Privacy policy: Kayabyte apps for HubSpot

Last updated: 16 October 2026

This policy explains what data the HubSpot apps published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), process when they are connected to a HubSpot account. Where an app processes data in a way this page does not cover, that app’s listing and documentation describe it, and this page is updated before the app is published.

Roles

For data in a HubSpot account (for example contacts, companies, deals, tickets and their properties), the account owner is the controller and Kayabyte acts as a processor that handles the data only to provide the app’s function.

How the apps connect

A HubSpot admin installs an app through HubSpot’s OAuth consent screen, which lists the permissions (scopes) the app requests. The app receives an access token for that account and uses the HubSpot APIs only within those scopes. App cards and settings pages run inside HubSpot; the app’s server-side logic runs on our own backend.

Data the apps read

• Account and installation details: the HubSpot account ID, the installing user’s name and email address, and OAuth tokens. These are used to provide the app, to contact the installer about the app, and to apply the plan the customer chose.
• Settings the admin enters in the app.
• CRM records an app needs for its function, such as the record a user has open or the records a workflow action runs on. Each app’s listing names the objects it reads and writes.

Data the apps store

An app stores only what its function requires, such as its configuration, OAuth tokens (encrypted at rest), schedules, logs of its own actions, and references to records (for example object IDs and timestamps). Apps do not keep copies of CRM records unless the app’s listing says so, and then only for as long as the function needs.

The apps do not use advertising, tracking or analytics services of their own and do not set cookies inside HubSpot.

Sub-processors

• Cloudflare, Inc.: hosting of the apps’ backend and storage.
• Stripe, Inc.: payment processing for paid plans (we do not receive or store card details).

Retention and deletion

Data is kept while the app is installed. When an app is uninstalled, its tokens are revoked and the data it stored for that account is deleted within 30 days. Customers can ask for deletion at any time at support@kayabyte.dev. A data processing agreement is available on request.

Access

Only the apps’ own code accesses account data. Kayabyte does not sell, share or use account data for any other purpose, and does not use it to train AI models.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page if our data handling changes. The date at the top shows the latest version.