Privacy Policy

RequestHub, Inc. ("RequestHub," "we," "us," or "our") provides RequestHub request-management software and operates requesthub.io. Questions or privacy requests can be submitted through our contact form. Select the closest subject and state that your message is a privacy request.

This policy applies to our public website, account and sign-in experiences, customer support, billing administration, and the RequestHub service. It does not govern third-party sites or services that have their own privacy notices.

For website, account, sales, support, and billing information, RequestHub generally decides why and how the information is processed. For personal information placed in a customer workspace, the customer organization generally decides the purposes of processing and RequestHub processes the information to provide the service on that organization's instructions. Contact your organization first if your request concerns content it controls in RequestHub.

Depending on how RequestHub is configured and used, we may process:

• Account and profile information, such as name, work email address, organization, role, department, title, location, authentication method, and account identifiers.
• Customer workspace content, including requests, forms, comments, messages, approvals, assignments, routing information, assets, workflows, optional attachments, reports, and audit history.
• Integration data, such as identity, directory, group, mailbox, chat, or other business-system data that a customer administrator authorizes RequestHub to access.
• Billing information, such as a billing contact, Stripe customer and subscription identifiers, plan and subscription status, invoice metadata, payment status, and limited payment-method details made available by Stripe. RequestHub does not need to store full card numbers in its application database.
• Communications, including contact form submissions, support messages, email delivery status, and feedback.
• Technical and usage information, such as IP address, browser and device information, timestamps, request and error logs, security events, feature interactions, and cookie or similar identifiers.

We receive this information from you, your organization and its administrators, other workspace users, configured identity and integration providers, service providers, and automatically from browsers, devices, and service infrastructure.

We use personal information to:

• create accounts, authenticate users, and route them to the correct workspace;
• provide, operate, maintain, and support RequestHub and enabled integrations;
• process requests, approvals, routing, notifications, reporting, and audit history;
• provide AI-assisted classification, routing, search, drafting, and assistance;
• administer trials, subscriptions, invoices, payments, and billing communications;
• respond to sales, support, security, and privacy inquiries;
• secure the service, prevent abuse, diagnose faults, and maintain availability;
• understand and improve the website and service; and
• comply with law, enforce agreements, and protect rights and safety.

Where a law requires a legal basis, our bases may include performing a contract or taking requested pre-contract steps, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. A customer organization may rely on its own legal bases for workspace content it directs us to process.

If you sign in with Google, RequestHub requests OpenID Connect identity scopes for your email address and basic profile. We use provider claims such as your verified email address, name, profile information, and stable account identifier to verify identity, create or locate your account, associate you with an authorized customer workspace, and secure the sign-in flow. Google access and ID tokens used during sign-in are not used to read your Gmail, Drive, or Calendar content.

If you sign in with Microsoft, RequestHub similarly requests basic identity and profile access, including User.Read where applicable, to verify identity and obtain the account information needed for sign-in and workspace routing.

Separately, a customer administrator may enable Google Workspace or Microsoft 365 integrations using administrator-configured credentials. Depending on the enabled feature and permissions granted, these integrations may read business directory users, groups, organizational information, and mailbox data used for request intake or synchronization. RequestHub uses this data only to provide and secure the enabled features for that customer.

We store the account identifiers and synchronized business information reasonably needed to maintain the account or enabled integration. We do not sell Google or Microsoft user data or use it for advertising. We disclose it only to the customer that authorized the integration, service providers needed to operate the feature, or as otherwise described in this policy or required by law. Users and administrators can revoke provider access through Google or Microsoft account controls; the customer administrator can also disable the integration.

RequestHub can use configured AI service providers to process relevant customer content and context for classification, prioritization, routing, search, drafting, and conversational assistance. The information sent depends on the feature used and the customer's configuration. RequestHub itself does not use customer content to train or fine-tune its own models.

AI output can be incomplete or inaccurate. AI-assisted classifications and routing are intended to support service operations and can be reviewed or changed by authorized users. RequestHub is not designed to make solely automated decisions that produce legal or similarly significant effects about individuals.

We use Stripe to create billing customers, collect payment details through Stripe-hosted or Stripe-provided payment experiences, manage subscriptions, and receive payment and invoice events. Stripe processes payment credentials under its own privacy terms. RequestHub retains billing contact information and the account, subscription, invoice, and payment-status metadata needed to administer the subscription, reconcile events, provide billing support, and keep financial records.

We use contact and account information to send requested support responses, authentication and account messages, request notifications, service notices, and billing communications. Customer administrators may configure email delivery for their workspace. Contact form submissions are routed to RequestHub for follow-up. You can manage available notification settings in the service; essential account, security, billing, and transactional messages may still be sent when necessary.

RequestHub uses browser storage and similar technologies for functions such as theme preference, session continuity, and authentication. The central sign-in flow uses a short-lived, secure browser cookie to bind an OAuth request to the browser that started it. The public site loads Google Tag Manager, which can deliver measurement tags; those tags may collect device, interaction, and cookie or similar identifier data according to their configuration.

Browser and device settings can block or delete cookies and site storage, although blocking technologies required for authentication or security may prevent parts of RequestHub from working. Where a consent choice is presented, you can use that control to make or change the available choice. You can also use browser privacy controls and content blockers for non-essential measurement technologies.

We may disclose information to:

• the customer organization, its administrators, and authorized workspace users;
• infrastructure, database, storage, backup, monitoring, security, and support providers that help operate the service;
• Google, Microsoft, Stripe, email delivery, analytics, AI, and other integration providers when needed for a feature the user or customer enables;
• professional advisers, auditors, insurers, and transaction counterparties subject to appropriate confidentiality obligations; and
• authorities or other parties when reasonably necessary to comply with law, enforce agreements, respond to valid process, or protect rights, safety, and the service.

Service providers are authorized to process information for the services they provide to us, subject to their agreements and applicable law. If RequestHub is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may be reviewed or transferred as part of that transaction.

We retain information for as long as reasonably needed to provide the service, maintain the customer relationship, meet the purposes described here, and satisfy legal, accounting, security, backup, dispute, and enforcement needs. Retention varies by data type, customer configuration, deployment, and legal obligation. Authorized customer administrators can configure supported retention policies for certain workspace records and can use available export, archival, and account-management controls. Deletion from active systems and expiration from backups or archives may occur on different schedules.

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, or alteration. Controls include tenant isolation, access controls, authentication protections, logging, backups, and operational monitoring where appropriate to the deployment. No method of transmission, storage, or security control is completely effective, so we cannot guarantee absolute security.

RequestHub and its service providers may process information in countries other than the country where the information originated. Those countries may have different data-protection laws. Where required, we use recognized safeguards for restricted transfers and require applicable service-provider protections.

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, or complain to a data-protection authority. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Submit a request through the RequestHub contact form. We may need to verify your identity and authority. If your information belongs to a customer workspace, we may direct the request to that customer or assist the customer in responding. You can also update certain account and notification details directly in RequestHub and revoke Google or Microsoft access in provider settings.

RequestHub is a business service and is not directed to children. You must be at least 18 years old or the age of legal majority in your jurisdiction to register an organization under our Terms. We do not knowingly solicit personal information from children through the public site. Customer organizations are responsible for the lawful use of the service and the content their authorized users submit.

We may update this policy as RequestHub, our providers, or applicable requirements change. We will post the current version at this URL and update the effective or last-updated date. When appropriate, we will provide additional notice through the service or other communication channels.