Hubricon is a founder-operated Managed Profit service for brands selling on Amazon and Shopify. This page says what we collect, why, who else touches it, and how to get it back or erased. It is written to be read, not skimmed past.
Hubricon is operated by Hagen Simmons, doing business as Hubricon, in Dallas, Texas, United States. Questions go to hagen.simmons@hubricon.com and land with the founder.
The application on our site asks four questions: where you sell, revenue band, business model and catalog size. They travel with your booking to Calendly so the call starts from your numbers, and we keep them on your booking record so we know which platform to set you up on. The four answers, and the fit note we derive from them, are also counted in our own analytics so we can see which kinds of seller apply. Our host, Vercel, records anonymous, cookieless analytics: pages viewed, country, device type, referrer. We run no advertising pixels and no retargeting.
Until 30 September 2026 a calculator at hubricon.com/teardown priced one listing against a published rate card in your browser. It is gone. If you used its "send me this" option, we still hold what it kept: the numbers you typed, your name and email address, and a salted hash of your connection address (never the address itself). Nothing more is sent to that address. Ask and we delete it, under section 6.
The application at hubricon.com/apply asks the four questions described above. They travel with your booking to Calendly as one tag, together with the fit note we derive from them and, if you arrived on a client's referral link, that link's code; we keep them on your booking record as described under "Visiting the website". Calendly collects your name, email, a phone number for the call, and your answers to the booking questions, under Calendly's privacy policy. We receive that information by email and keep it in our mailbox.
On the call we may open your Seller Central reports, or your Shopify Products export, in a page on our site, hubricon.com/call. It reads them inside your own browser: nothing is uploaded to us or kept, the page carries no analytics, and closing the tab forgets them. What you show us on the call is confidential under section 10 of the terms.
Every lesson and every spreadsheet is open: reading a course takes no email and no account. If you choose to leave your email on a course, we keep that address, which course you left it on and when, the campaign tag in the link you arrived by if it carried one, a salted hash of your connection address (never the address itself), so that one connection cannot sign up hundreds of addresses, and a record of what we told you would follow. We send one email with the course link and the spreadsheet, and after that only a short note when a fee card the courses use changes or a new course is out. Every email carries a one-click unsubscribe, and after it we send nothing more about courses; the courses stay open to you. The course page remembers, in your own browser's storage, which lessons you have read and the last one you opened, and any numbers you type into a course's own calculator, so they are there when you come back. A report you drop into a course (Fee Preview, Inventory Age) is read there and then, in your browser, and never uploaded or kept. None of that leaves your browser, and clearing the calculator or your browser's site data removes it. Ask, and we delete your address under section 6.
If you write to us, we keep the correspondence. If you received an email from us that you did not ask for, it came from a Hubricon address, it tells you who we are and where we are, and one reply or one click stops it. We honour opt-outs immediately.
On Amazon, you add one Hubricon user to your Seller Central with exactly four permissions: Business Reports (view), Fulfillment reports (view), Pricing (view and edit), and Advertising Campaign Manager (view and edit). Through that seat we download sales and traffic reports, SKU economics and fee reports, advertising reports, inventory, reimbursement and returns reports, and settlement data, and we make the pricing and advertising changes you have authorised.
On Shopify, you add one staff account with a role limited to Orders (view and export), Products (view, view cost, edit price and export), Discounts (view, create and delete) and Analytics reports: a staff account with no access to Finance, payouts, Customers, Settings or apps. Through it we export your orders and products and make the pricing and discount changes you have authorised; payout exports come from you, by upload. If you advertise on Meta or Google, you also give us partner access to your Meta ad account and Standard access to your Google Ads account, used for advertising changes and their reports only. Google's Standard access can see billing; we do not use it.
Neither seat can see banking, tax or account settings. On Amazon, the reports we pull describe your products, orders in aggregate, fees and campaigns, and contain no customer names, addresses or payment details.
Shopify orders are the one exception, and we handle it deliberately. A Shopify order record carries the customer's name, email and shipping address, because that is how the platform stores an order. We keep none of it. Our parser reads eleven fields from an order: order name, email, financial status, created and cancelled dates, refund total, and each line's SKU, name, quantity, price and discount. It writes a per-SKU, per-month aggregate, and one row per order holding the order name, date, units, revenue and a customer code: a SHA-256 hash of the lower-cased email joined to your account's identifier, so the same customer has the same code within your account and a different one in any other. We use it only to count repeat orders, which can raise what an advertisement can afford. The code is a pseudonym, not anonymity: anyone holding both the email and your account identifier could recompute it. The email address itself, and every customer name, address, phone number and payment detail, is never written to our database. If you delete the email column, everything else works, but repeat-customer value is not measured. The file you upload is stored as sent, in the encrypted bucket described below, and is deleted with the rest of your data when you ask.
You can revoke either seat any day: on Amazon in one click, on Shopify by removing the staff account under Settings → Users. Meta and Google access is removed in each one's own settings.
Your first exports come through a private upload link, as can any files you would rather send than have us pull through the seat. The link opens only the upload page and expires after ninety days. Files go straight into an isolated, access-controlled storage bucket and are parsed into structured tables. Nothing is sent by email. The unit-cost template you fill in contains your cost, freight and lead time per SKU, and we treat it as confidential.
Invoices go out by email and are paid by ACH. Payment details are handled by Stripe under its own privacy policy. We never see or store your bank account numbers, and no card is kept on file.
We do not sell or rent data, share one client's data with another (the aggregates above carry no figure of any one client), use your data to train AI models, or run advertising on the strength of it.
The wording of your written briefs is drafted by Anthropic's Claude from a short table of results our engine has already computed, for example your net margin, your Health Score and the moves waiting for your yes, together with your first name and company name. Our code inserts every figure afterwards, and rejects any draft that contains a number the table did not supply. Raw reports, uploaded files and credentials are never sent to an AI provider. Anthropic's commercial terms prohibit it from training on data submitted through its API.
Each of these providers processes data under its own terms and security programme. We add nothing to this list without updating this page.
| Provider | What for |
|---|---|
| Supabase | Database and file storage, encrypted in transit and at rest |
| Vercel | Website hosting and cookieless analytics |
| Google Workspace | |
| Resend | Delivery of transactional email such as your welcome and alerts, and of the course emails described under "Courses" |
| Calendly | Scheduling |
| Stripe | Invoicing and ACH payment |
| Loom | Hosting a video brief on the occasions the founder records one personally, in place of the generated one |
| ElevenLabs | Speaking the narration of your video brief. It receives the narration text, which contains figures from your own numbers; it never receives your raw reports or uploads |
| Instantly | Our cold outreach before you were a client: name, work email, company, and the text of any reply. Never used for client data |
| Anthropic | Drafting the wording of written briefs, and of replies to prospect enquiries, as described above |
| GitHub | Runs our weekly monitoring job; your data passes through that job in memory and is not stored there |
Your store access is one named, permission-scoped user that you can revoke any day: on Amazon in one click, on Shopify by removing the staff account under Settings → Users. Raw data and model outputs live in a database with row-level security. Hubricon signs you in with a one-time link sent to your own address — we never set, see or store a password, so there is no password to steal, and row-level security scopes every read to your workspace alone. The engine's own tables are reachable only by our server-side service, never by a signed-in session. Data is encrypted in transit and at rest. One person, the founder, holds access to production. Upload links are single-purpose and expire after ninety days. If we learn of a breach affecting your data, we tell you within seventy-two hours of confirming it.
While you are a client we keep your data to run the service and maintain your Profit Record. When you leave, an export of your data and your full Profit Record is free, any time, including the day you cancel. Ask, and we delete your raw reports, uploads and model outputs within thirty days, keeping only what invoicing and the law require and any results you agreed we may publish in anonymised form. Booking and correspondence records are kept for our own bookkeeping. A course sign-up is kept until you ask us to delete it; unsubscribing stops the emails at once. Analytics data is anonymous from the start.
Wherever you are, you can ask to see what we hold about you, correct it, export it, have it deleted, or object to a use of it. Email hagen.simmons@hubricon.com. It lands with the founder, and you get an answer within seven days. We do not sell or share personal information in the sense of the California Consumer Privacy Act. For clients in the European Union or the United Kingdom, we act as your processor for your store's data and as a controller for booking and correspondence data, and the rights in the GDPR apply.
We set none of our own. Vercel's analytics uses no cookies. The embedded Calendly scheduler may set Calendly's own cookies when you use it. A course page at /learn keeps a small note in your browser's storage (not a cookie) of which lessons you have read and the last one you opened, so it can offer to pick up where you left off. It is never sent to us, and clearing your browser's site data removes it.
Hubricon is a business service and is not directed at anyone under eighteen.
When this policy changes we post the new version here with a new effective date, and we email clients about anything material.
Hagen Simmons, founder · hagen.simmons@hubricon.com
Hubricon · Dallas, Texas, United States