Privacy Policy

Overview

SMG HUB is a workspace management platform for time tracking, projects, helpdesk and invoicing, operated by Solo Media Group ("we", "us"). This policy explains what information we collect when you use the SMG HUB web application, its client portal and its browser extension (together, the "Service"), how we use it, and the choices you have.

Information we collect

• Account information: your name, email address, profile photo, password (stored only as a one-way hash) and two-factor authentication settings.
• Information from Google Sign-In: if you choose to sign in with Google, Google shares your name, email address, whether that email is verified, your profile picture and your Google account identifier. See "Google user data" below.
• Workspace content: the information you and your workspace enter into the Service, such as time entries, projects, tasks, tickets, comments, attachments, companies, contacts, orders, estimates and invoices.
• Browser extension: when you start a timer from the extension, it reads the address of your active browser tab so it can link the time entry to the task you are working on. The extension does not record your browsing history.
• Payment information: payments are processed by Stripe, which collects your card details directly. We receive confirmation of the payment; we never receive or store your card number.
• Technical information: IP address, browser and device type, and error reports, which we use to keep the Service secure and working.

How we use information

• To provide, operate and maintain the Service and your workspace.
• To create your account, authenticate you and keep your account secure.
• To send service emails such as invitations, password resets, notifications, estimates and invoices.
• To process payments and manage subscriptions.
• To respond to support requests and to diagnose and fix problems.
• To comply with legal obligations and enforce our Terms and Conditions.

We do not sell your personal information and we do not use it for advertising.

Google user data

When you sign in with Google, SMG HUB requests only the openid, email and profile scopes. We use the name, email address, profile picture and account identifier Google returns solely to create your account, sign you in and show your name and photo inside the Service. We do not receive your Google password, we do not store Google access or refresh tokens, and we do not access your Gmail, Drive, Calendar, Contacts or any other Google data.

We do not sell Google user data, share it with third parties except the service providers that host the Service, use it for advertising, or use it to train artificial intelligence or machine learning models. SMG HUB's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can unlink Google from your profile's security settings at any time, and revoke SMG HUB's access from your Google Account permissions.

How we share information

• Within your workspace: workspace members see content according to the roles and access their workspace grants them, and client contacts see what the workspace shares with them through the client portal.
• Service providers: companies that host and operate the Service on our behalf, including Railway (hosting and databases), Stripe (payments), Resend (email delivery), Sentry (error monitoring) and our cloud file storage provider. They may use the information only to provide their services to us.
• Integrations you connect: when a workspace connects a service such as Asana or Stripe, we exchange the data that integration needs to work.
• Legal reasons: when required by law, or to protect the rights, safety and security of our users, the public or the Service.

Cookies and local storage

We use essential cookies to keep you signed in and to protect your session, and your browser's local storage to remember preferences such as your theme. We do not use advertising or third-party tracking cookies.

Data retention

We keep account information while your account is active and workspace content while the workspace exists. When a workspace is deleted, its content is removed after a grace period, except where we must keep records to meet legal or accounting obligations. Backups are overwritten on a rolling schedule.

Security

The Service is served over HTTPS. Passwords are stored as one-way hashes, credentials for connected integrations are encrypted at rest, and you can protect your account with two-factor authentication or a passkey. No system is perfectly secure, so please tell us right away if you believe your account has been compromised.

Your choices and rights

You can review and update your profile at any time. You can ask us to access, correct, export or delete your personal information by writing to [email protected]. If your account belongs to a workspace, some requests may need to be handled together with that workspace's administrator.

Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect information from children.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, notify account owners by email or in the Service.

Contact

Questions about this policy or your information can be sent to [email protected].