Privacy Policy
Effective date: 19.10.2026
This Privacy Policy explains what personal data the operator of PWA Hub, an individual entrepreneur registered in Ukraine (the "Provider", "we", "us"), collects when you use the PWA Hub websites and services, why we collect it, and what rights you have. We are the data controller for the processing described here.
1. What this policy covers
This policy covers the website pwahub.org and its subdomains, including the customer portal and the documentation, our license and update servers, the demo installation, and the email we exchange with you.
It does not cover your own installation of the PWA Hub software. The software runs on your server. The PWAs, landing pages, push subscribers, visitors and statistics in your installation are your data: you are their controller, they are not sent to us, and we do not host or back them up. If you are a visitor of an application built with PWA Hub, please contact the operator of that application.
2. Data we collect
2.1. Account data
When you register we collect your name, email address, a password (stored only as a hash) and the time of registration. During email verification we store a short-lived verification code.
2.2. Orders and payments
When you buy a plan we store the plan, billing period, amount, currency, order status, the time of the order and the identifier of the payment at our payment provider. Payments are processed by CoinGate (UAB CoinGate, Lithuania). CoinGate receives the payment details and may ask you for identification under its own rules; it is an independent controller of that data. We do not receive or store your wallet addresses or identity documents.
2.3. License data
To issue and verify licenses we store the license key, plan, limits and expiry date, and for each installation: its domain, server IP address, technical identifiers of the installation and the usage counters it sends. We also keep a log of license checks with the time, result, domain and IP address.
2.4. Software downloads
When the software or its updates are delivered we record the license, the component and version, the IP address and the time.
2.5. Support and correspondence
When you write to us we keep the correspondence, including your email address and anything you include in it.
2.6. Website analytics
Our websites use a self-hosted analytics tool running on our own server. It does not use cookies, does not store full IP addresses, does not build profiles across other websites and does not share data with any third party. It records page views, the referrer, browser and device type, country derived from the IP address, and events such as viewing the pricing section or clicking a plan.
2.7. Technical logs
Our servers and our content delivery provider keep standard access logs (IP address, time, requested URL, user agent, response code) for security, abuse prevention and troubleshooting.
2.8. Cookies
The customer portal uses strictly necessary cookies to keep you signed in. We do not use advertising or tracking cookies and we do not show a cookie banner because none is required for strictly necessary cookies.
3. Why we process your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and operating your account, issuing and verifying licenses, delivering software and updates | Account, license, download data | Performance of the contract (Terms of Service) |
| Processing orders, invoices and tax records | Order data | Performance of the contract; legal obligation (accounting and tax law) |
| Sending transactional email: verification codes, password resets, license expiry reminders, order confirmations | Email address | Performance of the contract |
| Protecting accounts and infrastructure, preventing abuse, fraud and misuse of licenses | License logs, download records, technical logs | Legitimate interest in security and in enforcing the license |
| Providing support | Correspondence | Performance of the contract; legitimate interest |
| Understanding how our websites are used | Analytics data | Legitimate interest in improving the websites (no cookies, no profiling) |
| Complying with legal requests | Any of the above | Legal obligation |
We do not send marketing email. We do not sell personal data and we do not use it for automated decisions with legal effect on you.
4. Who receives your data
We use the following categories of service providers (processors) that process data on our behalf:
- a hosting provider in the European Union, where our servers are located;
- a DNS, content delivery and attack protection provider (United States, with EU data centers);
- a transactional email delivery service (United States);
- an email provider for our mailboxes (Switzerland).
Payments are processed by CoinGate (Lithuania) as an independent controller. We will name a specific provider on request.
We may disclose data when required by law, to protect our rights, or in connection with a transfer of our business, in which case the recipient will be bound by this policy.
5. International transfers
Our servers are located in the European Union. Some providers listed above process data in the United States. Where data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision, and on the providers' additional safeguards. Our own records are kept by an individual entrepreneur registered in Ukraine; Ukraine has data protection legislation and we apply the standards of this policy to all processing.
6. How long we keep data
- Account data: for as long as the account exists, then up to 30 days to complete deletion, unless a legal obligation requires longer.
- Order and payment records: for the period required by accounting and tax law (three years from the end of the year of the transaction, or longer if the law requires).
- License data: for the life of the license and up to 24 months after its expiry or termination, to detect abuse and resolve disputes.
- License check logs and download records: up to 24 months.
- Verification codes and password-reset tokens: minutes to hours.
- Technical logs: up to 30 days.
- Analytics data: aggregated, without identifiers, kept indefinitely.
- Backups: up to 30 days, after which deleted data disappears from backups as well.
7. Security
We protect data with encryption in transit and at rest, access controls, separation of our infrastructure from customer installations, and regular updates. No system is perfectly secure; if we learn of a breach that affects you we will inform you as required by law.
8. Your rights
Under the General Data Protection Regulation and similar laws you may ask us to: access the personal data we hold about you; correct it; delete it; restrict its processing; provide it in a portable format; and object to processing based on our legitimate interests. You may also withdraw consent where processing is based on consent.
To exercise these rights write to [email protected]. We will answer within one month. We may ask you to confirm your identity. If you believe we process your data unlawfully you may complain to the data protection authority in your country of residence in the European Union.
9. Children
Our services are intended for businesses and are not directed at persons under 18. We do not knowingly collect data from children.
10. Changes to this policy
We may update this policy. The current version is always available at pwahub.org. For material changes we will notify registered customers by email. The effective date at the top shows when the policy was last changed.
11. Contact
PWA Hub
Email: [email protected]