Privacy Policy

This Privacy Policy explains what information Suedaz Hub collects, how we use it, and the choices you have. It covers the public website and the authenticated portal (together, the "Service").

• Account information: your name, email address, and password (stored as a one way hash, never in plain text).
• Organization information: your organization's name, type, country, currency, and other settings.
• Content you add: grants, contracts, funders, budgets, payments, compliance records, deadlines, notes, and any documents you upload.
• Usage and security data: an audit log of create, update, and delete actions (who, what, when), and short lived request records used to rate limit sign in, sign up, and password reset attempts.
• Session cookie: a single, essential, httpOnly cookie that keeps you signed in. We don't use third party advertising or analytics cookies.

• To provide, maintain, and secure the Service, including authenticating you and enforcing organization level access control.
• To send transactional email: email verification, password reset, deadline reminders, and account related notices. We don't send marketing email without your consent.
• To maintain the audit log required for compliance and accountability within your organization.
• To detect and prevent abuse, including rate limiting repeated sign in, sign up, and password reset attempts.

The Service runs on Vercel's hosting infrastructure, with data stored in a managed Postgres database (Prisma Postgres) and uploaded documents stored in Vercel Blob. All traffic to the Service is encrypted in transit (HTTPS). Passwords are hashed with bcrypt and never stored or logged in plain text.

Every organization's data is isolated by organization id at the database query level, and every mutating action is checked against your role's permissions on the server before it runs, not just hidden in the interface.

We use Resend to deliver transactional email (verification, password reset, welcome, and deadline reminder messages) from our verified domain. Resend processes the email address and message content solely to deliver that email on our behalf.

We don't sell your data, and we don't share it with third parties for their own marketing purposes. We share data only with the infrastructure providers necessary to run the Service (Vercel for hosting and file storage, Resend for email), each bound to process it only on our instructions, and when required to comply with the law.

We retain your organization's data for as long as your organization's workspace is active. If you close your organization's account, we'll delete or anonymize your data within a reasonable period, except where we're required to retain it longer by law.

You can access and correct most of your information directly within the portal (Organization Settings, Users & Permissions, and the records themselves). To request a full export or deletion of your organization's data, contact us at support@suedazhub.com.

The Service is intended for use by adults on behalf of organizations, not by children, and we don't knowingly collect information from children.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify Organization Admins by email.

Questions about this policy or your data? Reach us at support@suedazhub.com or through the Contact page.