for new tasks; deletion requests must be reapplied if a backup is restored. When handling a request we will explain its scope and any applicable exceptions or timeframes.

10. Disconnecting and requesting deletion

Disconnect Gmail in Hub: Iabot Mail → select mailbox → Edit → Disconnect account (Spanish interface: Editar → Desconectar cuenta), or Applications → Gmail → Disconnect. This removes that connection's credentials and associated mailbox. Previously imported email and history are not automatically deleted.
Revoke access at Google: open your Google account connections and remove Iabot's access. This may affect other Google services authorized for the same app. Also sign out of any separate Google browser session on the Hub computer to end that independent access.
Delete imported data or close an account: email team@iabot.io from your linked address, identifying the workspace, connected account and whether you request deletion of email, files, histories or the whole account. Do not send passwords, tokens or mailbox contents. For business accounts we verify your authority and coordinate with the controller.

Disconnection prevents new operations using that connection; it cannot undo a completed send or other action. Deleting a Hub copy does not delete the original at Google or copies you sent elsewhere.

11. Rights and complaints

You may request access, correction, deletion, restriction, objection and portability where applicable, and withdraw consent without affecting prior lawful processing. Contact team@iabot.io. We ask only for information necessary to verify identity and authority.

We generally respond within one month of receiving a request. If a legally permitted extension is necessary, we notify you within that month. You may complain to the Spanish Data Protection Agency or the competent authority. When processing on behalf of your business, we assist it in responding.

12. Decisions, age and changes of purpose

Iabot generates results and executes tasks according to user configuration. It should not be the sole basis for decisions producing legal or similarly significant effects without appropriate safeguards and oversight. The service is intended for adults and organizations, not children.

Updated versions are published with their date. Material changes are communicated through service channels. A new use of Google data requires prior information and any required authorization; publication alone does not expand existing permissions.

13. The iabot.io website and contact form

In addition to the services above, this website provides information and commercial services. If you write to us through the contact form we process your name, email, company, phone number (if provided), area of interest and message, together with the URL from which you submit it and your browser's user agent, to provide context and prevent abuse.

We use this data to respond to your enquiry or request for a demo or audit, to manage the business relationship where applicable and to prevent spam and misuse. The legal bases are pre-contractual measures or legitimate interest when responding to requests you send us voluntarily, your consent when you tick the acceptance box, and legal obligation when the law requires us to retain certain information.

Messages are received by email at team@iabot.io; email and infrastructure providers required to deliver the service may be involved. We do not sell your data. We retain enquiries for as long as needed to respond and, where applicable, for any additional period required by legal obligations or to manage a business relationship arising from the enquiry.

See our Terms and Conditions and the Spanish version.