Your information, with clear boundaries.

Innovation Hub operates the platform. Use Help & support in your workspace for privacy questions or requests. The planned email contact is info@InnovationHub.cat; use the workspace until domain and mailbox setup is complete. Individual program organizers may be separately responsible for application and cohort records; their program notice identifies the relevant purpose and contact. The registered country and address of the platform operator remain to be supplied.

Authenticated account ID, display name and email; information you choose to put in profiles, programs, applications, reviews, files, messages and support cases; and access/security records. We request only information needed for the selected service. Avoid including unnecessary sensitive or third-party information.

We use information to provide the service you request, manage access and program participation, maintain security and evidence of decisions, and answer support and data-rights requests. Optional ecosystem updates are separate and can be turned off. Legal obligations or a documented, proportionate legitimate interest may require limited retention. Program organizers must state their own applicable processing basis.

A profile appears in the directory only when you publish it. Applicant drafts stay with their authorized applicant team. Submissions are shared with the authorized program team and accepted assigned reviewers. Private mentor notes are visible to their author. Named document grants have an expiry and can be revoked. Support sees a case description only while the user’s explicit reading consent is active. Operators do not receive blanket access to private files or messages.

Hosting, PostgreSQL and private file storage use Microsoft Azure in Spain Central. Customer sign-in uses Microsoft Entra External ID in its Europe data region. Uploaded files stay quarantined until ClamAV running alongside the application verifies their exact content. PostgreSQL backups and deleted Blob versions have a 14-day configured recovery window; infrastructure logs have a 30-day configured retention window. Relevant providers may process information in their service locations under applicable contractual safeguards. This application does not send your program evidence to an AI model. No optional advertising or analytics SDK is active.

Ordinary review windows are six inactive months for unsubmitted drafts; 24 months after program closure for submissions, reviews, program messages, shared files and decision/access evidence; 90 days after a mentorship ends for private notes; 12 months after resolution for support cases; and 90 days for security logs. A documented legal hold or program obligation may justify a limited exception. Account deletion is reviewed separately from records a program organizer must retain. These windows guide reviewed fulfilment; automatic bulk erasure is not enabled. Provider backup expiry can occur later than deletion from active records.

You may update profile visibility, change optional notifications, revoke sharing, request access or correction, ask for deletion or restriction, and exercise applicable portability and objection rights. Use Profile & security or Help & support in your workspace. We verify identity and protect other people’s information when preparing an export or deletion. You may contact your competent data-protection authority. Withdrawing an optional choice does not remove unrelated account access.

We use scoped authorization, private storage and an additional authenticator check for sensitive actions. No system can guarantee absolute security. Material notice changes receive a new version; any new optional purpose requires an appropriate choice before processing begins.