Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that U.S. users who connect bank accounts for payment purposes have their banking credentials transmitted to Plaid, a third-party financial data service, and that Plaid processes their personal and financial data under Plaid's own privacy policy.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that banking credentials entered during checkout are transmitted to a third party (Plaid) and processed under a separate privacy policy, meaning HubSpot's privacy protections do not govern this data once transmitted. Users must review Plaid's Privacy Policy separately to understand how their financial data is handled.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, U.S. users who provide banking credentials during payment are subject to Plaid's data processing practices under Plaid's own privacy policy, which governs the financial data independently of HubSpot's policy. HubSpot's policy does not describe what data Plaid retains, how long it is held, or how it is used beyond payment validation.
Cross-platform context
See how other platforms handle Plaid Financial Data Integration and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We use Plaid to securely connect to financial institutions across the U.S. To the extent you are based in the U.S., by entering online banking credentials for payment and completing checkout, your banking credentials are sent to Plaid for validation. Your personal and financial data is processed by Plaid in accordance with the Plaid Privacy Policy available at https://plaid.com/legal/#consumers.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages the Gramm-Leach-Bliley Act (GLBA) for financial data handling, the California Consumer Financial Privacy Act, and potentially the CFPB's oversight of financial data aggregators. Plaid has been subject to CFPB enforcement attention regarding financial data practices. The FTC Act Section 5 also applies to unfair or deceptive practices in financial data handling. 2. GOVERNANCE EXPOSURE: Medium. The provision discloses the Plaid integration and directs users to Plaid's privacy policy, which limits HubSpot's direct accountability for financial data processing. However, the adequacy of vendor assessment and contractual controls over Plaid's use of banking credentials may be a due diligence consideration. 3. JURISDICTION FLAGS: U.S. users only, as the provision explicitly states it applies to the extent the user is based in the U.S. California residents may have additional rights under state financial privacy law regarding banking credential data. No EEA, UK, or Canadian applicability is stated. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should review HubSpot's data processing agreement with Plaid, confirm that Plaid's data retention and use practices are contractually limited to payment validation, and assess whether Plaid's separate privacy policy creates liability exposure for HubSpot in the event of a Plaid data incident. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the disclosure of banking credential transmission to Plaid is presented to users at the point of data entry (not only in the privacy policy), and that users are able to access Plaid's privacy policy prior to completing checkout. The adequacy of the vendor relationship with Plaid under applicable financial privacy regulations should be assessed.
This provision discloses that banking credentials entered during checkout are transmitted to a third party (Plaid) and processed under a separate privacy policy, meaning HubSpot's privacy protections do not govern this data once transmitted. Users must review Plaid's Privacy Policy separately to understand how their financial data is handled.
Under this clause, U.S. users who provide banking credentials during payment are subject to Plaid's data processing practices under Plaid's own privacy policy, which governs the financial data independently of HubSpot's policy. HubSpot's policy does not describe what data Plaid retains, how long it is held, or how it is used beyond payment validation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.