Privacy notice for the HubSpot integration

1. Who does what

The data we read from your HubSpot is yours: you are its controller. We act as a data processor under art. 28 GDPR — we process that data only on your behalf, to run the service, and for nothing else.

The processor can be reached at info@huntlog.xyz. A data processing agreement (DPA) is available on request.

2. What we read

Exactly what the permissions you authorise at connection cover, and not one field more:

• Deals: name, amount, stage, pipeline, close date, assigned owner, and the sede (branch) property where your portal has one.
• Deal owners: first name, last name, email, archived status.
• Portal users: first name, last name, email, whether they are administrators. Used to recognise who signs in and to suggest the right people to enable.
• Product catalogue: name, description, price, tax, SKU, image.
• Pipelines and stages: labels and order.
• Contacts and companies attached to a deal: read live only when someone opens that deal, and never stored.

We do not read emails, notes, calls, attachments, marketing data or your contacts' browsing data. The connection is read-only: we write nothing to your HubSpot.

3. What it is used for

• attributing each deal to the right branch and showing it only to those entitled to see it;
• composing and numbering quotes;
• diagnosing sync failures and helping you when you ask.

We do not use your data for profiling, we do not sell it, we do not pass it on for marketing, and we do not use it to train artificial-intelligence models.

4. Where it is, and for how long

Synced data is stored on servers in the European Union, in per-customer databases, and stays there as long as your account is active.

Disconnecting the portal stops the sync: data already downloaded and quotes already issued remain readable, because they are yours to consult. Ask us to delete them at info@huntlog.xyz and we do so within 30 days, confirming in writing. Backup copies are overwritten within the same period.

Server logs (IP addresses, request outcomes) are kept for as long as security and diagnosis require, and contain no credentials.

5. How it is protected

• Your portal's OAuth credentials are encrypted at rest and never appear in a page, a log or an application response.
• All traffic travels over HTTPS.
• Every query is bound to your account and, for branch managers, to their assigned branches: the separation is enforced by our code, not left to HubSpot's settings.
• Administrative access to the servers is limited to the people who operate the service.

6. Who else processes it

To deliver the service we rely on:

• HubSpot — the source of the data, your supplier before it is ours.
• Our hosting provider, for the servers the service runs on, in the European Union.
• Telegram — we get an internal notification when a new portal connects. It carries the portal name, its id and the email of whoever installed the app: no data about your contacts or your deals.
• Our transactional email provider, for service email (sign-in, account notices).

An up-to-date list of sub-processors, with their locations, is available on request together with the DPA.

7. Data subject rights

The people whose data appears in your CRM exercise their rights against you, because you are the controller. If you receive a request that concerns us — access, rectification, erasure — we help you act on it: write to info@huntlog.xyz.

For your own HuntLog account data (name, email, role) you can come to us directly, and you have the right to complain to the Italian data protection authority (garanteprivacy.it).

8. Data breaches

In the event of a breach affecting data processed on your behalf we inform you without undue delay, with the information you need to meet your own obligations towards the authority and the people concerned.

9. Changes

If something material changes — new data read, new sub-processors — we update this page and tell you by email.

Last updated: September 2026