Privacy Notice
Version 1, in effect from October 11, 2026.
Who we are
Stone Soup runs The Hub ("we", "us"). This notice explains what we collect about people who visit the platform's public pages at https://thehub.testtesttesting.com, people who sign up to start an organization, organization admins in their dealings with us, and platform staff.
Version 1, in effect from October 11, 2026.
It does not cover what a food hub collects about its own shoppers, vendors, partners and drivers. Each hub decides that and explains it in its own privacy notice, linked at the bottom of its pages. For those hub sites we act as the hub's service provider: we store and process that information only for the hub, under our Data Processing Agreement.
What we collect
- Sign-up details. When you start an organization: your name, email address, phone number if you give it, the organization's name, web address, city, state and description, the plan you chose, your password (stored only in scrambled, hashed form), and the date and internet address the sign-up came from.
- Billing details. The organization's plan, invoices and payments. If your organization saves a card on file, the card is held by Stripe; we keep only Stripe's references to it and a label such as "Visa ending 4242".
- Messages to us. Help requests and emails you send us, with the error code and page you were on when you include them.
- Platform staff accounts. Name, email address, a hashed password, two-step sign-in settings and a log of what each staff member does in the console.
- Records of what happens. A log of sign-ins, approvals and changes to organizations, plans, billing and settings, with the time and, for sign-in attempts, the internet address.
- Address lookups. When you type an address or town into a form on the platform's pages, what you type is sent through our server to our address service to suggest matches. Typed text is not stored with your name; some services' answers are cached for up to 24 hours without who asked.
- Cookies. One essential cookie that keeps you signed in, and your browser's own storage for small preferences. We don't use advertising or tracking cookies, and we don't use third-party analytics.
How we use it
- to set up and run your organization's hub site and the platform;
- to bill your organization and keep accounting records;
- to answer your questions and help your organization;
- to keep the platform and its users secure, and to stop fraud and abuse;
- to tell you about changes to the platform, its terms or your account; and
- to meet our legal obligations.
We never sell personal information, and we don't share it for advertising.
Who we share it with
We share personal information only with the service providers that help us run the platform, under contracts that limit them to that purpose:
- Hosting: AJH, which runs the servers and stores the data (United States).
- Email delivery: AJH, which delivers the platform's and hubs' emails.
- Stripe, Inc.: card payments on organizations' own or connected accounts, and the platform's billing of organizations (card on file).
- PayPal, Inc.: card and PayPal payments for organizations that connect PayPal.
- When a map is shown, your browser loads the map pictures from OpenStreetMap (tile.openstreetmap.org), and the map code from a public code library (cdnjs.cloudflare.com).
- Address suggestions: what you type in an address box is sent through our server to Photon, an OpenStreetMap address service run by komoot (photon.komoot.io) to suggest matches.
- Placing an address on the map: the address text of a delivery, market or partner is looked up with OpenStreetMap's Nominatim service. Only the address text is sent.
- Browser push services (Google, Apple, Mozilla, Microsoft): deliver phone notifications to people who turn them on. They see the notice, not the account.
- US National Weather Service (api.weather.gov): market-day forecasts. Only a market's location is sent.
We may also share information when the law requires it, to protect people's safety, or as part of a sale or reorganization of our business (in which case this notice continues to apply).
How long we keep it
- Sign-ups that are never confirmed: removed after 3 days.
- Organization and billing records: for as long as the organization uses the platform, then as long as tax and accounting law requires (usually 7 years).
- Help requests: removed 2 years after they are closed.
- Platform activity logs (sign-ins, approvals and changes): kept for the platform's security and accounting records.
- Address suggestion caches: 24 hours.
- An organization's own hub data: see our Terms of Service, "Your data when you leave".
How we protect it
Passwords are stored only in hashed form. Payment keys and other secrets are encrypted. Each organization's data lives in its own separate database. Platform staff use two-step sign-in, and opening a hub's records needs a logged support session that the hub can see. No system is perfectly secure, so if we learn of a breach that affects you, we tell you as the law requires.
Your choices and rights
You can see and correct your organization's details on its own pages, and ask us at info@stonesouphub.com for a copy of the personal information we hold about you, to correct it, or to delete it. Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have further rights, such as to know what we collect and to not be treated differently for using your rights. We will answer within the time the law sets, after checking it is really you. Someone you authorize may ask for you.
If your question is about a food hub's shoppers, vendors, partners or drivers, ask that hub: it decides about its users' information, and we help it answer.
Children
The platform's public pages and console are not meant for children under 13, and we don't knowingly collect their information. Food hubs decide who may use their own sites.
Where it is stored
The platform is hosted in the United States. If you use it from elsewhere, your information is processed in the United States.
Changes to this notice
When we change this notice, we publish the new version here with its version number and a summary of what changed. If the change is significant, we tell organization admins before it takes effect.
Contact
Stone Soup
123 Main St
info@stonesouphub.com
Each food hub has its own terms of use and privacy notice for its shoppers, vendors, partners and drivers, linked at the bottom of its pages.
Questions: info@stonesouphub.com