Pulse Marketplace Privacy Policy

1. General provisions

1.1.This Privacy and Personal Data Processing Policy (the “Policy”) establishes the purposes, categories, processing procedures and safeguards for personal data processed by the Pulse Marketplace application at https://marketplace.hubba-cloud.ru/ (the “Website” or “Service”).

1.2.The personal data controller is Daniil Olegovich Khabibulin, a self-employed individual paying Russian professional income tax (the “Controller”). The Controller’s details are set out in this document.

1.3.This Policy is prepared with reference to Russian Federal Law No. 152-FZ of 27 July 2006 on Personal Data and other applicable Russian legislation. It is a public document available on the Website.

1.4.The Policy covers catalog visitors, registered users, module authors and persons contacting the Controller. Marketplace is not a hosted server-monitoring service and does not receive user server metrics, processes, network connections or logs from Monitor or agents.

1.5.This Policy informs Users about data processing and does not itself constitute consent. Visiting the Website does not constitute consent to advertising or purposes unrelated to the requested Service functionality.

2. Definitions

2.1.“User” means an individual visiting the Website, using available Service functions or contacting the Controller.

2.2.“Personal data” means information relating directly or indirectly to an identified or identifiable individual.

2.3.“Processing” means operations on personal data, including collection, recording, organization, storage, correction, use, disclosure, restriction, deletion and destruction.

2.4.“External provider” means a separate service involved in delivering a function chosen by the User, including GitHub, Google, website hosting and email providers.

3. Data subjects and categories of personal data

3.1.Registered account data comprises the internal account identifier, display name, role and creation date. Email sign-in additionally processes the email address, verification status and a strong individually salted password hash. Plaintext passwords are not stored. Email registration and recovery are disabled on the current public installation.

3.2.GitHub sign-in processes the GitHub user identifier, display name and account association. Google data and its processing are described in dedicated sections of this Policy. External provider passwords are not disclosed to the Controller.

3.3.Module author data includes public GitHub owner/repository details, releases, source links, manifests, platforms and distributed packages. Validation results, moderation decisions, comments and decision-maker identifiers are retained.

3.4.Operating and protecting the Service involves session records, temporary OAuth parameters, attempt counters and technical request information. IP addresses may be processed by network infrastructure and appear in system logs. The Marketplace virtual host HTTP access log is disabled.

3.5.Support correspondence comprises the sender’s email address, message, information necessary for handling it and voluntary attachments. Users must not submit active passwords, keys, tokens or excessive third-party personal data.

4. Purposes of processing

4.1.Personal data is processed to provide requested Website functionality, maintain operation, protect against unauthorized access and handle User requests.

4.2.Processing also supports account identification, role-based workspace access, repository authorship and package validation, catalog management, moderation, complaints and appeals.

4.3.Data may be processed to meet applicable legal obligations and protect Controller/User rights where permitted by law. Processing is limited to information necessary for a specified purpose.

5. Legal grounds

5.1.The Controller processes data where a ground under applicable data protection law exists, including necessity to perform an agreement with the User or deliver a requested function, meet legal obligations or act on validly obtained consent.

5.2.Where a specific processing activity requires consent, that consent must be obtained separately from this Policy and other documents being confirmed. Reading the Policy does not replace consent where consent is required.

5.3.Withdrawal ends processing based solely on that consent. Processing may continue where a separate lawful ground exists. If the data is necessary for a requested function, that function may cease; withdrawal does not automatically prohibit use of every part of the Service.

6. Access to Google user data

6.1.Pulse Marketplace uses Google OpenID Connect only to sign in and explicitly link an identity. The requested scopes are openid and profile. The Google user data used and stored by the application consists of the unique Google identifier (sub) and display name (name, if supplied by Google), received from the verified ID token.

6.2.The profile scope may return other basic profile information, such as a photo URL. The current implementation does not store or use the photo, date of birth or gender. The email scope is not requested and a Google email address is not required for sign-in. The application cannot access Gmail, Google Drive, contacts, calendars, your Google password or private GitHub repositories.

6.3.During sign-in, the server validates the ID token and protocol security parameters. Google access tokens, refresh tokens and ID tokens are not persisted in the account database. The Google identifier and display name are stored in the Pulse Marketplace database.

7. Use of Google data

7.1.The Google identifier associates repeat sign-ins with the same Pulse Marketplace account. The name identifies the account in the interface. Linking an existing account requires a separate user action; matching emails do not automatically merge accounts.

7.2.These data support workspace access, authorized account actions and sign-in support. Google sign-in alone does not establish ownership of a GitHub repository: module authorship is checked separately through GitHub.

7.3.Google data is not used for advertising, resale, creditworthiness assessment, advertising profiles or training artificial intelligence models. The application does not use Google Workspace APIs. New permissions or processing purposes require the necessary notice and user authorization.

7.4.Pulse Marketplace’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Disclosure of Google data

8.1.The Google identifier and identity link are not published in the catalog, embedded in installation JSON packages or shared with module authors, Monitor or agents. An account display name is not used as the public GitHub module owner name.

8.2.Human access to Google user data is limited to the user’s prior affirmative agreement to view specific data, security needs or compliance with applicable law. A support request does not authorize unrestricted access to data. Server infrastructure stores the database and backups to operate and recover Marketplace. No other recipients receive Google data for advertising, analytics or sale.

8.3.Google processes sign-in under its own privacy policy. Information may be disclosed to the extent required by applicable law or necessary to address abuse; this is not authorization for arbitrary disclosure. External providers may process data outside your country.

9. Processing procedures and methods

9.1.Processing uses automated and non-automated means through Website software, handling correspondence and, for Marketplace, publication moderation.

9.2.The Controller limits processing to specified purposes, takes steps to correct inaccurate data and restricts access to what is needed for the relevant task.

9.3.Special-category and biometric personal data are not requested for Service operation. Users should not include such information in public packages or correspondence unless necessary to address a specific request.

10. Cookies and browser storage

10.1.Your chosen theme is stored in pulse-market.theme.v1. Sign-in uses the secure HttpOnly __Host-pulse-session cookie for up to 7 days; signing out revokes the current session. The pulse-oauth-github and pulse-oauth-google cookies bind the start and completion of sign-in and last up to 10 minutes. These cookies are not necessarily all present at once.

11. Retention, cessation and deletion

11.1.Google user identifiers and display names are stored in the Pulse Marketplace PostgreSQL database for as long as they are needed to maintain the account and Google sign-in, unless deletion is requested or another lawful retention ground applies. Deletion requests follow the procedure in the Google account deletion section below. Other profile data is retained to operate accounts. Sessions expire after 7 days and OAuth state after 10 minutes; a background process removes expired authentication records. Publication and moderation history is retained for catalog integrity and dispute handling.

11.2.The database and packages are backed up daily. Retention is currently managed manually by the operator; automatic backup expiry has not been configured. Deleting a primary database record does not itself erase existing backups. The operator must separately account for backups and recovery when handling deletion requests.

12. External services and data disclosure

12.1.The catalog exposes module ownership, release details, source links, permissions and approved packages. Account email, password hashes, sessions and Google identity links are not published. Do not include secrets or other people’s personal data in distributed packages.

12.2.GitHub and, when enabled, Google process authentication under their own policies. Public repository data is retrieved from GitHub. The server and its hosting provider deliver requests; technical IP addresses may appear in system logs. The Marketplace virtual host HTTP access log is disabled. External providers may process data outside your country.

13. Personal data safeguards

13.1.Google user identifiers and display names receive the same safeguards as other account data. The public Marketplace uses HTTPS. PostgreSQL and the internal API bind only to the server loopback interface and are not exposed as public services. Workspace actions require server-side session and role checks; state-changing requests check Origin and CSRF tokens.

13.2.The session cookie uses Secure, HttpOnly and SameSite=Lax. Session tokens are hashed in the database; email passwords use a strong individually salted hash. Google sign-in uses PKCE, state and nonce. File permissions restrict server credentials and backups. These are the implemented safeguards, not a guarantee that every risk is eliminated.

13.3.Report suspected disclosure or unauthorized account access to heyhubbabubbapr@gmail.com. Do not attach active passwords, tokens or private keys.

14. User rights and requests

14.1.Users may request information about processing of their personal data, require correction, restriction or destruction where provided by law, withdraw previously given consent and challenge the Controller’s actions before the competent authority or a court.

14.2.Requests may be sent to heyhubbabubbapr@gmail.com or support@hubba-cloud.ru. Identify the requester and relevant data, specify the request and provide a reply address. The Controller may require proportionate verification that the data belongs to the requester.

14.3.The Controller handles requests manually subject to applicable requirements and statutory time limits. Ordinary technical support has no fixed SLA or 24/7 availability; this does not alter mandatory data subject request deadlines.

14.4.Account deletion, removal of a Google identity and retention of licensed published releases are assessed separately. Users may request deletion of unnecessary profile data; publication alone does not justify indefinite retention of every account detail.

15. Deletion of a Google identity and account

15.1.To delete a Google identity link, account or associated data, email heyhubbabubbapr@gmail.com with the subject “Pulse Marketplace — data deletion”. Include the display name and sign-in method; the operator verifies account ownership in a safe and proportionate way. There is currently no self-service deletion button.

15.2.After verifying the request, the operator disables the identity being removed, revokes affected sessions and deletes or anonymizes information no longer required to provide the service or meet mandatory retention obligations. Removing the only sign-in method loses account access; arrange an alternative sign-in method beforehand if needed.

15.3.Deleting a Google identity link does not revoke licenses already granted for published modules. Necessary decision history may be retained for security and disputes with personal data minimized. Backups are considered separately during deletion and recovery; automatic backup rotation is not yet configured.

15.4.You can also remove Pulse Marketplace access in your Google Account connections settings. Doing so does not erase the record already stored in Marketplace: contact the operator to request its deletion.

16. Controller obligations

16.1.The Controller must use personal data within the stated purposes and lawful grounds, maintain confidentiality and implement necessary organizational and technical safeguards.

16.2.The Controller handles data subject requests, corrects inaccurate information, addresses unlawful processing and deletes or destroys information where a legal ground requires it.

16.3.Disclosure to third parties requires an appropriate lawful ground. An external provider’s participation in sign-in or hosting does not authorize sale of data or advertising use.

17. Analytics and advertising technologies

17.1.As of this revision, Google Analytics, Yandex Metrica, advertising pixels and marketing mailings are not used. Personal data is not sold or used for advertising profiles. Changes require advance User notice and an appropriate lawful ground.

18. Amendments and final provisions

18.1.The current Policy is published at the Website’s permanent privacy policy URL. Its revision date appears at the beginning. The Controller updates the Policy when actual processing practices change.

18.2.Replacing this text or continuing to use the Website does not replace separate consent to new processing where consent is required. Existing open-source licenses and mandatory User rights remain unaffected.

18.3.Matters not addressed in this Policy are governed by applicable law. Ordinary Service requests may be sent to support@hubba-cloud.ru; personal data and security requests to heyhubbabubbapr@gmail.com.