Privacy Policy

This policy applies to communityhub.cloud and every Community Hub product, including dashboards hosted for a community or organization — for example, the Oberlin dashboard at oberlin.communityhub.cloud — and to the optional Google Sheets connection in Data Hub.

It does not apply to third-party websites or services, including Google. When you use Google Sign-In or connect Google Sheets, Google’s own terms and privacy policy also apply to your Google account.

Information you give us

Your name, email address, organization, role, the content you create or upload, and the messages you send to support or sales.

Account and sign-in information

Your name, email address, Google account identifier when you choose Google Sign-In, a hashed password when you use email sign-in, your organization and role, and session information needed to keep you signed in. If you use a guest workspace, we create a signed workspace identifier for that browser rather than asking you to create an account.

Google user data

When you connect Google Sheets, we receive the basic profile information described below and the spreadsheet data you choose to connect. This is described in full in Google user data.

Usage and device information

IP address, browser and device type, operating system, pages and screens viewed, referring page, timestamps, and diagnostic logs. We use this to run, secure and improve the service, and to understand which features are used.

Cookies and similar technologies

We use a small number of strictly necessary cookies. See Cookies.

Aggregated and de-identified information

We may create aggregated or de-identified information that cannot reasonably be used to identify you. We may use it to operate, improve and describe the service.

Connecting Google Sheets is optional. It lets an authorized administrator import rows from a spreadsheet into their organization’s Data Hub so the data can appear in dashboards, stories and public displays.

What we access

• Basic profile: your name, email address and Google account identifier. We use these for sign-in and to identify the connected Google account.
• Google Sheets data: the spreadsheet you choose to connect, its spreadsheet and sheet titles, the configuration needed to import it (for example which column contains the date), and the values read from the tab you designate, such as the Master Data tab.
• OAuth tokens: encrypted tokens used to refresh read-only access to the spreadsheet you linked.

We request the read-only Google Sheets scope https://www.googleapis.com/auth/spreadsheets.readonly, plus basic profile and email for account linking. We do not write to your spreadsheets.

How we use it

Only to provide the feature you asked for: importing and syncing the selected Google Sheet into your organization’s Community Hub dashboards, showing that data to the people your organization authorizes, and supporting the connection when something goes wrong. We do not use Google user data for advertising, and we do not sell it.

In line with the Google API Services User Data Policy, Google user data is not used to develop, improve or train generalized artificial intelligence or machine-learning models, is not used to determine creditworthiness or for lending purposes, and is not transferred to third parties except as described in Sharing. Access by our staff is limited to authorized personnel who need it to operate, secure or support the service, or to comply with law.

You can revoke access at any time. See How to disconnect Google access.

We use information to:

• provide, operate and maintain the service, including dashboards, maps and signage;
• authenticate users, create and secure workspaces, and manage organization membership;
• import, sync and display the Google Sheets data an administrator connects;
• respond to support, sales and privacy requests;
• monitor reliability, prevent abuse, investigate security incidents and enforce our terms;
• understand usage and improve features, using aggregated or de-identified information where practical;
• comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not use Google user data for advertising or to train generalized AI models.

Legal bases for European users

Where the GDPR or UK GDPR applies, we rely on: performance of a contract with you or your organization; our legitimate interests in operating, securing and improving the service; compliance with legal obligations; and your consent where we ask for it (for example, an optional integration). You can withdraw consent at any time without affecting processing that already happened.

We do not sell personal information, and we do not share Google user data with third parties for their own purposes.

We share information only in these situations:

• Service providers. Companies that host or run Community Hub under contract, such as DigitalOcean for hosting and infrastructure, and providers that help us with authentication, email and security. They may process information only to provide those services to us.
• Your organization. If your account belongs to an organization, authorized administrators can see and manage the organization’s content, members and connected data sources.
• Legal and safety. When we believe disclosure is required by law, legal process, or necessary to protect rights, safety, security or the integrity of the service.
• A business transfer. If Community Hub is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction. When you ask us to share something, for example a public dashboard or an embeddable.

Google connection data

OAuth tokens, the connected Google account email, the linked spreadsheet URL and integration settings are kept while the Google Sheets data source exists and remains enabled in Data Hub for your organization, or until you disconnect Google or delete that data source.

Imported Google Sheet data

Values imported into Data Hub are kept as long as your organization uses Data Hub and the integration remains active, unless your organization deletes the data source, disables the integration, or requests deletion. Historical time-series may remain in backups for a limited period consistent with our backup and disaster-recovery practices.

Temporary setup data

In-progress setup data created before you finish a connection is kept only for a short period, on the order of hours, and is then removed automatically.

Account and workspace data

Kept while the account or organization workspace is active. After deletion, limited copies may remain in backups, logs or records for the period needed for security, legal or accounting purposes.

Requested deletion

When we verify a deletion request, we delete or anonymize the requested data within 30 days, except for limited information we must keep for legal, security or backup obligations. If we keep something, we tell you what and why.

We use Google user data only to provide the import feature described above. We do not use it for advertising, and we do not sell it.

Community Hub is hosted on DigitalOcean. We protect information with HTTPS/TLS in transit, encryption at rest for stored data and OAuth tokens, access limited to authorized staff and service providers, and monitoring for abuse and security events.

No system is perfectly secure. If we become aware of a breach that affects personal information, we will notify affected organizations and individuals, and the authorities, as required by applicable law.

You can stop our access to your Google account in either of these ways:

1. Inside Community Hub (recommended)

Sign in to your organization’s Data Hub site (for example https://oberlin.communityhub.cloud), go to Data Hub → Data Sources → Google Sheet, open the integration, and either delete the data source or use Change Account to remove the linked Google account. That stops scheduled imports and removes the stored OAuth credentials for that integration.

2. In your Google Account

Revoke access at myaccount.google.com/permissions by removing Community Hub (or the name shown for this OAuth client). After revocation, imports stop; we clear the stored connection when our systems detect that the token is no longer valid.

To request deletion of Google-linked connection data and/or imported data associated with your organization’s Google Sheets integration, contact us at info@communityhub.cloud. Include:

• your organization name and Data Hub site URL;
• the Google account email used for the connection, if known;
• whether you want connection data only, or connection data and imported sheet data removed.

We will verify that you are authorized to act for that organization, then delete or anonymize the requested data within 30 days, except where we must retain limited information for legal, security or backup obligations. If we keep something, we will tell you what we kept and why.

You can ask us to access, correct, export or delete your personal information by emailing privacy@communityhub.cloud. We respond within 30 days. Organization administrators can also update or remove members of their organization.

European Economic Area and United Kingdom

If the GDPR or UK GDPR applies, you have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. You also have the right to complain to your local supervisory authority. We process data to provide the service you or your organization requested, for our legitimate interests in running and securing it, and to meet legal obligations.

California

If the California Consumer Privacy Act, as amended by the CPRA, applies, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CPRA. You may use an authorized agent; we may ask for proof of authorization.

Other regions

If your local law gives you additional rights, contact us and we will honor them. We may need to verify your identity before acting on a request.

We use only strictly necessary cookies: a secure session cookie that keeps you signed in and expires after 24 hours. We do not use advertising cookies.

Your browser can block or delete cookies. If you block the session cookie, you may not be able to stay signed in to Data Hub or the Studio.

Community Hub is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact privacy@communityhub.cloud and we will delete it. In the European Union and the United Kingdom, the minimum age for consent to online services is 16 unless local law sets a lower age.

Community Hub is hosted on DigitalOcean infrastructure and may process information in the United States and other countries where our service providers operate. Where law requires it, we use appropriate safeguards for transfers of personal information. Contact us if you need more information about the safeguards that apply to your organization.

We post changes on this page and update the “Last updated” date above. For material changes, we email account holders before the changes take effect. If you do not have an account, the updated page is the notice.

Community Hub Inc
Oberlin, OH 44074, United States

Privacy and data requests: privacy@communityhub.cloud
General support: info@communityhub.cloud

We respond to privacy requests within 30 days. Include the organization and site name if your request concerns a Community Hub dashboard.