Privacy notice
Effective July 17, 2026.
Two kinds of data, one clear line
HS-X is built around a split that matters for privacy: the control plane (our infrastructure — accounts, projects, deploys) and your runtime (your Cloudflare account — where your apps actually run). We hold control-plane data. Runtime data — portal records, sync state, end-user information your apps process — lives in your Cloudflare account and never touches HS-X infrastructure.
What we collect
- Account data — your email address (used for magic-link sign-in) and account/organization names you choose.
- Connection credentials — OAuth tokens for HubSpot and least-privilege deployment credentials for Cloudflare, stored encrypted and scoped to what deploys require.
- Project metadata — project names, configuration, deploy history, and audit events (who did what, when).
- Operational telemetry — logs and error reports from the hosted platform itself, used for reliability and security.
- Billing data — if you buy a paid plan, our payment processor handles your payment details; full card numbers never touch HS-X.
- Support — anything you send us at hi@hs-x.dev.
What we deliberately don't hold
Your CRM records, the people in your HubSpot portals, sync payloads, and agent invocation data are processed by your runtime in your Cloudflare account. HS-X does not store, read, or sell that data. If you delete your HS-X account, that runtime keeps working and its data stays where it always was — yours.
We also don't run advertising, don't sell personal data to anyone, and don't use third-party analytics trackers on the dashboard.
How we use what we collect
- Signing you in (magic-link emails) and keeping your session working.
- Running deploys and syncs you request against HubSpot and Cloudflare.
- Showing you your own audit history and platform activity.
- Security: detecting abuse, investigating incidents.
- Service email: sign-in links, billing notices, material changes.
Where data lives and who touches it
The control plane runs on Cloudflare (hosting, storage, and email delivery for magic links). If you buy a paid plan, billing runs through a PCI-compliant payment processor. We share data with no one else except as required by law, and we'll tell you if that happens unless legally barred.
Retention and deletion
We keep control-plane data while your account is active. When you delete your account, stored HubSpot and Cloudflare credentials are revoked immediately and your control-plane data is deleted within 30 days, except minimal records we're legally required to keep (such as billing history). You can disconnect either provider at any time without deleting your account.
Cookies
The dashboard uses a single first-party session cookie to keep you signed in. No advertising or cross-site tracking cookies.
Access, export, delete
You can access and change your account data from the dashboard, and delete your account from settings. For an export of your control-plane data, or to exercise rights under laws like the GDPR or CCPA (access, correction, deletion, portability, objection), email hi@hs-x.dev and we'll respond within 30 days.
How it's protected
Data is encrypted in transit and at rest. Provider credentials are stored scoped to least privilege — enough to provision and update your runtime, nothing more. Sign-in links expire after 10 minutes and are single-use.
Children and changes
The service is not directed at children under 16, and we don't knowingly collect their data. If we change this notice materially, we'll email account holders before the change takes effect and update the date at the top of this page.
Questions or requests: hi@hs-x.dev.