Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
HubSpot keeps your personal data for as long as it needs it for business purposes, legal compliance, or dispute resolution, but does not specify fixed retention periods for most data categories.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without specific retention periods stated, it is difficult for individuals to know how long their data will be held or to anticipate when deletion might occur without a formal request.
Interpretive note: The policy does not specify retention periods for individual data categories, making compliance with GDPR's storage limitation principle and CPRA's retention disclosure requirement difficult to assess from the document alone.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Removed the parenthetical example explaining legal obligations retention and changed terminology from 'personal information' to 'personal data'; severity downgraded from medium to low.
View full change record →HubSpot does not commit to specific retention timeframes for most data categories in this policy, meaning your personal data could be retained for an extended period absent a deletion request. Submitting a deletion request to privacy@hubspot.com is the most direct way to prompt removal of your data.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.Excerpt from HubSpot's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e) (storage limitation principle), which requires personal data to be kept no longer than necessary for the purpose for which it was collected. The absence of specific retention periods may be scrutinized by EU supervisory authorities as inconsistent with the storage limitation principle's documentation requirements. CCPA does not impose explicit retention limits but requires that retention periods be disclosed in privacy notices in some interpretations. GOVERNANCE EXPOSURE: Low to Medium. The policy's general retention language is common in the industry, but GDPR's storage limitation principle implies that retention schedules should be documented and purpose-specific. Supervisory authorities in some EU member states have issued guidance requiring more specific retention period disclosures. JURISDICTION FLAGS: EU/EEA creates the highest exposure for vague retention language, as GDPR requires demonstrable compliance with storage limitation. California's CPRA requires disclosure of the retention period or criteria used to determine it for each category of personal information. This disclosure may not be sufficiently specific in the current policy text. CONTRACT AND VENDOR IMPLICATIONS: Business customers should request HubSpot's data retention schedule as part of DPA negotiations to ensure they can fulfill their own data minimization and storage limitation obligations for end-user data processed through HubSpot. Retention terms should specify what happens to customer data upon contract termination. COMPLIANCE CONSIDERATIONS: Compliance teams should request HubSpot's internal data retention schedule for each data category and assess whether it aligns with the purposes stated in the policy. Business customers should confirm that HubSpot's retention terms in the DPA include provisions for deletion of customer data within a specified period following contract termination.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Without specific retention periods stated, it is difficult for individuals to know how long their data will be held or to anticipate when deletion might occur without a formal request.
HubSpot does not commit to specific retention timeframes for most data categories in this policy, meaning your personal data could be retained for an extended period absent a deletion request. Submitting a deletion request to privacy@hubspot.com is the most direct way to prompt removal of your data.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.