Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HubSpot acts as a data controller for visitor and user data but as a data processor for data that business customers submit into HubSpot products, directing data subject inquiries about that second category to the relevant HubSpot customer rather than to HubSpot.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a bifurcated data governance structure in which data subject rights requests for customer-submitted data must be directed to HubSpot's business customers, not to HubSpot directly, which affects how data subjects can exercise GDPR and CCPA rights depending on the category of data at issue.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Clarified that HubSpot acts as both controller (for own data collection) and processor (for customer-submitted data), and added redirect language for customer inquiries.
View full change record →Under this provision, individuals whose data has been submitted into HubSpot by a business (such as a contact in a company's CRM) must direct access, deletion, or portability requests to that business rather than to HubSpot, as HubSpot acts only as a data processor for that data.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"HubSpot is the data controller for information we collect about visitors, customers, and users. For information that our customers submit to our Services (including information submitted about their own contacts and leads), HubSpot is the data processor and our customers are the data controllers. If you have questions about the personal information that a HubSpot customer has submitted to our Services, please direct your questions to that customer.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 4, 24, and 28, which define the obligations of controllers and processors and require documented data processing agreements between them. The CCPA similarly distinguishes between businesses and service providers. The Irish DPC and relevant EU member state supervisory authorities have jurisdiction over GDPR compliance. 2. GOVERNANCE EXPOSURE: High. Organizations using HubSpot as a CRM or marketing automation platform are the data controllers for contact data submitted into HubSpot, and must ensure their own privacy notices, data processing agreements with HubSpot, and data subject rights processes account for this structure. 3. JURISDICTION FLAGS: EU and EEA organizations face the highest exposure given GDPR processor agreement requirements. UK organizations must comply with UK GDPR equivalent obligations. California-based organizations should assess whether their use of HubSpot as a service provider is documented consistent with CCPA service provider definitions. 4. CONTRACT AND VENDOR IMPLICATIONS: The policy's processor assertion requires that organizations using HubSpot have a compliant Data Processing Agreement (DPA) in place. Teams should confirm that HubSpot's current DPA covers all relevant processing activities, sub-processor disclosures, and breach notification timelines required under GDPR Article 28. 5. COMPLIANCE CONSIDERATIONS: Legal teams should review whether their organization's privacy notice adequately describes HubSpot as a processor of contact and lead data, and should ensure internal data subject rights workflows route requests appropriately based on whether HubSpot is acting as controller or processor in the relevant context.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes a bifurcated data governance structure in which data subject rights requests for customer-submitted data must be directed to HubSpot's business customers, not to HubSpot directly, which affects how data subjects can exercise GDPR and CCPA rights depending on the category of data at issue.
Under this provision, individuals whose data has been submitted into HubSpot by a business (such as a contact in a company's CRM) must direct access, deletion, or portability requests to that business rather than to HubSpot, as HubSpot acts only as a data processor for that data.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.