← Back to Synchhub

Privacy Policy

Last updated: July 14, 2026

Synchhub ("we", "our") processes data on behalf of our customers to sync Slack Connect conversations into HubSpot. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

Data type	Purpose	Storage
Email address	Account login, billing communication	Stored in our database
Slack User OAuth Token	Read conversations from your Slack workspace	Encrypted at rest (AES-256/Fernet)
HubSpot Service Key / PAT	Write notes to your HubSpot portal	Encrypted at rest (AES-256/Fernet)
Slack message content	Sync to HubSpot as notes	Not stored — read from Slack, written to HubSpot directly
Slack user profiles	Resolve @mentions and identify participants	Not stored persistently
Sync metadata	Deduplication (prevent duplicate notes)	Thread IDs and HubSpot note IDs stored in database
Channel configuration	Know which channels to sync	Stored in our database

2. How We Use Your Data

We use your data solely to provide the sync service:

• Read messages from your selected Slack Connect channels
• Write those messages as notes in your HubSpot portal
• Associate notes to the correct companies, deals, and contacts
• Track what has been synced to prevent duplicates
• Send transactional emails (login links, service notifications)

We do not sell, share, or use your data for advertising, analytics, or any purpose other than providing the Service.

3. Legal Basis (GDPR)

We process your data based on:

• Contractual necessity — processing required to deliver the service you signed up for
• Legitimate interest — service improvement, security, fraud prevention

4. Subprocessors

The following third-party services process data on our behalf:

Service	Purpose	Location
Railway	Application hosting	EU/US
Neon	Database (PostgreSQL)	EU (Frankfurt)
Slack (Salesforce)	Message source API	US
HubSpot	CRM destination API	US/EU
Paddle	Payment processing	UK
Resend	Transactional email	US
Cloudflare	DNS, domain management	Global

5. Data Retention

• Active accounts: Data retained while your subscription is active
• Cancelled accounts: Configuration retained for 30 days, then permanently deleted
• Sync metadata: Deleted when your account is deleted
• Message content: Never stored — exists only in transit between Slack and HubSpot

6. Data Security

• API tokens encrypted at rest using Fernet (AES-128-CBC + HMAC)
• All connections over HTTPS/TLS
• Database access restricted, connection pooled
• Row-level security policies on database tables
• Signed session cookies with expiry

7. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your data ("right to be forgotten")
• Export your data (portability)
• Object to processing
• Withdraw consent at any time

To exercise these rights, email lucas.fatas@gmail.com.

8. Cookies

We use a single signed session cookie for authentication. We do not use tracking cookies, analytics cookies, or third-party cookies.

9. International Transfers

Some subprocessors are based in the US. Data transfers are protected by Standard Contractual Clauses (SCCs) as implemented by each subprocessor.

10. Changes

We will notify you by email of material changes to this policy at least 30 days in advance.

11. Contact

For privacy questions: lucas.fatas@gmail.com