When a business uses HubSpot's software, HubSpot stores and processes that business's customer list (including your email and contact details) on the business's behalf. The business — not HubSpot — is responsible for making sure it had your permission to put your data there.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause allocates data governance responsibilities between HubSpot and its customers by defining HubSpot's role as a service provider rather than an independent controller, which determines applicable legal obligations under data protection frameworks and establishes the customer as the entity accountable for lawful basis to process contact data.
Your email address, phone number, and interaction history may be stored in HubSpot's CRM by a business you've dealt with, without HubSpot being the entity responsible for obtaining your consent — making it harder to know who to contact if you want your data removed.
How other platforms handle this
When our business customers use certain Services, we generally process and store limited personal information on their behalf as a data processor. For certain products such as Docusign's Contract Lifecycle Management (CLM) and Identity products, we may act as a processor and as a controller in certa...
Signal can optionally discover which contacts in your address book are Signal users, using a service designed to protect the privacy of your contacts. Information from the contacts on your device may be cryptographically hashed and transmitted to the server in order to determine which of your contac...
We collect information about you when you shop in our stores, including through store cameras, loyalty programs, payment processing systems, and other in-store technologies. This information is used to improve store operations, loss prevention, and marketing.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Our Customers use our Services to, among other things, run their businesses and, in doing so, they direct us to collect, process and store 'Customer Data,' including information about their own customers and leads ('Contacts'). In these cases, HubSpot is providing services to the Customer as a data processor or service provider... HubSpot's Customers are responsible for ensuring they have the appropriate permissions and consents to process personal information in HubSpot's Services.— Excerpt from HubSpot's HubSpot Privacy Policy
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Art. 4(8) (processor definition), Art. 28 (processor obligations and contractual requirements), Art. 29 (processing under controller authority), and Art. 82 (liability). Under CCPA §1798.140(ag), HubSpot functions as a 'service provider,' which limits its liability for onward use only if it contractually restricts its own use of the data. The primary enforcement authorities are EU/EEA national Data Protection Authorities, the UK ICO, and the California Privacy Protection Agency (CPPA). (2)
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause allocates data governance responsibilities between HubSpot and its customers by defining HubSpot's role as a service provider rather than an independent controller, which determines applicable legal obligations under data protection frameworks and establishes the customer as the entity accountable for lawful basis to process contact data.
Your email address, phone number, and interaction history may be stored in HubSpot's CRM by a business you've dealt with, without HubSpot being the entity responsible for obtaining your consent — making it harder to know who to contact if you want your data removed.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.