The agreement prohibits use of the Subscription Service for regulated sensitive data categories including HIPAA, COPPA, GLBA, and FISMA-governed data unless the customer separately enables Sensitive Data functionality and accepts the HubSpot Sensitive Data Terms.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Organizations in healthcare, financial services, or those processing children's data must separately enable and accept the Sensitive Data Terms before using HubSpot to process regulated data categories; use of the standard Subscription Service for such data without enabling these additional terms is prohibited under the agreement.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →The agreement prohibits processing of HIPAA-covered health information, COPPA-governed children's data, GLBA-regulated financial information, and FISMA-governed data through the standard Subscription Service. Customers who require such processing must enable the Sensitive Data functionality in their account, which triggers the Sensitive Data Terms as an additional contractual obligation.
Cross-platform context
See how other platforms handle Sensitive Data Terms and similar clauses.
Compare across platforms →"The HubSpot Sensitive Data Terms available at https://legal.hubspot.com/sensitive-data-terms are incorporated into this Agreement if you enable the Sensitive Data functionality in your HubSpot Account. To the extent specifically permitted under the HubSpot Sensitive Data Terms and subject to those additional terms, you may use the Subscription Services to collect, store, manage, or otherwise process information considered sensitive information under various regulations. You may not use the Subscription Service in a way that would violate local or industry-specific regulations (for example, the Children's Online Privacy Protection Rule consistent with the requirements of the Children's Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the Federal Information Security Management Act (FISMA), etc.).Excerpt from HubSpot's Terms of Service
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Organizations in healthcare, financial services, or those processing children's data must separately enable and accept the Sensitive Data Terms before using HubSpot to process regulated data categories; use of the standard Subscription Service for such data without enabling these additional terms is prohibited under the agreement.
The agreement prohibits processing of HIPAA-covered health information, COPPA-governed children's data, GLBA-regulated financial information, and FISMA-governed data through the standard Subscription Service. Customers who require such processing must enable the Sensitive Data functionality in their account, which triggers the Sensitive Data Terms as an additional contractual obligation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.