Privacy Policy

This policy explains how Hubertino MB, based in Riga, Latvia (“Hubertino”, “we”, “us”), the operator of hubertino.com, handles personal data. It covers your data as a visitor or customer, the business-listing data the service collects from public sources on our customers' behalf (including the decision makers it looks up for them), our browser extension, our CRM connector and our Google Sheets add-on. Contact for anything in this policy: [email protected].

Part I — your data

1. What we collect about you

• Account data — name, email address, and a password (stored only as a salted scrypt hash; we cannot read it).
• Billing data — handled by Stripe, our payment processor. We never see or store card numbers; we store your plan, Stripe customer/subscription references, and a credit ledger of grants and spends.
• Usage data — the scrapes you define (categories, locations, settings), their results, the Google place IDs you upload to skip businesses you already have (your existing-contacts list), and API keys (stored hashed).
• Technical data — IP address and request logs, used for security and rate limiting.

2. Cookies and analytics

Our essential cookies are a session cookie that keeps you signed in (httpOnly, expires after 30 days), a preference for light/dark mode, and, when you arrive with a search to start from (from one of our lead pages or the browser extension), a cookie that holds that search until your first scrape (at most 7 days). We use no advertising cookies.

To measure whether our own ads lead to sign-ups, we use Google Ads conversion measurement in cookieless mode: consent for ad storage and ad personalization is permanently set to "denied", so Google's tag stores nothing on your device and receives only aggregated, cookieless signals that Google uses to statistically model conversions. We do not use it to profile you, track you across other websites, or personalize ads.

We do use privacy-friendly, EU-hosted product analytics (PostHog) to understand how the product is used and how well it works — for example how many people who start a scrape complete it. It runs cookielessly: nothing is stored on your device beyond the current page session, we don't track you across other websites, and we never sell this data. For signed-in users we link usage to the account (legitimate interest, to improve the service); you can object at any time by emailing us. If we ever add cookie-based advertising or cross-site tracking, we will update this policy and ask for consent first.

We also use DataFast web analytics to count visits and see which pages and sources lead to sign-ups and purchases. It sets first-party analytics cookies on hubertino.com: datafast_visitor_id, datafast_visitor_first_seen_at and datafast_visitor_session_count (kept for 1 year), and datafast_session_id (30 minutes). They recognise a returning browser on our site only, not across other websites, and are not used for advertising (legitimate interest, to understand which of our pages and channels work). When you buy a plan or credits, we pass the two DataFast ids to Stripe with the payment, so DataFast can link the purchase to the visit that led to it. You can block or delete these cookies in your browser at any time; the site works the same without them.

3. Why we process your data

• To provide the service (contract): accounts, scrapes, results, exports, API access, support.
• To bill you (contract & legal obligation): payments, invoices, tax.
• To send transactional email (contract): email verification, password resets, and important account or billing notices. We do not send marketing email unless you have opted in, and every marketing message would include an unsubscribe.
• To keep the service safe (legitimate interest): abuse prevention, rate limiting, debugging.
• To understand how the site and product are used (legitimate interest): visit, sign-up and purchase analytics with DataFast and PostHog (section 2).

4. Who we share it with

We do not sell personal data. We share it only with processors that run the service for us: Stripe (payments, tax), our transactional-email provider, DataFast and PostHog (analytics), xAI (the optional SEO audit, see Part II), our hosting and web-infrastructure providers, all bound by data-processing agreements. Data is hosted in the EU; some processors (for example Stripe and xAI) process data in other countries under appropriate safeguards such as the EU Standard Contractual Clauses. We disclose data beyond that only if the law requires it.

5. How long we keep it

• Account data: while your account exists. You can permanently delete your account yourself at any time in Settings → Delete account — this removes your account, scrapes and remaining credits immediately and cancels any subscription, except what we must keep (e.g. invoices for tax law).
• Scrape results: until you delete the scrape or your account.
• Existing-contacts list: until you clear or replace it, or delete your account.
• Backups rotate on a 14-day cycle.

6. Your rights

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your data, restrict or object to processing, and withdraw consent where processing is based on it. Email us and we will act within a month. You can also complain to your local supervisory authority.

Part II — business-listing data

7. What the service collects

On our customers' instructions, Hubertino collects publicly available information about businesses from public web pages: business name, address, phone number, website, publicly listed contact email, social-media profile links, opening hours, ratings, and published reviews. With the optional SEO audit, it also makes an automated assessment of the business's website (what kind of site it is, a 0–10 score and its main issues) with an AI model from xAI, which processes for us, as our processor, the website's public content together with the listing's business name, category, city, country and phone number. xAI processes it in the United States, outside the EU, under the EU Standard Contractual Clauses. Where a business is a sole trader, some of this (a name, a phone number, an email) can be personal data — so we treat this data with GDPR care even though it is business information from public sources.

With the optional decision-maker lookup, which a customer turns on for a scrape, Hubertino also obtains, for each business in it, the professional details of up to two of its current decision makers (such as its owner, founder or CEO) from Coresignal, a professional-data provider that compiles publicly available professional profiles. To find the company we send Coresignal only the business's website domain or the address of its LinkedIn company page. To confirm up to two decision makers we may retrieve the professional record of up to three people at the business, which can include their work history and other details of their professional profile. Of those records we keep only, for at most two people, their name, job title, LinkedIn profile URL and, where available, a professional email address, which may be inferred from the company's email-address pattern rather than published by them, together with the company's size band (for example 11–50 employees) and its LinkedIn company page; we discard the rest as soon as the lookup ends. This is personal data, and we process it only on our customer's request, as part of the scrape they run.

8. Why and on what basis

We process this data in our legitimate interest — and our customers' — in making publicly available business contact information usable for business-to-business purposes such as market research and outreach. We collect only what the business itself has published or, for the decision-maker lookup, the professional record a professional-data provider holds about a person, of which we keep only the details of their role at the business, including a work email that may be inferred rather than published (see section 7); we do not build hidden profiles, and we do not collect data about private individuals or anyone's private life.

The decision-maker lookup serves our customers' business-to-business prospecting: reaching the person who decides for a business about an offer for that business. Its legal basis is likewise our and our customers' legitimate interests. We keep the professional details of at most two people per business, in their role at that business, and nothing is looked up unless a customer asks for it. The customer receives these details as part of their export, like the rest of the listing data.

Customers who export the data become independent controllers of their copy and must use it lawfully (our Terms bind them to that, including anti-spam rules).

9. How long the service keeps it

Job results are stored so customers can access their scrapes, and are deleted when the customer deletes the scrape or account. Decision-maker details are part of those results and kept the same way; we keep no separate list of the people found. Internal copies are kept no longer than needed to run the service, and backups rotate on a 14-day cycle.

10. If you are a listed business or a named decision maker

If your business appears in data processed by Hubertino, or you are named in it as one of a business's decision makers, you can exercise your GDPR rights with us, including your right to object: email [email protected] with the business name and the data concerned (for a decision maker, your name and the business). We will tell you what we hold, correct it, or delete it from the scrape results we hold where you object.

We cannot yet keep it out of later scrapes: each scrape searches its sources afresh and, for the decision-maker lookup, asks Coresignal again, and we keep no list of the people found. A later scrape that includes the business can therefore return the same details. To stop that at the source, also ask Coresignal to remove your profile from its records. Nor can we delete copies our customers exported before your request — for those, the customer is the controller and the request belongs with them — or remove your information from the public sources it came from. You can also complain to your local supervisory authority.

Part III — the browser extension

This part covers Email Finder for Google Maps™ — Hubertino, our extension for Chrome and Microsoft Edge. It runs entirely in your browser, has no account, and sends no data to Hubertino.

11. What the extension reads

• On Google Maps pages (www.google.com/maps and Google's country domains): the business data Maps loads for your search results and the place you open (Google's place IDs, business name, website, phone number and map position) and the page address. For a result whose website isn't in that data (mostly ads), it asks Google Maps for the place's details, the same request Maps sends when you open a place.
• Business websites: for the businesses in your Google Maps results or the place you have open, it loads the website the business lists, plus at most two of its contact or about pages, from your browser, without your cookies and without a referrer. Those websites see an ordinary visit from your IP address. The extension reads email addresses, social-profile links and contact-page links from them and does not keep the pages.
• The current tab: when you open the extension's popup on a Google Maps tab, its address and title, to offer “Export with Hubertino” for that search.

It does not read your Google account, your device's location (GPS or IP address), or pages other than Google Maps and those business websites, and it does not record what you type. On Google Maps it reacts to clicks, scrolling, the Escape key and keys pressed on its own icons and cards, only to open, close and place those cards. The map positions it reads are those of businesses and of the map view, not your device's.

12. What it stores and sends

• It saves none of the contacts it finds: they are held in memory only while the Google Maps tab that shows them is open. The browser's extension storage on your device holds only its settings (whether it is switched on, whether it has access to websites, and whether its Contacts card is minimized), which are never synced or sent anywhere.
• It sends nothing to Hubertino on its own. Links you click to hubertino.com (the Hubertino logo, “Export with Hubertino”) carry marketing parameters saying where in the extension you clicked; “Export with Hubertino” also carries the category and location of your Maps search so your first Hubertino search is filled in. hubertino.com moves them into the cookie described in section 2 before the page loads.
• It loads no remote code and includes no analytics or advertising.

The use of information received by the extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We don't sell or transfer this data, don't use it for advertising or creditworthiness, and don't use it for anything outside showing you the contact details of the businesses you look up and, when you ask, filling in an export of your search.

13. Your controls

• Switch the extension off in its popup; while it is off it checks no websites.
• To stop it opening business websites, set its Site access in chrome://extensions (edge://extensions in Edge) to “On specific sites” with only your Google Maps site. Phones and websites from Maps still show; emails don't.
• Uninstalling deletes its settings. It keeps no contacts, so there is nothing else to delete.

The contact details it shows are what businesses publish on their own websites. If you use them to contact businesses, follow the anti-spam and data-protection laws that apply to you.

Part IV — the CRM connector

This part covers Hubertino – Google Maps Leads, our app in the LeadConnector App Marketplace. It imports the businesses from your Hubertino scrapes into the contacts of a CRM account, and runs on our servers (connect.hubertino.com).

14. What the connector does

When the app is installed in a CRM account, the CRM gives the connector access to that account's contacts and contact fields. An account admin connects a Hubertino account by pasting its API key. When a user starts an import, the connector reads that scrape's rows from Hubertino and creates or updates one contact per business, with the tags and fields the user chose. It never reads the account's existing contacts or any other CRM data, and uses its access only for the imports users start.

15. What it stores, and for how long

• Access to the CRM account — the CRM's access tokens, encrypted. Kept until the app is uninstalled.
• The connected Hubertino API key — encrypted, with which user connected it and when. Kept until it is disconnected or the app is uninstalled.
• Import history — for each import: the scrape, the column mapping, tags and options, the counts, and the CRM user who started it (their ID and name). The last 50 imports per account are kept.
• Import reports — for each business an import skipped or couldn't write: its row number, name, email, phone and the reason, so users can see and download what didn't go in. Kept with its import.

The connector keeps no copy of the contacts it imports, and never logs tokens, keys or the user details the CRM shares with it. The business data it imports is the business-listing data described in Part II.

16. Disconnecting and uninstalling

• Disconnecting Hubertino inside the app deletes the API key and stops imports in progress.
• Uninstalling the app from the App Marketplace deletes everything above for that account. Contacts already imported stay in the CRM account, which controls them.

Part V — the Google Sheets add-on

This part covers our Google Sheets add-on, listed in the Google Workspace Marketplace as Hubertino: Local Business Leads & Emails. From a sidebar in Google Sheets it starts searches on your Hubertino account and writes the businesses they find into the spreadsheet you're using. It runs in Google Apps Script under your Google account and talks to one service only: hubertino.com.

17. What the add-on accesses

• Your Google account's email address and account ID (the openid and userinfo.email permissions). The add-on sends them to hubertino.com as a token signed by Google with each request, so we know which Hubertino account is asking. The first time, we link your Google account to the Hubertino account with the same email, or create one — only after you press Continue in the sidebar. Account data is then handled as described in Part I.
• The spreadsheet you open it in (spreadsheets.currentonly), and no other file. The add-on adds one tab per search and writes that search's businesses into it. It reads only the tabs it created, and only to update their rows when you import a search again. It never sends the contents of your spreadsheet to us. Which tab belongs to which search is saved inside the spreadsheet itself.
• Connecting to an external service (script.external_request): requests go to hubertino.com only — to read your account, start and stop searches, and fetch their results.
• Showing the sidebar (script.container.ui).

18. What we store

The same as for any Hubertino account (Part I): your account, the searches you run from the sidebar (business types, locations and settings) with their results, and your credit ledger — plus the Google account ID linked to your account. We receive nothing from your spreadsheet. Search results are the business-listing data described in Part II.

19. Limited Use, and removing the add-on

Hubertino's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google account information only to sign you in to Hubertino. We don't sell it, use it for advertising, or transfer it to anyone except as needed to run the service, for security, or when the law requires it.

• Remove the add-on in Google Sheets under Extensions → Add-ons → Manage add-ons, or revoke its access at myaccount.google.com/permissions.
• Tabs it created stay in your spreadsheet: they're yours.
• Your Hubertino account stays until you delete it in Settings → Delete account, or ask us to.

20. Changes and contact

We will update this policy as the service evolves and note the date at the top; material changes are announced in the app or by email. Anything unclear, any request, any concern: [email protected].