Monitored company
Hubspot
clause.watch tracks 2 legal documents published by Hubspot, re-reading each one every six hours. Below is what each document covers, in plain English.
Legal Stuff
Privacy Policy
HubSpot Privacy Policy: User-Friendly Overview
*Policy last modified: April 14, 2026. This summary is informational and not legal advice.*
1. Data Collection & Usage
HubSpot may collect:
- Identity and business information: name, email, phone number, address, job title, company, and account details.
- Payment information: billing details and financial information, processed through third-party payment providers.
- Usage and technical data: IP address, browser, device, operating system, log-in activity, viewed pages, product features used, and workflow activity.
- Website and tracking data: cookies, pixels, web beacons, online identifiers, and information collected through HubSpot tracking code installed on customer websites.
- Information from other sources: public websites, social media, partners, customers, affiliates, and third-party providers.
- Integration data: information from connected services such as Gmail, Google Calendar, Drive, YouTube, and other applications.
HubSpot uses this information to:
- Provide, authenticate, support, and bill for its services.
- Improve and develop its products, communications, and AI features.
- Detect fraud, security incidents, abuse, and policy violations.
- Send marketing, promotional, event, and product communications.
- Personalize advertising and recommendations.
- Create and operate a commercial dataset of professional/business contact information for enrichment products.
A significant risk is that HubSpot may process data about professionals obtained indirectly from public or third-party sources and make it available to HubSpot customers for sales and marketing.
HubSpot generally retains data while it has a legitimate business, legal, or contractual need. It may delete, anonymize, or isolate data when no longer needed, but no fixed retention schedule is provided.
2. User Rights
Depending on location, users may request:
- Access, correction, updating, deletion, or portability of personal data.
- Restriction of or objection to processing.
- Withdrawal of consent.
- Opt-out from marketing, personalized advertising, and certain data sharing.
- Removal from HubSpot’s commercial dataset.
- Appeal of a denied privacy request.
- Non-discrimination for exercising privacy rights.
Requests can be made through HubSpot’s privacy request or preference forms, or by emailing privacy@hubspot.com. Identity verification may be required, and legal exceptions may permit HubSpot to refuse or limit a request.
If HubSpot processes data on behalf of one of its customers, the customer—not HubSpot—is generally the data controller. Users should contact that customer directly.
California residents have additional CCPA rights, including access, deletion, correction, information about disclosures, and opting out of “sale” or “sharing.” The policy states that some data may be “sold” or “shared” with advertising partners and HubSpot customers using enrichment products.
3. Third-Party Sharing
HubSpot may share data with:
- Hosting, payment, analytics, marketing, support, and security providers.
- HubSpot affiliates, partners, co-marketing partners, and Marketplace providers.
- Advertising networks for personalized advertising.
- Customers using HubSpot enrichment products.
- Authorities when legally required or when necessary to protect rights, safety, or security.
- A successor company in a merger, acquisition, bankruptcy, or asset sale.
Connected integrations may receive broad access. For example, Gmail integration may read, store, modify, create, and send emails; Calendar may modify calendars and events; Drive may access and upload documents. HubSpot disclaims responsibility for third-party integration practices.
Data may be transferred internationally using contractual safeguards, including Standard Contractual Clauses and the Data Privacy Framework.
4. AI/ML Training
Yes. HubSpot states that it may use personal data processed through its products to develop, support, improve, and train AI models and machine-learning products. It does not clearly promise that customer data is always excluded or fully anonymized before such use.
However, HubSpot specifically states that Google Workspace API data is not used to develop, improve, or train generalized AI/ML models. Aggregated, non-identifying statistics may also be published externally.
5. Key User Obligations and Restrictions
Users and customers must:
- Review and control permissions granted to third-party integrations.
- Avoid posting sensitive information in public forums; posts may remain after account termination.
- Comply with HubSpot’s Acceptable Use Policy and anti-spam rules.
- Include legally required opt-out mechanisms in emails.
- Obtain required notices and consents before transferring personal data to HubSpot.
- Avoid using the service for unlawful, abusive, or unsolicited commercial communications.
Violations may result in suspension or termination.
6. Liability & Disputes
This privacy policy itself contains limited liability terms and does not provide a comprehensive damages cap, warranty disclaimer, or governing-law clause. Those terms are incorporated from the HubSpot Customer Terms of Service and related agreements.
For EU, UK, and Swiss individuals relying on the Data Privacy Framework, unresolved complaints may ultimately qualify for binding arbitration after specified procedures are exhausted. Lawful government disclosures may still occur.
7. Changes
HubSpot may update the policy periodically and encourages users to review it. Changes will be posted on the privacy-policy webpage. For material changes, HubSpot says it will provide direct notice, such as email. Cookie practices may also change through updates to the separate Cookie Policy without additional notice.
Change history
2026-10-20 · Privacy Policy
2026-10-19 · Privacy Policy
2026-10-17 · Privacy Policy
2026-10-14 · Privacy Policy
Summary
The supplied diff does not include the text of the approximately 200 words that were added. Because the actual language is missing, it is not possible to reliably identify:
- Changes to the parties’ rights or obligations
- New fees, liability provisions, warranties, or termination rights
- Changes to confidentiality, security, or data protection obligations
- Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
- Whether data is shared with affiliates, vendors, or third parties
- Whether the customer can opt out of AI training or request deletion of training data
- Whether the provider obtains ownership or broad usage rights in customer content
- Any new compliance, indemnity, audit, or dispute-resolution risks
AI Training and Data-Use Review
No conclusion can be reached regarding AI-model training because the added contractual language itself was not provided. The key provisions to check for include whether the provider may:
1. Use customer data, prompts, outputs, or usage metadata to train or improve models.
2. Use data for “service improvement,” “research,” analytics, benchmarking, or product development—terms that may functionally include AI training.
3. Retain data after termination or use aggregated, de-identified, or pseudonymized data indefinitely.
4. Share customer data with subprocessors or model providers.
5. Claim ownership, a broad license, or unrestricted rights to customer content or derived data.
6. Offer an opt-out, enterprise exclusion, or deletion mechanism, and whether it applies prospectively only.
7. Use customer data to train general-purpose models whose outputs may benefit other customers.
Required Information
Please provide the actual added text and, if applicable, the surrounding clauses or redlined version. The placeholder “Added approximately 200 words to the document” is not sufficient to perform a legal or risk analysis.
2026-10-14 · Privacy Policy
Summary
The diff states only that approximately 199 words were removed from the document. The actual deleted language is not provided.
Key Legal and Commercial Implications
- Unable to assess substantive changes: Without the text that was removed, it is not possible to determine whether the deletions affect:
- Customer rights or obligations
- Provider liability, warranties, or indemnities
- Termination or suspension rights
- Confidentiality and security obligations
- Data ownership or licensing
- Audit, compliance, or regulatory terms
- Pricing, renewal, or service levels
- AI training and data use: The available diff does not identify whether customer data may now be used to train, fine-tune, evaluate, or improve AI models. The removed language could have:
- Prohibited training on customer data
- Required customer consent or opt-out
- Limited use to providing the services
- Required anonymization or aggregation
- Addressed ownership of inputs, outputs, or derived data
- Imposed deletion, retention, or confidentiality requirements
- Potential risk from deletion: If the deleted provisions contained restrictions on data use, their removal could expand the provider’s ability to use customer data. Conversely, the deleted language may have been permissive or protective of the provider. The direction and significance of the change cannot be determined from the word-count description alone.
Conclusion
A reliable legal analysis requires the actual deleted text, ideally together with the surrounding unchanged provisions. Based on the information supplied, no definite conclusion can be reached about changes to AI-model training or any other customer rights.
2026-10-13 · Legal Stuff
No
2026-10-13 · Legal Stuff
No
2026-10-13 · Privacy Policy
Summary of Important Changes
Overall assessment
The diff appears to affect only the website’s cookie-consent banner and contains substantial apparent formatting, tracking-code, or extraction corruption. It does not show a substantive change to HubSpot’s privacy policy, data-processing terms, or customer-data rights.
Key changes
1. Cookie-banner text and controls
- “We” appears to have been changed to
×closeWe, suggesting that a close-button label or UI element was inserted into the text. - “Cookiesword” was changed to “Cookies.”
- A very large block of repeated placeholder-like text and character strings was deleted, including repeated sequences such as:
mmMwWLliI0fiflO&1- Repeated “word” entries
These changes appear technical or editorial rather than legal. They may reflect removal of corrupted HTML, accessibility text, tracking parameters, or cookie-banner configuration data.
2. Consent options remain substantively the same
The visible cookie choices remain:
- Accept all
- Decline all
- Manage Cookies
No change is apparent to the scope of consent, the categories of cookies, retention periods, third-party sharing, or the ability to withdraw consent.
AI-model training and customer data
No language in the supplied diff addresses:
- Whether customer data may be used to train, fine-tune, or improve AI models;
- Whether prompts, inputs, outputs, or telemetry may be retained for AI development;
- Whether HubSpot or its service providers may use customer content for product improvement;
- Opt-out rights or controls relating to AI training;
- De-identification, aggregation, or human review of customer data for AI purposes.
Accordingly, this diff shows no identifiable change—favorable or unfavorable—to HubSpot’s AI-training rights or restrictions. The relevant privacy-policy or product terms should be reviewed separately if AI-data use is a concern.
Risks and recommended follow-up
- The diff is too malformed to confirm whether any underlying cookie-policy language was changed.
- The insertion of
×closeand deletion of repeated strings could cause user-interface, accessibility, or consent-recording problems if reflected in the live site. - Confirm that “Decline all” works as intended and that non-essential cookies are not set before consent.
- Compare the underlying HTML or policy source, rather than the extracted diff, to verify that no substantive privacy terms were accidentally omitted.
2026-10-12 · Legal Stuff
2026-10-12 · Privacy Policy
Summary of Changes
1. Large New Addition in Cookie-Notice Area
- The diff adds a very large block of repeated placeholder text—“word”—followed by a repeated alphanumeric string.
- The addition appears immediately after cookie-consent language (“Accept all,” “Decline all,” and “Manage Cookies”).
- This does not appear to be a substantive contractual provision. It may be:
- Accidental content or corrupted text;
- A testing or placeholder string;
- An injection or tracking-related payload; or
- Malformed consent-banner content.
2. Legal and Operational Risks
- Clarity and enforceability: The added material is unintelligible and could create ambiguity about what the customer is agreeing to.
- Cookie consent integrity: If this content is part of the consent mechanism, it could undermine the transparency and informed-consent requirements commonly applicable to cookies and similar technologies.
- Security and integrity review: The repeated string should be investigated to determine whether it is executable, a tracking identifier, a hidden parameter, or otherwise capable of affecting website behavior.
- Regulatory exposure: An unclear or defective cookie notice may create privacy-law risk, particularly if cookies are deployed before valid consent or if the notice fails to explain purposes, providers, retention, or user choices.
- Document-control concern: The addition may indicate an unauthorized or accidental modification to the legal notice and should be verified against the approved source version.
3. Customer Data and AI Model Training
- No express change identified. The diff does not add, remove, or modify language concerning:
- Use of customer data to train, fine-tune, or improve AI models;
- Whether customer inputs or outputs are retained or reviewed;
- Use of data for service improvement or product development;
- Opt-out rights or restrictions on AI training; or
- Ownership, confidentiality, or de-identification of customer data.
- The repeated text does not constitute a clear authorization to use customer data for AI training. It should not be interpreted as consent for that purpose.
Recommended Action
Confirm whether the added block is intentional. If not, remove it and review the cookie-consent implementation, source-control history, and relevant privacy disclosures for unauthorized changes.
2026-10-11 · Privacy Policy
No
2026-10-10 · Legal Stuff
2026-10-09 · Legal Stuff
2026-10-02 · Privacy Policy
No
2026-10-01 · Privacy Policy
2026-09-30 · Legal Stuff
2026-09-30 · Privacy Policy
2026-09-29 · Legal Stuff
2026-09-27 · Legal Stuff
2026-09-27 · Legal Stuff
2026-09-24 · Legal Stuff
2026-09-23 · Legal Stuff
2026-09-21 · Legal Stuff
2026-09-21 · Legal Stuff
2026-09-20 · Legal Stuff
2026-09-20 · Legal Stuff
2026-09-12 · Legal Stuff
No
2026-09-11 · Legal Stuff
2026-09-10 · Privacy Policy
Summary
The provided diff does not include the actual added contractual language. It only states:
> “Added approximately 116 words to the document”
Without the text of those additions, it is not possible to reliably identify:
- Changes to customer data rights or permitted uses
- Whether customer data may be used to train, fine-tune, or evaluate AI models
- Whether data may be shared with affiliates, vendors, or model providers
- Any new consent, opt-out, confidentiality, retention, or deletion provisions
- Changes to intellectual-property ownership or rights in model outputs
- New security, compliance, indemnity, or liability obligations
- Whether the added terms apply retroactively or to previously collected data
AI Training-Related Risks
No conclusion can be reached regarding AI-model training because the relevant contractual language is missing. In particular, the diff does not reveal whether the contract:
- Authorizes training on customer content, prompts, inputs, outputs, or usage data
- Permits use of data to improve products or services
- Allows human review or annotation of customer data
- Uses data in aggregated, de-identified, or identifiable form
- Allows data to be transferred to third-party AI providers
- Provides an opt-out or deletion mechanism
- Limits training to specified models, purposes, or geographic regions
Required Information
Please provide the actual 116-word addition, using the stated notation:
{added text}[deleted text][]{replacement text}
Once the substantive language is provided, it can be reviewed for legal effect and specific risks, particularly those concerning AI training and customer-data use.
2026-09-08 · Legal Stuff