Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement requires the Customer to represent and warrant that all Customer Data provided to HubSpot has been lawfully collected, that the Customer holds all necessary rights and permissions to transfer and process that data, and that doing so does not violate applicable laws or third-party rights including privacy rights.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision places the legal compliance burden for Contact Data on the Customer as data controller, creating direct exposure under GDPR, CCPA, and other applicable privacy laws if data is transferred to HubSpot without adequate lawful basis, consent, or required disclosures to data subjects.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →This high-severity addition shifts legal responsibility to the customer for data legality and third-party rights compliance, with explicit coverage of export control laws.
View full change record →This clause establishes that the Customer, not HubSpot, is responsible for ensuring that all Contact Data uploaded to the platform has been lawfully collected and that individuals whose data is processed have been appropriately notified. Under this provision, the Customer assumes warranty obligations regarding data legality that could create liability in the event of a privacy law violation.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Customer represents and warrants that it has obtained all necessary rights, releases and permissions to provide any Customer Data to HubSpot and to grant the rights granted to HubSpot in this Agreement, and that Customer Data and its transfer to and use by HubSpot as authorized by Customer under this Agreement will not violate any applicable laws (including those relating to export control and electronic communications) or rights of any third party, including without limitation, any intellectual property rights, rights of privacy, or rights of publicity.Excerpt from HubSpot's Terms of Service
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 5, 6, and 7 (lawfulness of processing, conditions for consent) for EU/EEA/UK customers, and CCPA Sections 1798.100 et seq. for California-based operations involving consumer personal information. The relevant enforcement authorities are the applicable EU Data Protection Authorities, the UK Information Commissioner's Office, and the California Privacy Protection Agency. The provision's warranty structure means that compliance failures by the Customer may not shift liability to HubSpot under these terms. 2) GOVERNANCE EXPOSURE: High. The Customer's warranty that Contact Data has been lawfully collected and transferred creates a contractual representation that, if breached, exposes the Customer to both contractual liability to HubSpot (under the indemnification clause) and direct regulatory liability under applicable privacy laws. This exposure is heightened for customers operating email marketing or CRM workflows involving large volumes of third-party Contact Data. 3) JURISDICTION FLAGS: EU and EEA customers face the most significant exposure given GDPR's strict requirements for lawful basis and data subject rights. UK customers face equivalent obligations under UK GDPR. US customers in California, Virginia, Colorado, and other states with comprehensive privacy laws face state-level obligations regarding consumer data. Healthcare and financial services customers may face additional sector-specific data handling requirements that this general warranty does not address. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should conduct a data mapping exercise before deploying HubSpot to confirm that all Contact Data sources have documented lawful bases for processing. The warranty in this provision functions as a risk allocation mechanism that places downstream regulatory liability on the Customer. Vendor assessments should confirm whether HubSpot's DPA includes adequate controller-to-processor terms under GDPR Article 28 and whether standard contractual clauses are in place for international data transfers. 5) COMPLIANCE CONSIDERATIONS: Privacy and compliance teams should audit consent collection mechanisms and privacy notices for all Contact Data sources integrated with HubSpot. Data subject rights request workflows should be mapped to HubSpot's toolset to ensure deletion and access requests can be fulfilled. Organizations should review HubSpot's subprocessor list and assess whether any subprocessors create additional transfer or processing risk under applicable law.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision places the legal compliance burden for Contact Data on the Customer as data controller, creating direct exposure under GDPR, CCPA, and other applicable privacy laws if data is transferred to HubSpot without adequate lawful basis, consent, or required disclosures to data subjects.
This clause establishes that the Customer, not HubSpot, is responsible for ensuring that all Contact Data uploaded to the platform has been lawfully collected and that individuals whose data is processed have been appropriately notified. Under this provision, the Customer assumes warranty obligations regarding data legality that could create liability in the event of a privacy law violation.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.