Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data collected through use of HubSpot products and services may be processed to train HubSpot's AI models and develop AI-related features and products.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes a secondary processing purpose beyond product delivery: personal data from product and service usage may be applied to AI model training. The provision does not specify which categories of personal data are used for training, which AI models or features are involved, or whether this processing is limited to aggregated or anonymized data versus identified personal data.
Interpretive note: The provision does not specify which data categories, which AI models, or which legal basis applies to AI training use, creating ambiguity regarding scope and compliance posture.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, personal data generated through use of HubSpot's products and services may be processed for AI model training purposes in addition to direct service delivery. The provision does not include an opt-out mechanism specific to AI training use.
Cross-platform context
See how other platforms handle AI Model Training Using Personal Data and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you use our products and services we may process personal data to develop, support, and improve HubSpot AI features and to train our AI models and similar products and services that rely on machine learning.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 6 legal basis requirements and the compatibility assessment under Article 5(1)(b) for secondary processing purposes. In the EEA and UK, processing personal data for AI training as a purpose beyond the original collection context may require a separate legal basis or compatibility assessment. The EU AI Act may also apply depending on the AI system risk classification involved. The FTC has signaled scrutiny of data use for AI training under Section 5 of the FTC Act. 2. GOVERNANCE EXPOSURE: Medium. The provision does not specify the legal basis for AI training use, which categories of personal data are processed for this purpose, or whether the processing is limited to pseudonymized or aggregated data. For EEA and UK users, this ambiguity creates exposure if the legal basis relied upon is consent or contract performance, as those bases may not extend to AI training without explicit disclosure at collection. 3. JURISDICTION FLAGS: EEA and UK users face heightened exposure given GDPR purpose limitation requirements. California residents may have rights under the CCPA regarding use of personal data for purposes beyond the primary service. Switzerland's revised Federal Act on Data Protection similarly requires clear purpose specification. 4. CONTRACT AND VENDOR IMPLICATIONS: B2B customers whose employees or contacts generate data through the Subscription Service should assess whether their own data processing agreements with HubSpot cover AI training use and whether their downstream data subjects have been notified of this secondary processing purpose. 5. COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether HubSpot's privacy notices at point of collection disclose AI training as a processing purpose, whether a separate legal basis is identified for this use, and whether opt-out or objection mechanisms exist for this processing. Data mapping exercises should distinguish between Customer Data processed as a processor and usage data processed as a controller for AI training.
This provision authorizes a secondary processing purpose beyond product delivery: personal data from product and service usage may be applied to AI model training. The provision does not specify which categories of personal data are used for training, which AI models or features are involved, or whether this processing is limited to aggregated or anonymized data versus identified personal data.
Under this clause, personal data generated through use of HubSpot's products and services may be processed for AI model training purposes in addition to direct service delivery. The provision does not include an opt-out mechanism specific to AI training use.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.