Privacy Policy

Last updated: March 7, 2026

1. Introduction

This Privacy Policy describes how WF Hub Actions ("we", "us", "our") collects, uses, and protects information when you use our HubSpot application ("the Service").

2. Information We Collect

When you install and use the Service, we collect and store the following data:

  • OAuth Tokens — Access tokens and refresh tokens provided by HubSpot during the OAuth authorization flow. These are required to communicate with the HubSpot API on your behalf.
  • Portal ID (Hub ID) — Your HubSpot portal identifier, used to associate your installation with your account.
  • Workflow Action Data — Input data sent by HubSpot when a workflow action is triggered (e.g., contact properties mapped as variables). This data is processed in real-time and not stored after execution.

3. Information We Do NOT Collect

  • We do not collect or store your HubSpot contacts, deals, or other CRM data.
  • We do not track your browsing activity on our website.
  • We do not use cookies for advertising or analytics purposes.
  • We do not sell, rent, or share your personal information with third parties.

4. How We Use Your Information

  • OAuth Tokens — Used exclusively to authenticate API calls to HubSpot (e.g., sending workflow action callbacks). Tokens are automatically refreshed and old tokens are overwritten.
  • Portal ID — Used to look up the correct OAuth tokens for your installation.
  • Workflow Data — Processed in-memory to execute your custom code or send your configured webhook. Data is discarded immediately after the action completes.

5. Data Storage and Security

  • OAuth tokens are stored in a PostgreSQL database on our server.
  • All communication between our servers, HubSpot, and your browser is encrypted via HTTPS/TLS.
  • Custom code runs in an isolated sandbox process with strict memory and time limits.
  • We follow industry-standard security practices for server infrastructure.

6. Data Retention

  • OAuth tokens are retained as long as your app is installed. When you uninstall the app, tokens are deleted from our database.
  • Workflow execution data (inputs, outputs, code) is not stored. It is processed in real-time and immediately discarded.
  • Server logs may temporarily contain request metadata (timestamps, portal IDs, error messages) for debugging purposes and are automatically rotated.

7. Third-Party Services

The Service interacts with:

  • HubSpot API — To receive workflow action requests and send callbacks with results.
  • User-specified webhook URLs — When using the Send Webhook action, HTTP requests are sent to URLs configured by you. We are not responsible for the privacy practices of those third-party services.

8. Your Rights

  • You may uninstall the app at any time from your HubSpot portal settings, which will revoke our access and trigger deletion of your tokens.
  • You may request information about what data we hold for your portal.
  • You may request deletion of your data by contacting us.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app dashboard. Continued use of the Service constitutes acceptance of the updated policy.

11. Contact

For questions or concerns about this Privacy Policy, please contact us through the app dashboard or at the email address provided in the HubSpot App Marketplace listing.