Last updated: 13 September 2026

1. Introduction

Hub is a Chrome extension for Current RMS that enhances your workflow by injecting custom modules such as Shortages Hub, Supplier Hub, Message Hub and other workflow tools. Hub also offers paid Pro features via Lemon Squeezy.

This policy explains what information we collect, how we use it, when it is shared with third-party services, and your rights in relation to that data.

Main Hub build and Cloud beta: Heartbeats, module-usage reporting, Cloud login and device pairing have been removed from the main Hub extension build prepared on 13 September 2026. That build does not send Hub Cloud installation or module-usage reports. Separate Cloud-enabled beta builds and older installed builds may still report as described below until they are updated, disabled or uninstalled. Pro licence checks and other enabled integrations are separate from Hub Cloud.

2. Data We Collect & Store

We collect and store the following information only where needed to operate Hub features.

Current RMS Subdomain & API Key

Purpose: Authenticate API requests to Current RMS for Hub features such as shortages, availability, suppliers, Message Hub and related tools.

Storage: Chrome Sync Storage (chrome.storage.sync).

Feature Toggles

Purpose: Remember which Hub modules and settings you have enabled or disabled across browser restarts.

Storage: Chrome Sync Storage (chrome.storage.sync).

Lemon Squeezy License Key & Pro Status

Purpose: Validate paid subscriptions and unlock Pro-only modules.

Storage: Chrome Local Storage (chrome.storage.local).

Device Identifier (Activation ID)

Purpose: Identify this Hub installation when creating or validating Pro licence activations with Lemon Squeezy.

Storage: Chrome Local Storage (chrome.storage.local).

Notes: The main extension stores a random short device identifier, such as 724A, and an activation label containing the configured Current RMS subdomain, browser/platform, extension ID and version. Cloud-enabled builds additionally use a full random installation identifier (UUID). These identifiers can distinguish installations; they do not identify a verified person or unique physical machine.

Installation Heartbeats (Cloud-Enabled Beta and Older Builds Only)

The main build described above has no installation heartbeat. Cloud-enabled builds send an initial installation status report and report version changes. Earlier reporting builds use an approximately hourly interval; the revised reporting implementation uses approximately 24 hours after the last successful report and does not send an extra report on restart unless one is due. If Chrome is closed, asleep or offline, reporting resumes when available. Reporting in these builds works without a Hub Cloud account or sign-in.

Reports contain the configured Current RMS domain, a random installation identifier and short display ID, Hub version, Pro/non-Pro status, a UTC date and time, and a sequence number. Hub Cloud also records when the report arrives. Locally stored registration credentials authenticate these reports; they are separate from your Current RMS API key.

Purpose: Monitor installed versions, last contact and Pro coverage, support installations and diagnose rollout issues. Authorised Hub administrators can group installations by domain and see installation counts. An installation normally represents a Chrome profile, not a verified person or a unique physical machine. These records are identifiable installation records, not anonymous statistics.

Heartbeats do not contain your name, email address, Current RMS API key, licence key, Google tokens, payment details, page contents, Current RMS records or general browsing history.

Overall Module Usage Counts (Cloud-Enabled Builds Only; Optional)

Cloud-enabled builds count openings of Check-In Hub, Transport Hub, Transfer Hub and Shortages Overview locally by module and UTC calendar day, then periodically send batches of daily totals to Hub Cloud. The main build described above does not collect or send these module-opening totals. This helps us understand which features are used and where to focus improvements.

Each batch contains a day, module counts and a fresh random batch identifier used to prevent duplicate counting. The report does not include a domain, installation ID, Hub version, Pro status, user identity or exact opening times. The server stores shared daily totals, without a module-usage history for a particular installation or domain.

Control: In Cloud-enabled builds with aggregate reporting, module-count sharing is enabled by default. You can turn off “Share overall module usage counts” in Hub Settings, under Setup & Account. This setting saves immediately for that installation, stops future module-count reporting and clears unsent counts. It cannot recall reports already received or remove a contribution from combined totals. Turning it back on starts fresh counting.

Turning off module counts does not stop installation heartbeats. In those Cloud-enabled builds there is no separate heartbeat switch. These reporting controls are absent from the main build because reporting has been removed. Disabling or uninstalling Hub stops future reporting by that installation; it does not automatically delete records already held on our servers. Contact us about those records or to object to processing.

Google Account & Calendar Connection (Optional)

What:

• Google account email address used to connect Google Calendar

• Google OAuth access token and refresh token issued by Google

Purpose: Enable optional Google Calendar integration, allowing Hub to create, update, search and delete calendar events that mirror Current RMS opportunities and activities.

Storage:

• OAuth tokens: Chrome Local Storage (chrome.storage.local)

• Connected Google account email: Chrome Local Storage (chrome.storage.local)

Notes:

• Hub only accesses Google Calendar data when you explicitly connect Google Calendar and enable sync.

• Hub does not read unrelated calendar data or contacts.

• You can disconnect Google Calendar at any time, which removes stored tokens.

Xero Connection (Optional)

When you enable Xero Credit Hub and connect your Xero organisation, Hub uses OAuth tokens and organisation identifiers to retrieve matched customer contact details, outstanding invoices, balances and credit-limit information for the credit-control features you use. Relevant contact IDs or invoice numbers are sent to Xero to request these records.

Access and refresh tokens and connection details are stored in Chrome Local Storage. Xero configuration, including the selected organisation, is stored in Chrome Sync Storage. This optional connection is separate from Hub Cloud.

Product Volume Cache

What:

• productVolumeMap, a JSON mapping of product IDs to volume in cubic metres

• volumeLastRefresh, a timestamp of the last fetch

Purpose: Speed up Total Volume calculations by avoiding repeated full product catalogue fetches.

Storage: Local storage on the Current RMS domain.

Per-Session Volume Totals

What: volume_total_<opportunityId>, the last computed total volume.

Purpose: Immediately display the last total-volume calculation on popup reload.

Storage: Session storage on the Current RMS domain, cleared when the tab closes.

Message Hub Throttling

What:

• lastOpportunityId, the ID of the last opportunity shown

• lastPopupTime, the timestamp of the last popup

Purpose: Limit Message Hub auto-popups to once per hour per opportunity.

Storage: Local storage on the Current RMS domain.

3. How We Use Your Data

We use your data:

• To authenticate and fetch data from Current RMS.

• To validate your Lemon Squeezy license and unlock Pro features.

• To remember which modules and settings you have enabled.

• To improve performance with caching and session-specific calculations.

• To throttle in-app reminders so they are not disruptive.

• To provide optional Google Calendar, Xero, OpenAI, Google Maps, Google Places and Team Hub automation features where enabled or used.

• For Cloud-enabled builds only: to monitor installation status and version rollout, support customers, diagnose issues and use overall module counts to improve Hub features.

Where UK GDPR applies, our likely lawful bases include performance of contract for core extension and licensing functionality, legitimate interests for support, security, diagnostics and version monitoring, and user action/permission for optional integrations such as Google Calendar.

4. Data Sharing & Third-Party Services

We do not sell your data.

Amazon Web Services (AWS), for Cloud-enabled builds and previously received Cloud records: installation heartbeats and overall module totals are processed and stored using AWS services in the London region (eu-west-2). Access to installation records and reporting dashboards is restricted to authorised Hub administrators. Network infrastructure necessarily processes connection information, such as IP addresses, to deliver and protect requests; the absence of identifiers in module-count payloads does not mean the entire network request is anonymous.

We share data with third-party services only where needed to provide Hub features:

• Current RMS: Hub uses your API key to connect to your own Current RMS account and read or update the records needed for the features you enable. Your API key is not included in Hub Cloud heartbeat or module-usage reports.

• Lemon Squeezy API: to validate paid subscriptions. Activation requests include the licence key and device activation label described above so Lemon Squeezy can manage licence activations.

• Google Calendar API: used only when you explicitly enable Google Calendar Sync, to create, update, search and delete calendar events related to Current RMS opportunities and activities.

• Xero API: used when you enable and connect Xero Credit Hub to retrieve the customer and accounting information described above from your selected Xero organisation.

• OpenAI API: used only when you enable or use optional Hubi AI features.

• Google Maps / Google Places API: used only when postcode, address, venue or place lookup features are enabled or used.

• Third-party automation providers: process data needed for Team Hub workflows where configured.

Lemon Squeezy handles payment processing and stores credit-card data on their servers. For details, see their Privacy Policy.

5. Data Retention

Most Hub data is stored locally in Chrome extension storage or in the Current RMS browser session.

Hub Cloud Reporting Retention (Beta and Previously Received Records)

Removing Cloud features from the main extension does not delete previously received Cloud records. The following periods apply to those records and reporting from Cloud-enabled builds.

Installation profiles: We keep the latest installation status and last-contact information, rather than a history of every heartbeat. These profiles currently have no automatic expiry and remain until deleted. You can contact us to request deletion or object to their processing.

Version-change records: Scheduled to expire after 90 days. Overall module totals: The dashboard shows up to 90 UTC calendar days; daily aggregate records are scheduled to expire 91 days after their reporting date. Duplicate-prevention receipts are scheduled to expire after 32 days. Unsent module counts are kept locally for up to 30 days, and are cleared when sharing is turned off.

Hub Cloud reporting application logs are retained for 14 days. Expiry is followed by asynchronous deletion, so physical removal may occur later. Backup copies can remain until their normal backup retention ends. These periods apply to Hub Cloud reporting; other services have their own retention arrangements.

Clearing local data or uninstalling Hub does not erase previously transmitted server records. Contact us using the details below for assistance.

Installation reports are stored in Hub Cloud, hosted on AWS in London. For questions or deletion requests, email talk@hubapp.uk.

You can clear local Hub data at any time by:

• Using Chrome's Clear site data controls for Current RMS page local storage and session storage.

• Uninstalling the extension, which removes stored extension data.

6. Security

• Hub stores extension credentials in Chrome extension storage. Protect access to your device and browser profile.

• Cloud-enabled build heartbeats and module-count reports do not include your Current RMS API key, Lemon Squeezy licence key or Google OAuth tokens. The main build described above sends neither type of report.

• Hub Cloud reporting uses HTTPS in transit, encrypted database storage and restricted administrator access. Reporting fields are limited as described above.

• Webhook URLs and third-party service credentials are treated as confidential operational data.

7. Your Rights

You have control over locally stored Hub extension data and can view, modify or delete it using Chrome's extension storage controls.

Where Hub or its processors hold personal data about your installation, including licensing records, heartbeats or upgrade telemetry, you may contact us to request access, correction, deletion, restriction or portability where applicable. Please provide enough information to locate the relevant installation; do not send API keys or passwords.

Right to object: Where processing relies on legitimate interests, you can object by contacting us. If you use a Cloud-enabled build with module-count sharing, you can turn it off as described above. Where processing relies on consent, you can withdraw that consent without affecting processing already carried out. Your rights depend on the circumstances and applicable law.

You can raise a complaint with the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

8. Changes to This Policy

We may update this policy to reflect new features, legal requirements or changes to how Hub processes data.

We will post the revised date above and link from the extension UI where appropriate.

9. Contact Us

If you have any questions or need assistance, please reach out:

Email: talk@hubapp.uk