Hubspot

The policy no longer displays a Last Modified date and appears to focus this update on Google/integration disclosures and the California disclosure, adding a Google Maps data-sharing section, a broadened reCAPTCHA description, and a new YouTube API data retention/deletion commitment.

• The previous opening line Last Modified: April 14, 2026 has been removed, so the new version no longer states a last-modified/effective date.
• In Section 8.2(iii), Internet or network information is now stated to be collected directly from your device or from emails sent through our platform; previously it said only directly from your device. This appears to expand the disclosed collection source for California consumers.
• Section 10.1 now says HubSpot has implemented Google reCAPTCHA Enterprise on our websites and products for security, fraud, and abuse prevention; the prior wording referred to certain products and services and to preventing malicious software ... abusive activities, so the stated scope and purposes appear broader.
• A new Section 10.3, Google Maps Integration, states HubSpot uses the Google Maps API for address autocompletion and validation, address inputs may be transmitted to Google to provide these features, and Google processes this data as an independent data controller under its own privacy policy and the Google Maps/Google Earth Additional Terms of Service. This appears to add a new data-use and data-sharing arrangement.
• A new Section 10.9.3, YouTube API Limits, states HubSpot complies with the YouTube API Services Developer Policies and that any stored public YouTube API data is refreshed or completely deleted within 30 calendar days, or deleted immediately upon user request. This appears to add a new retention/deletion commitment.
• The remaining differences appear non-substantive: the Google integration subsections are renumbered, several HubSpot Terms Tip cross-reference callouts were added, Markdown links were converted to plain URLs, and there are minor wording/typo changes such as the the Standard Contractual Clauses.

The document has changed from a page listing archived versions of the Terms of Service and DPA to the full text of the HubSpot Data Processing Agreement (DPA) dated April 14, 2026. This is a complete replacement with an entirely new set of obligations, rights, and definitions.

• Effective Date Added: The new version begins with "Last Modified: April 14, 2026" and introduces a DPA effective as of that date.
• Comprehensive Definitions Section: The previous version contained no definitions; the new version defines key terms such as "Customer Personal Data," "Data Protection Laws," "Standard Contractual Clauses," "CCPA," "Data Privacy Framework," and many others.
• Customer Responsibilities: The new DPA includes a detailed 'Customer Responsibilities' section (Section 2) requiring Customer to comply with Data Protection Laws, provide accurate instructions, and secure its own use of the service.
• HubSpot Obligations as Processor: Section 3 outlines HubSpot's obligations, including compliance with Instructions, security measures (detailed in Annex 2), confidentiality, breach notification (within 72 hours), and deletion/return of data on termination.
• Data Subject Requests: Section 4 describes how HubSpot will assist Customer in responding to data subject requests, with Customer bearing reasonable costs.
• Sub-Processor Provisions: Section 5 allows HubSpot to engage sub-processors, with a 30-day notice for changes and an objection mechanism. The previous version only listed archived DPA dates; now there is a full sub-processor regime referencing Annex 3.
• Data Transfers: Section 6 acknowledges global processing; Section 11 provides transfer mechanisms including the Data Privacy Framework and Standard Contractual Clauses (Modules One, Two, Three). The new version incorporates SCCs in detail with clauses for EU, UK, and Switzerland.
• Demonstration of Compliance: Section 7 grants Customer audit rights through SOC 2 reports, penetration test summaries, and written responses (once per year unless suspicion of non-compliance).
• California Provisions: Section 9 adds CCPA-specific terms, certifying HubSpot as a Service Provider, prohibiting sale or share of California Personal Information, and allowing audits.
• Controller-to-Controller Terms: Section 10 addresses processing of Controller Personal Data when using enrichment products and HubSpot Tracking Code, with mutual compliance obligations.
• Annexes Added: Three annexes are now included: Annex 1A and 1B detail processing for HubSpot as Processor and Controller respectively; Annex 2 lists security measures; Annex 3 references a sub-processor page.
• General Provisions: Section 12 covers amendments, severability, limitation of liability (subject to General Terms), and governing law.
• Parties and Permitted Affiliates: Section 13 allows Permitted Affiliates to be covered under the DPA with combined audit rights.

The previous version contained no such obligations, definitions, or annexes—it was merely an archive list.