Privacy and data: Paddle Sync

Last updated: 11 November 2026

This page adds the details for Paddle Sync to the privacy policy of Kayabyte apps for HubSpot. Kayabyte is the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway. For the customer data in your HubSpot and Paddle accounts you are the controller and Kayabyte is the processor. Paddle Sync is not affiliated with Paddle.com. Paddle is the payment provider you chose; it is not our sub-processor, and the data flows from it to the app.

What the app reads

From Paddle, with the API key you provide: customers (ID, email, name, and one custom data key if you set a company key), subscriptions (status, items, prices, quantities, discounts, billing dates, scheduled changes), transactions (status, amounts, currency, dates) and, from webhooks, adjustments such as refunds. From HubSpot: contacts (found by email, and the Paddle properties), companies (found by domain or name, and the Paddle properties), deal pipelines and stages, and owners (name, email, user ID).

What the app stores

• Paddle connection: the environment (sandbox or live), your Paddle API key and the webhook endpoint secret, both encrypted, the last four characters of the key, and the ID of the notification destination in Paddle.
• Customers: Paddle customer ID, email, name, the company custom data value if you configured one, the HubSpot contact and company IDs, first payment date, last failed payment date and lifetime value per currency.
• Subscriptions: ID, customer, status, plan name, currency, MRR, ARR, billing interval, quantity, billing and trial dates, scheduled cancellation, and the ID of the deal if deals are on.
• Transactions: for the last 12 months, ID, customer, subscription, status, amount net of discount and tax, currency and date.
• Raw Paddle events: the full webhook payloads, kept so events are not processed twice and can be replayed. They contain customer details.
• Notes waiting to be written to the HubSpot timeline.
• Account details, encrypted OAuth tokens, the installing user’s email, app admins’ HubSpot user IDs, a hash of the last values written to each record, short-lived caches of pipelines and owners, the last 50 job results, and billing records for paid plans, in our database and at Stripe.

We do not read or store card numbers or bank details. Paddle handles payments and we only see the amounts and statuses it reports.

Retention

• Raw Paddle events: 14 days, then deleted. They are also deleted when you disconnect Paddle.
• Synced customers, subscriptions and transactions: kept until you disconnect and choose to delete the Paddle data, or uninstall the app. Uninstalling deletes everything the app stored for your account. After an uninstall in HubSpot, the app normally learns of it within an hour and deletes the data then.
• Notes that have waited more than 30 days to be written to HubSpot (for example for customers who have no synced subscription) are deleted.
• Install record without tokens (account ID, plan) and licence record: 30 days after uninstall. The record that a trial was used is kept until about 13 months after the trial ended, so a reinstall does not give a second trial.
• Counts of API calls and install sources (no account or personal data): 90 days. Stripe keeps billing records as the law requires.

The properties, notes and deals the app wrote stay in your HubSpot account, under your control.

Email

Paddle Sync sends no email. Notifications are made by your own HubSpot workflows.

Who sees what

Everyone in your HubSpot account who can open the Paddle cards sees the subscription data of that contact or company, whatever their HubSpot record permissions. Only app admins manage the connection, the matching rules and the plan. The settings page shows the webhook address to every user who can open it; it is protected by the signature check described on the security page.

Sub-processors

See sub-processors: Cloudflare (hosting, database) and Stripe (our own billing).

Your rights and questions

support@kayabyte.dev. We don’t sell data, share it, use it for advertising or use it to train AI models.