HubSpot's Privacy Policy explains how HubSpot collects and uses personal information about visitors to its website, people who sign up for its services, and the contacts that HubSpot's business customers upload into HubSpot's CRM and marketing tools. The most important thing for everyday people to know is that if a business uses HubSpot's software, your contact details — including your email address, browsing behavior on that business's website, and any form submissions — may be stored and processed by HubSpot on that business's behalf. If you believe a business has submitted your data to HubSpot without your consent, you can submit a data removal request at https://app.hubspot.com/reports-dashboard/1316849 or by emailing privacy@hubspot.com.
This document is HubSpot's global Privacy Policy governing the collection, use, storage, and disclosure of personal data across HubSpot's CRM platform, marketing tools, and related services, with legal bases including consent, legitimate interests, and contractual necessity under GDPR Art. 6. The policy creates obligations for HubSpot to respond to data subject access, deletion, correction, and portability requests, and obligates business customers ('Customers') to maintain their own legal bases for processing end-user ('Contact') data submitted to HubSpot's platform. Notably, HubSpot operates a dual-controller model in which it acts as both a data controller (for its own marketing and service data) and a data processor (for Customer-submitted Contact data), and the policy discloses sharing of personal data with a broad list of third-party service providers, advertising networks, and business partners without requiring opt-in consent for many such transfers. The policy engages GDPR (EU/UK), CCPA/CPRA (California), and other applicable data protection laws, with HubSpot relying on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework for cross-border data transfers; material compliance considerations include the adequacy of HubSpot's legitimate interest assessments, the comprehensiveness of its cookie consent mechanisms, and the sufficiency of its processor agreements with Customers who upload third-party Contact data.
🔒 Institutional analysis locked
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Upgrade to Professional — $149/mo3 changes analyzed since monitoring began.
Cross-platform context
See how other platforms handle Dual Controller-Processor Model for Contact Data and similar clauses.
Compare across platforms →