This Privacy Policy describes how Hugo ApS ("Hugo," "we," "us") processes personal data when you visit our websites, create an account, or use the Hugo platform (the "Services").
1. Data controller
Hugo ApS is the controller for personal data we process in connection with the Services. Contact: privacy@hugo.app or hello@hugo.app. Registered office: Copenhagen, Denmark.
2. What we collect
Depending on how you use the Services, we may process:
- Account and profile data: name, email, organization name, role, and authentication identifiers.
- Service and technical data: device and browser type, IP address, approximate location, log events, and diagnostic data to secure and operate the platform.
- Content you provide: data you or your organization uploads or generates in the product (e.g. messages, files, tasks, calendar data, financial records) to the extent it includes personal data.
- Support and communications: information you send when you contact us or participate in surveys.
- Billing data: payment-related information processed by our payment provider; we do not store full card numbers on our servers.
3. How we use personal data
We use personal data to:
- Provide, maintain, and improve the Services, including AI features you enable.
- Authenticate users, enforce security, and prevent abuse.
- Communicate about the Services, updates, and (where permitted) marketing.
- Comply with legal obligations and respond to lawful requests.
- Analyze usage in aggregate or de-identified form to improve reliability and product experience.
4. Legal bases (EEA/UK)
Where GDPR applies, we rely on:
- Performance of a contract (providing the Services you requested).
- Legitimate interests (security, product improvement, fraud prevention), balanced against your rights.
- Consent where required (e.g. certain non-essential cookies or marketing).
- Legal obligation where we must retain or disclose data.
5. Sharing and subprocessors
We share personal data with service providers who process it on our instructions (hosting, authentication, analytics, email delivery, payment processing, AI/LLM infrastructure, and customer support tools). We require appropriate safeguards. A current list of key subprocessors is available on request and may be referenced in order documentation. We may also disclose data if required by law or to protect rights and safety.
6. International transfers
We may process data in the European Economic Area and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses and supplementary measures where required.
7. Retention
We retain personal data for as long as your account is active, as needed to provide the Services, and as required by law, dispute resolution, or billing. Backup and log retention follows our security and compliance schedules.
8. Security
We implement technical and organizational measures designed to protect personal data, including access controls and encryption in transit. No method of transmission or storage is 100% secure; we encourage strong passwords and workspace access policies.
9. Your rights
Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, to data portability, and to object to certain processing. You may withdraw consent where processing is consent-based. To exercise rights, contact privacy@hugo.app. You may lodge a complaint with your local supervisory authority.
10. Children
The Services are not directed at children under 16, and we do not knowingly collect their personal data.
11. Changes
We may update this Policy and will revise the "Last updated" date. Material changes will be announced as appropriate (e.g. in-product notice or email).
12. Cookies
For details on cookies and similar technologies, see our Cookie Policy.