Privacy Policy

Last updated: 2026-10-22

1. Introduction & Data Controller

Exelab SRL ("we", "us", "our") operates PluSync, a HubSpot connector platform available atplugsync.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website or use our Service.

For the purposes of the EU General Data Protection Regulation (GDPR), Exelab SRL is thedata controller for personal data relating to website visitors and customer accounts. When processing customer CRM data that flows through the sync engine, we act as adata processor on behalf of our customers.

Data Controller:
Exelab SRL
VAT: IT08990591003
Italy
Email: privacy@plugsync.com

2. Data We Collect

We collect and process different categories of personal data depending on how you interact with us:

2.1 Website Visitors

When you visit our website, we automatically collect certain technical information through Google Analytics and HubSpot tracking code, including:

  • IP address
  • Browser type and version
  • Operating system
  • Pages visited and time spent on each page
  • Referral source (the website or link that directed you to us)
  • Device information (screen resolution, device type)
  • Approximate geographic location (derived from IP address)

2.2 Contact Form

When you send us a request through the contact form on our website, we collect the information you enter: your name, email address, company name and, if you write one, your message. If you tick the optional box to receive news and product updates by email, we also record that choice and the time you made it.

Together with the request we store information about how you reached the site during that visit:

  • Campaign parameters: the values of utm_source, utm_medium, utm_campaign, utm_term and utm_content, when the link that brought you to the site contained them. They describe the campaign (for example the source, the medium and the campaign name) and do not identify you.
  • Landing page and form page: the path of the first page you opened during the visit and the path of the page from which you sent the form.
  • Google Ads click identifier (gclid): an advertising identifier that Google adds to the link when you arrive from one of our ads. We keep it and attach it to your request only if you have accepted the marketing category of the cookie banner. See Section 7.3.

The contact form transmits this information only when you submit it: until then it stays in your browser. It is sent to our systems together with your request. We use it to understand which campaigns and pages lead to contact requests.

2.3 Customers

When you create an account and use our Service, we collect:

  • Name and email address
  • Company name
  • HubSpot portal ID
  • OAuth credentials (encrypted at rest using Fernet symmetric encryption)
  • Connector configurations (sync rules, field mappings, scheduling preferences)
  • Usage data, including sync operation counts, error rates, and feature usage patterns

2.4 Customer Contacts (Processed as Data Processor)

As part of providing the sync engine, we process CRM data on behalf of our customers. This may include contacts, companies, deals, and custom objects that flow through the PluSync sync engine. This data is processed solely on behalf of and under the instructions of our customers, who remain the data controllers for their CRM data.

3. How We Use Data

We use the personal data we collect for the following purposes:

  • Provide and maintain the Service: operate the PluSync platform, process your requests, and deliver the sync functionality you have configured
  • Process and sync data: execute data synchronization operations between your systems and HubSpot according to your connector configurations
  • Monitor performance and reliability: track service health, uptime, error rates, and sync pipeline performance to ensure reliable operation
  • Provide customer support: respond to your inquiries, troubleshoot issues, and assist with configuration
  • Send service-related communications: notify you about service updates, maintenance windows, security alerts, and important changes to your account or our terms
  • Analyze usage patterns: understand how customers use the platform to improve features, user experience, and product roadmap decisions
  • Ensure security and prevent fraud: detect and prevent unauthorized access, abuse, and fraudulent activity
  • Comply with legal obligations: fulfill our obligations under applicable laws, including tax, accounting, and regulatory requirements
  • Respond to contact requests: follow up on the requests you send us through the contact form on our website
  • Measure our campaigns: understand which campaigns and pages lead to contact requests

4. Legal Basis for Processing (GDPR Article 6)

We process personal data under the following legal bases as defined in Article 6 of the GDPR:

  • Consent (Art. 6(1)(a)): We rely on your consent for the use of cookies and tracking technologies on our website. You may withdraw your consent at any time by adjusting your browser settings or using the opt-out mechanisms described in Section 7. We also rely on your consent, given through the marketing category of the cookie banner, to save the Google Ads click identifier (gclid) and attach it to a contact request. You can withdraw it at any time from the "Cookie preferences" link in the footer of every page.
  • Contract performance (Art. 6(1)(b)): Processing is necessary for the performance of our contract with you, including customer account creation and management, service delivery, connector configuration, and data synchronization operations.
  • Legitimate interest (Art. 6(1)(f)): We process certain data based on our legitimate interests, including website analytics to understand visitor behavior, security measures to protect our platform and users, and product improvement based on aggregated usage patterns. We carefully balance these interests against your rights and freedoms. We also rely on our legitimate interest in measuring the effectiveness of our campaigns to associate the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the landing page and the form page with a contact request.
  • Legal obligation (Art. 6(1)(c)): Processing is necessary to comply with legal obligations to which we are subject, including Italian tax law, accounting regulations, and other applicable regulatory requirements.

5. Data Processing Role

Our role in data processing depends on the type of data involved:

  • Data Controller: We act as the data controller for website visitor data (analytics, cookies, tracking, contact form requests) and customer account data (registration information, billing details, usage metrics). We determine the purposes and means of processing this data.
  • Data Processor: We act as a data processor for CRM data that flows through the PluSync sync engine. This data is processed strictly in accordance with our customers' instructions as defined by their connector configurations. We do not use this data for our own purposes.

A Data Processing Agreement (DPA) is available upon request for enterprise customers. Please contact privacy@plugsync.com to obtain a copy.

Our customers remain the data controller of their CRM data at all times and are responsible for ensuring they have a lawful basis for the collection and processing of personal data that they transmit through PluSync. Customers must ensure that appropriate privacy notices have been provided to data subjects and that any necessary consents have been obtained before transmitting personal data through the Service.

6. Third-Party Services

We use the following third-party services to operate and improve PluSync. Each provider has been assessed for adequate data protection standards:

  • Google Analytics — Purpose: website analytics and visitor behavior tracking. Data location: USA. Safeguards: Standard Contractual Clauses (SCCs) as approved by the European Commission.
  • HubSpot — Purpose: CRM platform integration and website tracking. Data location: USA. Safeguards: Standard Contractual Clauses (SCCs) as approved by the European Commission.
  • Amazon Web Services – Purpose: cloud infrastructure that hosts the Service (application, API, background workers, databases and storage). Data location: EU (Frankfurt, Germany). Safeguards: Service data is hosted in the AWS EU region in Frankfurt.

7. Cookies

Our website uses cookies and similar tracking technologies to collect information about your browsing activity. Below is a summary of the cookies we use:

7.1 Analytics Cookies (Google Analytics)

  • _ga — Distinguishes unique visitors. Expiry: 2 years.
  • _gid — Distinguishes unique visitors. Expiry: 24 hours.
  • _gat — Throttles request rate to Google Analytics. Expiry: 1 minute.

7.2 Marketing and Tracking Cookies (HubSpot)

  • __hstc — Tracks visitor identity and session information. Expiry: 6 months.
  • hubspotutk — Tracks visitor identity for HubSpot form submissions. Expiry: 6 months.
  • __hssc — Tracks session data (pages viewed, session duration). Expiry: 30 minutes.
  • __hssrc — Determines whether the visitor has restarted their browser. Expiry: session (deleted when browser is closed).

7.3 Session Storage (Campaign Data)

Besides cookies, our website uses the browser's session storage (sessionStorage) to remember how you reached the site, so that this information can be attached to a contact request (see Section 2.2). Session storage belongs to a single browser tab and is cleared by your browser when you close that tab.

  • Campaign parameters and landing page: saved on the first page you open during a visit, whatever your choice in the cookie banner, and not overwritten on later pages. The contact form transmits them only when you submit it.
  • gclid: saved only if the marketing category is accepted when you arrive, or if you accept it while you are still on the page you arrived on. Before consent we only note that the link contained one, not its value. Without consent it is neither saved nor attached to a contact request. If you withdraw your consent, it is removed from session storage. An identifier already sent with an earlier request stays with that request until the request is deleted (see Section 8).

7.4 Managing Cookies

On your first visit a cookie banner lets you accept all optional cookies, reject them all, or choose by category (statistics, marketing). Statistics and marketing cookies are not set until you give your consent. You can change or withdraw your choice at any time from the "Cookie preferences" link in the footer of every page. Your choice is stored for 6 months in a strictly necessary first-party cookie (cc_cookie).

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling cookies may affect the functionality of our website and your user experience.

To opt out of Google Analytics tracking specifically, you can install theGoogle Analytics Opt-out Browser Add-on.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Our retention periods are as follows:

  • Website analytics data: 26 months (the default Google Analytics retention period).
  • Contact form requests: 12 months from the date of the request, after which they are deleted. The campaign data stored with a request (campaign parameters, landing page, form page and, where present, gclid) is kept for the same period.
  • Customer account data: retained for the duration of your active service, plus 30 days after account closure to allow for reactivation or data export.
  • Sync operation logs: 90 days. Logs include operation timestamps, sync status, error details, and record counts but do not contain CRM record content.
  • Customer CRM data: transient processing only. CRM data passes through the PluSync sync engine in real time and is not stored beyond the completion of each sync operation. No CRM record content is persisted in our systems.
  • Billing and financial records: retained as required by Italian tax law (10 years) in accordance with applicable fiscal regulations.

9. Your Rights Under the GDPR

Under the General Data Protection Regulation (Articles 15 through 22), you have the following rights regarding your personal data:

  • Right of access (Art. 15): You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data.
  • Right to rectification (Art. 16): You have the right to request correction of inaccurate personal data or completion of incomplete data.
  • Right to erasure (Art. 17): You have the right to request deletion of your personal data ("right to be forgotten") where there is no compelling reason for its continued processing.
  • Right to restriction of processing (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
  • Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
  • Right to object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
  • Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects. PluSync does not currently engage in automated individual decision-making.

How to exercise your rights: To exercise any of the above rights, please contact us at privacy@plugsync.com. We will acknowledge your request and respond within 30 days. In complex cases, we may extend this period by an additional 60 days, in which case we will inform you of the extension and the reasons for it.

You also have the right to lodge a complaint with the Italian supervisory authority, theGarante per la Protezione dei Dati Personali, atwww.garanteprivacy.it.

10. International Data Transfers

Our primary infrastructure is hosted in the European Union (Frankfurt, Germany) through our hosting provider, Amazon Web Services. Database services are also located within the EU. This means that the majority of your data is processed and stored within the European Economic Area (EEA).

However, some of the third-party services we use, specifically Google Analytics and HubSpot, may transfer personal data to the United States. These transfers are carried out underStandard Contractual Clauses (SCCs) as approved by the European Commission, which provide appropriate safeguards for the protection of personal data in accordance with Article 46(2)(c) of the GDPR.

We regularly review our data transfer mechanisms and the data protection practices of our sub-processors to ensure that adequate safeguards are maintained for all international data transfers.

11. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encryption in transit: All data transmitted between your browser and our servers, and between our internal services, is encrypted using TLS 1.2 or higher.
  • Encryption at rest: Stored data is encrypted at rest at the database and storage level.
  • OAuth token encryption: HubSpot OAuth credentials and API tokens are encrypted using Fernet symmetric encryption before storage, ensuring they cannot be read even in the event of a database breach.
  • Role-based access controls: Access to systems and data is restricted based on the principle of least privilege, with role-based access controls enforced at both application and infrastructure levels.
  • Regular security assessments: We conduct periodic security reviews of our codebase, infrastructure, and third-party dependencies to identify and remediate vulnerabilities.
  • Incident detection and response: We maintain monitoring and alerting systems to detect security incidents and have documented incident response procedures to ensure timely and effective responses.
  • Secure development practices: Our development process includes code review, dependency scanning, and adherence to security best practices throughout the software development lifecycle.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the "Last updated" date at the top of this page.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide notice to registered customers via email at least 30 days beforethe changes take effect. This gives you the opportunity to review the updated policy and, if necessary, take appropriate action.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Exelab SRL
Italy
VAT: IT08990591003