The policy states that HubSpot collects personal data that users directly provide, data generated through use of the services, and data received from third-party websites, services, and partners.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the three primary collection channels and authorizes ingestion of data from external third-party sources in addition to direct user input and behavioral data, which has implications for data mapping and consent chain documentation.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Explicitly details the breadth of data collection methods including third-party sources, establishing a foundational disclosure of collection scope.
View full change record →Under this provision, personal data may be collected not only from information a user directly submits but also from third-party sources including websites and partner organizations, which may include data the user did not provide directly to HubSpot.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
We collect your personal data when you use our Services, create a new eBay account, provide us with information via a web form, add or update information in your eBay account, participate in online community discussions or otherwise interact with us.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below. We may collect and receive information about users of our Services from various sources, including: (i) information you provide through your user account on the Services (your "Account") if you register for the Services; (ii) your use of the Services; and (iii) from third-party websites, services, and partners.— Excerpt from HubSpot's HubSpot Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR Article 14 (information to be provided where personal data has not been obtained from the data subject) and CCPA disclosure requirements for data collected from third-party sources. The FTC Act's unfair or deceptive practices authority is also relevant where third-party sourced data is used in ways not reasonably expected by the data subject. The Irish DPC is the lead EU supervisory authority. 2. GOVERNANCE EXPOSURE: Medium. The authorization to receive data from third-party sources requires organizations to assess whether those third parties have valid legal bases for sharing data with HubSpot and whether the privacy notice chain is adequate under GDPR Article 14 timelines. 3. JURISDICTION FLAGS: EU and EEA users have the strongest exposure given GDPR Article 14 requirements for notice when data is obtained from third parties. California residents are also affected given CCPA disclosure obligations for categories of sources. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm in data processing agreements with HubSpot which third-party data sources are used and whether those sources are disclosed in HubSpot's sub-processor or partner lists. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether their own privacy notices adequately disclose HubSpot as a source through which third-party data may be collected, and should review data flow diagrams to account for third-party sourced data entering HubSpot-managed systems.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the three primary collection channels and authorizes ingestion of data from external third-party sources in addition to direct user input and behavioral data, which has implications for data mapping and consent chain documentation.
Under this provision, personal data may be collected not only from information a user directly submits but also from third-party sources including websites and partner organizations, which may include data the user did not provide directly to HubSpot.
ConductAtlas has identified this type of provision across 17 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.