The agreement requires the Customer to represent and warrant that all Customer Data provided to HubSpot has been lawfully collected, that the Customer holds all necessary rights and permissions to transfer and process that data, and that doing so does not violate applicable laws or third-party rights including privacy rights.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision places the legal compliance burden for Contact Data on the Customer as data controller, creating direct exposure under GDPR, CCPA, and other applicable privacy laws if data is transferred to HubSpot without adequate lawful basis, consent, or required disclosures to data subjects.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →This high-severity addition shifts legal responsibility to the customer for data legality and third-party rights compliance, with explicit coverage of export control laws.
View full change record →This clause establishes that the Customer, not HubSpot, is responsible for ensuring that all Contact Data uploaded to the platform has been lawfully collected and that individuals whose data is processed have been appropriately notified. Under this provision, the Customer assumes warranty obligations regarding data legality that could create liability in the event of a privacy law violation.
How other platforms handle this
You can always contact your local data protection authority if you have concerns regarding your rights under local law.
If you are an end user in a Workspace not owned by you and wish to update, delete, or receive any information we have about you, you may do so by contacting the organization who owns your ClickUp Workspace.
to request that your data be transferred to a third party (data portability)
"Customer represents and warrants that it has obtained all necessary rights, releases and permissions to provide any Customer Data to HubSpot and to grant the rights granted to HubSpot in this Agreement, and that Customer Data and its transfer to and use by HubSpot as authorized by Customer under this Agreement will not violate any applicable laws (including those relating to export control and electronic communications) or rights of any third party, including without limitation, any intellectual property rights, rights of privacy, or rights of publicity.Excerpt from HubSpot's Terms of Service
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 5, 6, and 7 (lawfulness of processing, conditions for consent) for EU/EEA/UK customers, and CCPA Sections 1798.100 et seq.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision places the legal compliance burden for Contact Data on the Customer as data controller, creating direct exposure under GDPR, CCPA, and other applicable privacy laws if data is transferred to HubSpot without adequate lawful basis, consent, or required disclosures to data subjects.
This clause establishes that the Customer, not HubSpot, is responsible for ensuring that all Contact Data uploaded to the platform has been lawfully collected and that individuals whose data is processed have been appropriately notified. Under this provision, the Customer assumes warranty obligations regarding data legality that could create liability in the event of a privacy law violation.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.