Privacy Policy

1. Information We Collect

Account information: When you create an account, we collect your email address, name (optional), and password (hashed). If you sign in with Google, we receive your Google profile information.

HubSpot data: When you connect a HubSpot portal, we receive OAuth tokens that allow us to access your CRM data. We access only the data necessary to perform search and replace operations you initiate.

Operation logs: We store records of search and replace operations, including the search pattern, replacement value, and affected record IDs, to enable rollback and audit functionality.

Signup attribution: We store the first landing page, referring page, and campaign parameters associated with a signup so we can understand which acquisition sources lead to product use. This first-party attribution is separate from optional analytics cookies.

2. How We Use Your Information

We use your information to: (a) provide and maintain the Service; (b) authenticate your identity; (c) execute search and replace operations on your behalf; (d) enable rollback of previous operations; (e) send transactional emails (password reset, email verification); and (f) measure signup, activation, and subscription outcomes so we can improve the Service.

3. Data Security

Passwords are hashed with bcrypt. HubSpot OAuth tokens are encrypted at rest using AES-256-GCM. Session cookies are encrypted and HTTP-only. All data is transmitted over HTTPS in production.

4. Data Retention

Account data is retained until you delete your account. Operation logs and snapshots are retained to support the rollback feature. When you delete your account, all associated data is permanently removed.

5. Third-Party Services

We integrate with: (a) HubSpot — to access and modify authorized HubSpot data; (b) Google— for optional sign-in and, only after consent, website analytics through Google Tag Manager; (c) Postmark — for transactional email delivery; and (d) Stripe — for paid subscriptions. These services have their own privacy policies.

6. Your Rights

You can: (a) access your account data via the Settings page; (b) disconnect HubSpot portals at any time; (c) delete your account and all associated data; (d) request information about your data by contacting us.

7. Cookies

We use essential cookies for session management and CSRF protection. Optional Google analytics tags load only after you select Accept in the cookie notice. If you decline, those analytics tags are not loaded. We do not use advertising cookies.

8. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice.