Privacy information · public notice
How personal information is handled
Version 1.6 · Updated 13 October 2026
This notice describes the CentralHub public website, private administration service, and optional connected-service features. It explains what Google user data CentralHub accesses, why it is used, how it is protected, when it may be shared, how long it may be retained, and how users can revoke access or request deletion.
Who operates the service and how to contact us
CentralHub is operated by INDIVORA LTD (company number 17459277), registered office: Weald Bridge Nursery, Kents Lane, Epping, England, CM16 6AX. Privacy and deletion requests may be sent to support@centralhub.network or by post to the registered office marked “CentralHub privacy request”. This notice concerns the CentralHub website and the existing private administrative platform. The separate CentralHub Shop showcase has its own privacy notice.
Our role and the information we handle
For our own website, account administration and correspondence, INDIVORA LTD determines the purposes of that processing. The role for information held on behalf of each business depends on who determines the purposes and means; the business may be the controller and INDIVORA LTD a processor. Depending on use, the platform may hold authorised staff and business contact details, login and security records, customer and supplier details, sales and orders, invoices, inventory, banking and reconciliation records, staff operational records and support communications. Business records may include information about identifiable people.
Purposes and legal grounds
We use information to provide and secure the requested software, administer authorised users, maintain operational records, handle support requests and investigate errors or misuse. Depending on the particular activity, the applicable UK GDPR basis may be performing a contract, a legal obligation or a legitimate interest in running and protecting the service. Where we process information solely on a business customer’s documented instructions, that customer determines the relevant purpose and legal basis.
Demo enquiry information
When you request a CentralHub demonstration, we collect the name, business name, email, optional phone, all selected business activities, number of legal companies to manage, the number of companies without websites where the free website offer applies, any optional business-specific information, the names and purposes of software you currently use (if you provide them), and the features you would like help with. You may also tell us you do not yet use any software or prefer to discuss this during a demo. We use this information to review your enquiry, determine initial eligibility for any relevant free business website offer, and contact you about a demonstration or that offer, not to create a paid account or send unrelated marketing. Requests are recorded in a restricted CentralHub Control Centre database for manual handling. You can ask us to correct or delete your enquiry using the contact details in this notice, subject to applicable legal or security retention needs.
Information received from other sources
A business administrator may import authorised staff, customer, supplier or transaction details. Connected stores, couriers, messaging, email, analytics or banking services may send records through their configured integration. For individual data held on behalf of a business customer, ask that business how it originally collected the information. We do not represent a planned government connection as an active source of taxpayer records.
Google user data CentralHub accesses
Google connections are optional and begin only after an authorised user chooses to connect a Google service and completes Google’s OAuth consent flow. For Google Tasks, CentralHub may access task-list information and task records such as titles, notes, status and due dates, and may create or update tasks when the authorised user enables task synchronisation. For Gmail, CentralHub may use read-only access to message metadata and relevant message content, including attachments where a user-enabled workflow requires them, for authorised business workflows such as finance, support or record intelligence. For Google Analytics, CentralHub may use read-only access to authorised account, property and reporting information, including metrics and dimensions needed to show business and marketing insights. CentralHub requests only the scopes needed for the connected feature the user enables.
How CentralHub uses Google user data
Google user data is used only to provide, operate, secure, troubleshoot or improve the specific user-facing CentralHub functionality requested by the authorised user. Task data may be used to synchronise an authorised task queue and update task status. Gmail data may be used to surface relevant authorised business information inside CentralHub workflows. Google Analytics data may be used to display authorised performance and marketing reports. Google user data is not used for targeted advertising, personalised advertising, retargeting, determining credit-worthiness, lending, sale to data brokers, information resale, or unrelated profiling.
Google user data sharing and disclosure
CentralHub does not sell Google user data, share it with advertisers, or transfer it for advertising, credit, lending, data-broker, information-reseller or unrelated commercial purposes. Google user data may be disclosed only to service providers acting on our behalf where necessary to host, secure or operate the requested CentralHub feature, to authorised users within the organisation controlling the relevant CentralHub workspace where the feature is intended to share that business information, or where disclosure is required by law. We do not transfer Google user data to third parties for purposes unrelated to providing or improving CentralHub’s user-facing functionality.
Google user data storage, retention, deletion and revocation
OAuth client secrets and refresh credentials are handled and stored server-side in protected application infrastructure and are not exposed in the public browser interface. Where a connected feature saves Google-derived records, those records may be stored in the protected CentralHub business-data environment only to provide the requested feature and related security, audit or support functions. OAuth credentials are retained only while needed to maintain the authorised connection and may be invalidated by revocation, disconnection or account closure. Google-derived business records are retained only as long as needed for the requested service or where retention is required or permitted for security, dispute, accounting, tax or other legal obligations. When data is no longer required under those criteria, it is deleted or removed in accordance with the applicable operational and backup lifecycle. Users may request deletion by emailing support@centralhub.network. A Google account owner can revoke CentralHub access at any time from the security or third-party access settings in their Google Account; revocation prevents further Google API access but does not automatically erase records that CentralHub is legally required or otherwise permitted to retain.
Security safeguards for Google user data
CentralHub applies technical and organisational safeguards designed to protect Google user data. Google OAuth credentials are handled server-side rather than exposed to the public browser. Data transmitted between users, CentralHub and connected services is protected using HTTPS/TLS. Access to protected application data is restricted through authenticated sessions, application permissions and role-based access controls. Production infrastructure and database services provide additional platform security controls, and access is limited to authorised users and services required to operate the requested feature. No online service can guarantee absolute security, so these controls are reviewed and updated as the platform develops.
Google Workspace API data and AI/ML
CentralHub does not use information obtained through Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Google Workspace API data is not used to train foundation models or shared models for other customers. Where an authorised CentralHub feature uses AI-assisted processing to provide a requested user-facing function, Google user data is processed only for that requested function and is not used to train the underlying generalized model.
Google API Services User Data Policy
Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to build advertising profiles, sell personal information, provide data to third parties for advertising purposes, or create standalone datasets for unrelated purposes.
Recipients, hosting and transfers
The application uses hosting and database infrastructure including Hetzner-hosted application services managed through Coolify and Supabase database and authentication services, and may exchange relevant records with existing connected business services selected by the authorised organisation. Access and disclosure depend on the feature and configured account. Provider processing and support locations can differ from the database region. We do not promise that all data remains in the UK; any relevant international transfers and safeguards must be documented for each service before wider commercial onboarding.
Current processing locations and limits of verification
At the most recently checked project configuration, the private CentralHub Supabase database is in AWS eu-west-2 (London). Application hosting, delivery, provider support and backup infrastructure may involve other locations. A database location alone does not establish that all providers or support staff process data in the UK. Exact provider contracts, backup/support access locations and any applicable international transfer safeguards need validation before wider paid customer onboarding. Do not interpret this notice as a UK-only processing guarantee.
Retention, security and account closure
We retain business records for as long as needed to operate the service, support authorised users, handle disputes and meet applicable accounting, tax or other record-keeping obligations. Log and backup lifecycles may differ. We do not promise instant removal of records subject to a lawful retention obligation. Account closure or disconnection stops future access where applicable, while records that must be retained remain protected until their applicable retention period ends.
Your rights
Depending on the processing and applicable exemptions, you may request access, correction, erasure, restriction, portability or object to processing. Where consent applies you may withdraw it. Contact support@centralhub.network or write to the registered office above. If a business customer controls the record, we may need to direct the request to that business or help it respond. You may complain to the UK Information Commissioner’s Office at ico.org.uk. We do not use the public website to make solely automated decisions about people with legal or similarly significant effects.
Cookies and browser information
Essential sign-in/session mechanisms and security-related technical information may be used to operate the website and protected application. Optional analytics, cookies and marketing technologies require a feature-by-feature audit and any applicable consent controls. An account or support request does not automatically opt a user into optional marketing.
Future tax and government connections — not active filing services
We plan separate VAT Making Tax Digital, Corporation Tax, PAYE/payroll, Business Rates, Customs Duty/import VAT and Companies House integrations. If activated, a customer may choose to supply relevant tax identifiers, authorised account references, financial transactions, payroll, property or customs records, and consent to service-specific account authorisation where applicable. A privacy-notice update and appropriate security, processor/recipient, location, retention and user-authorisation reviews must happen before any new processing starts. Accepting this notice is not permission to connect an HMRC or council account, file returns or make payments. The current sandbox application diagnostic is not production VAT filing.
Commercial customers should also review the proposed data-processing terms and outstanding approval conditions. This public notice does not by itself create a processor contract.
See ICO guidance on your information rights, our website terms and tax integration roadmap.
Return to homepage