Privacy Policy
Last updated: March 2026
SlyOrange ("we," "us," or "our") built the SlyOrange HubSpot Activity Tracker to help RevOps teams see who did what last — and which team they're on. This Privacy Policy explains what we collect, why, and what you can do about it.
What We Collect
When you install SlyOrange:
Your HubSpot portal ID
The email address of the person who authorized the app (from HubSpot's OAuth token)
OAuth access and refresh tokens (encrypted at rest)
Your HubSpot account domain and name
When SlyOrange processes activity:
Engagement event counts (how many calls, emails, meetings were processed)
Timestamp of the last processed event
Running monthly totals for billing purposes
What we do NOT collect:
The names, email addresses, or contact details of the people in your HubSpot CRM
The content of calls, emails, or meetings
Any data from HubSpot records beyond what's needed to write the three custom fields
Payment card information (handled entirely by Stripe)
How We Use It
We use the data we collect to:
Run the app (process webhooks, update your HubSpot properties, refresh tokens)
Calculate usage against your plan limits
Provide support when you contact us
Send billing-related communications via StripeWe do not sell your data. We do not use it for advertising.
How We Store It
OAuth tokens are encrypted at rest using AES-256 before being stored in our database
Data is stored in MongoDB Atlas on infrastructure hosted in the United States
Access to production data is restricted to authorized SlyOrange personnel only
Data Retention
We retain your data while your account is active.
If you uninstall SlyOrange from your HubSpot portal, your tokens are deleted immediately. Remaining portal data (usage counts, billing records) is deleted within 30 days of a written deletion request to kevin@slyorange.com.
Your RightsDepending on where you're located, you may have rights including:
Access: Ask what data we hold about your portal
Deletion: Request deletion of your portal's data
Portability: Request an export of your data
To exercise any of these rights, email kevin@slyorange.com. We'll respond within 30 days.
For GDPR-related deletion requests concerning contacts in your HubSpot CRM: SlyOrange does not store individual contact data. If you submit a contact data deletion through HubSpot, we receive and log that request but have no individual contact records to delete.
Third-Party Services
SlyOrange uses the following third-party services:
HubSpot — CRM integration via OAuth
Stripe — Payment processing. Stripe's privacy policy applies to payment data.
MongoDB Atlas — Database hosting
Render — Application hosting
Changes to This Policy
If we make material changes, we'll update the "Last updated" date above. Continued use of SlyOrange after changes means you accept the updated policy.
Contact
Questions? Email us at kevin@slyorange.com