HubSpot

HubSpot says third-party AI providers immediately delete data after LLM processing.

HubSpot says customer data is yours and used only as permitted in customer terms and privacy materials.

Super admins and governance tooling let organizations decide how broadly AI features are used in the CRM.

HubSpot publishes AI trust and safety documentation instead of treating AI processing as invisible product plumbing.

HubSpot AI features can still process CRM and customer context to generate outputs.

Connected inboxes and CRM integrations can pull more customer context into the AI surface than a narrow prompt-only tool would.

CRM connectors, inbox sync, integrations, and service providers still create additional data flows.

Marketing, support, and operational vendors can still receive data depending on account setup and workflow design.

HubSpot provides AI trust, security, privacy, and trust-center documentation for enterprise review.

HubSpot says data stored in the product is the customer's data, protected under customer terms.

SSO, super-admin roles, and content-access controls help organizations narrow who sees CRM data.

HubSpot's business model still includes marketing, analytics, CRM tracking, and behavioral measurement contexts.

Connected inboxes, site tracking, and automation features can capture broad engagement data across channels.

HubSpot supports customizable cookie-consent banners across regions.

Lawful-basis tracking and subscription settings are built into the CRM privacy toolset.

Admins can govern tracking and messaging consent more centrally than in scattered single-purpose marketing tools.

HubSpot's GDPR delete feature permanently deletes record data.

HubSpot supports automated deletion policies for inactive contacts.

HubSpot provides export paths so customers can back up and manage their own content and data.

Deleted inactive contacts can remain restorable from the recycling bin for 90 days.

Backups, connected systems, and account context can still keep some data longer than the main record lifecycle suggests.

Important controls are still admin-led and depend on subscription, permissions, and account setup.

The broad CRM and marketing feature set makes it easy to create new data flows unless admins actively govern them.

Super admins can configure privacy tools, retention, and AI-related settings.

SSO and access controls let organizations govern who reaches HubSpot-hosted content.

Consent tracking, lawful-basis controls, and subscription settings are built into the platform.

HubSpot documents export and privacy-rights workflows instead of relying only on support tickets.