HubSpot Privacy Policy

This document is HubSpot's global Privacy Policy (last modified April 14, 2026), governing HubSpot's collection and processing of personal data across three distinct roles: as a controller when individuals interact with HubSpot's websites, products, and events; as a processor when customers use the Subscription Service to process their own contacts' data; and as a controller when collecting and commercializing professional data for enrichment products made available to other customers. The policy states that HubSpot collects identifiers, device information, log files, IP addresses, payment data, usage metrics, and professional data sourced from publicly available sources, third-party providers, and customers, and authorizes use of this data for product delivery, AI model training, marketing, advertising partner disclosure, and enrichment product distribution. The policy asserts that personal data collected via the HubSpot Tracking Code installed on customer websites, including IP addresses and online identifiers, is processed by HubSpot as a controller for its own purposes including improvement of its commercial dataset, which represents a distinct data flow from the processor relationship with customers and may warrant separate regulatory evaluation. The policy references compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, Standard Contractual Clauses, UK Addendum, and Canadian transfer mechanisms, engaging GDPR, UK GDPR, Swiss data protection law, CCPA, the Canadian PIPEDA framework (subject to the Office of the Privacy Commissioner of Canada), and FTC enforcement jurisdiction. Material compliance considerations include the dual-controller role in enrichment data commercialization, the AI training use of customer-adjacent data, the scope of advertising partner data disclosure, and the California-specific rights framework described in Section 8.