Privacy Policy

Last updated: [DATE] · Applies to: Stripe Subscriptions & Invoices and other Product Factory HubSpot integrations

Draft — not yet reviewed by a lawyer This is placeholder legal text generated to complete the page structure, written with GDPR-style concepts in mind given Product Factory's Amsterdam base, but it should not be treated as binding, published live, or relied on for the HubSpot Marketplace listing until a qualified lawyer has reviewed it against the actual data flows, subprocessors and legal entity involved.

1. What this covers

This policy explains what data Product Factory for Scaleups ("Product Factory", "we") accesses, stores and processes when you use one of our HubSpot integrations, and why.

2. Data we access

What's accessed depends on the specific integration you use. For Stripe Subscriptions & Invoices, that means:

From Stripe: subscription records, invoice records, and customer records (name, email, subscription status, invoice amounts and dates) — read-only, via a restricted API key you provide.
From HubSpot: contact records the integration matches to Stripe customers, which it reads and updates with subscription/invoice information — via a private app token you provide.
Account data: the login email and name of people your organization invites to the integration's admin console.

We don't access more than an integration's page describes, and we don't request write access to Stripe — it's a read-only connection in every case.

3. Why we process this data

Solely to provide the integration's core function: matching Stripe billing data to the right HubSpot contact and keeping it current, on the schedule you configure. We don't use your data for any other purpose.

4. Where data is stored

Synced data is stored in a database on infrastructure we operate (currently hosted on Hetzner, within the EU). We don't currently commit to a specific data residency guarantee beyond that — worth confirming your own requirements with us directly if that matters for your organization.

5. Who else sees it

We don't sell your data or share it with third parties for marketing. A small number of subprocessors support the service itself — for example, our hosting provider, and Brevo for sending account-related emails (like invite links). We'll keep this list current as the service grows.

6. How long we keep it

Synced data is kept for as long as your integration is active. If you disconnect or your pilot access ends, we'll delete the data we hold on your behalf within a reasonable period — [SPECIFY TIMEFRAME once finalized, e.g. 30 days] — except where we're required to retain it for legal reasons.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export or request deletion of data we hold about you or your organization's contacts. Contact us at hello@product-factory.com and we'll action it directly.

8. Security

Credentials (API keys, tokens) are stored encrypted and are never exposed in logs or shared outside the service. Access to the admin console requires a login, and we scope requested API permissions to the minimum the integration needs.

9. Changes to this policy

We may update this policy as the product evolves. We'll post the updated version here with a new "last updated" date, and will tell active pilot customers directly about material changes.

10. Contact

Questions about this policy or your data: hello@product-factory.com.