If you use HubSpot to handle personal data covered by privacy laws like GDPR, you must sign a separate Data Processing Agreement with HubSpot — and it's your responsibility to make sure you're allowed to share that data with HubSpot in the first place.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision clarifies the operational framework for data handling compliance by designating a separate DPA as the governing instrument for regulated data processing and allocating the compliance obligation for pre-transfer authorization to the customer organization.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →Previous version's explicit statement of Customer's responsibility for legal compliance and data transfer rights has been removed; scope now limited to 'Personal Data' as defined in the DPA rather than all 'Data Protection Laws.'
View full change record →Business customers processing EU, UK, or other regulated personal data through HubSpot must separately execute the DPA to maintain legal compliance — failure to do so creates significant GDPR enforcement risk that falls entirely on the business customer.
How other platforms handle this
Preventing and prosecuting potentially prohibited or illegal activities; Enforcing our agreements; and Complying with our legal obligations
We use your personal information to send you newsletters and other promotional communications, including information about MyFitnessPal's new offerings, features, offers, events, webinars, and other information.
We may infer certain information from your interactions with the Lyft Platform and other personal information available to us. For example, if you frequently ride to or from airports, we may infer you are a frequent traveler.
"To the extent that HubSpot processes any Customer Data that is subject to Data Protection Laws on Customer's behalf, the terms of the HubSpot Data Processing Agreement ('DPA'), which are incorporated into this Agreement by reference, shall apply. The DPA is available at https://legal.hubspot.com/dpa. Customer is responsible for ensuring that it has all necessary rights, consents, and legal bases required under applicable Data Protection Laws to transfer Customer Data to HubSpot for processing.Excerpt from HubSpot's Terms of Service
(1) REGULATORY FRAMEWORK: GDPR Art.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The provision clarifies the operational framework for data handling compliance by designating a separate DPA as the governing instrument for regulated data processing and allocating the compliance obligation for pre-transfer authorization to the customer organization.
Business customers processing EU, UK, or other regulated personal data through HubSpot must separately execute the DPA to maintain legal compliance — failure to do so creates significant GDPR enforcement risk that falls entirely on the business customer.
ConductAtlas has identified this type of provision across 279 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.