Get Started
Back to Home

Privacy Policy

Effective Date: April 10, 2026 · Last Updated: November 3, 2026

1. Introduction

BlueOshan Digital Private Limited ("we", "our", "us") operates AuPerate, a HubSpot marketplace application. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service. We are committed to protecting your privacy and complying with applicable data protection regulations including GDPR and CCPA.

2. Information We Collect

2.1 Account Information

  • Email address - Used for authentication (OTP verification) and communication.
  • Name - Provided during signup.

2.2 HubSpot Portal Data

  • Portal ID and domain - Identifies your connected HubSpot account.
  • OAuth tokens - Encrypted access and refresh tokens for maintaining the HubSpot connection.
  • CRM data processed in workflows - Contact, company, deal, ticket, and custom object properties passed through workflow actions. We do not copy your CRM records into a database of our own. However, the values an action receives and returns are written to that action's execution log, as described in section 2.3.

2.3 Usage Data

  • Execution logs - For every action that runs we record the action type, status (success or error), execution time, timestamps, any error message, and identifiers for the workflow, enrolment, and record involved.
  • Action inputs and outputs - Several actions also record the values they were given and the values they returned, so that you can inspect and troubleshoot a run from the Logs page. For a webhook this is the destination URL and method; for data formatting and date handling it is the input values and the result; for custom code it is the inputs you mapped and the output your code produced. These entries are truncated at 5,000 characters. If a workflow passes personal data into one of these actions, that value is stored in the log. The merge, association, line item, clone, and hash or encrypt actions record only metadata, never the values themselves.
  • Usage metrics - Daily execution counts by action type.
  • Payment records - Transaction IDs, amounts, plan selections. We do not store credit card numbers.

2.4 Technical Data

  • IP address and browser information - For security, rate limiting, and geo-detection.
  • Timezone and locale - For currency detection (USD/INR).

3. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To authenticate your identity and manage your account.
  • To execute workflow actions on your behalf within HubSpot.
  • To track usage and enforce subscription plan limits.
  • To process payments and manage billing.
  • To send transactional emails (OTP codes, usage alerts, payment receipts).
  • To respond to support requests and inquiries.
  • To detect and prevent fraud, abuse, and security incidents.

4. Data Storage and Security

Your data is stored on AWS infrastructure (DynamoDB) in the US East region. We implement the following security measures:

  • Encryption at rest - All sensitive data (OAuth tokens, user secrets) is encrypted using AES-256-GCM with unique IVs and authentication tags.
  • Encryption in transit - All communications use TLS 1.2+.
  • Code sandboxing - Custom code runs in a Node.js virtual machine context with a fixed timeout and a curated set of modules (axios, lodash, dayjs, crypto, form-data). It has no filesystem access and cannot load modules outside that list. It can make outbound HTTP requests, which is deliberate, because the action exists to let your code call external services in the same way HubSpot's own custom code action does.
  • SSRF protection - Webhook URLs are validated against private IP ranges and metadata endpoints.
  • OTP hashing - Verification codes are stored as SHA-256 hashes, never in plaintext.
  • Access control - JWT-based authentication with token expiration.

5. Data Retention

We would rather describe what actually happens than publish a schedule we do not enforce. Four kinds of record expire on their own; everything else is kept until you ask us to remove it.

Deleted automatically:

  • One-time passcodes - Expire 10 minutes after they are issued, and are deleted as soon as they are used.
  • OAuth connection states - Short-lived values used only while you connect a HubSpot portal, deleted once the connection completes or the attempt expires.
  • Execution logs, including the action inputs and outputs described in section 2.3 - Deleted automatically 90 days after the action runs.
  • Administrative audit entries - Deleted automatically after two years.

Kept until deletion is requested:

  • Account and portal data - Your account, connected portal, and subscription records are kept for as long as the account exists. We do not currently offer a self-service delete button, so closing an account is a manual request to us.
  • Usage counters - Monthly execution counts, kept alongside your subscription record.
  • Snippets and secrets - Kept until you delete them from the application, which removes them immediately.
  • Payment and invoice records - Kept indefinitely, because tax, accounting, and audit obligations require us to be able to produce them.

You can ask us to delete any of this at any time using the contact address in section 7, and we will do so except where we are legally required to keep a record, which in practice means payment and invoice history.

6. Third-Party Services

We use the following third-party services:

  • HubSpot - CRM platform integration via OAuth. Subject to HubSpot's Privacy Policy.
  • Google - Analytics and web fonts. Subject to Google's Privacy Policy.
  • Amazon Web Services (AWS) - Cloud infrastructure (DynamoDB, Lambda). Subject to AWS Privacy Policy.
  • Razorpay - Payment processing. We do not store credit card details.
  • OneSignal - Email delivery and customer engagement. Receives your email address and name, and a small set of account attributes used to decide what to send you: your plan, subscription status, connected portal ID, monthly execution count, and lifecycle stage. Subject to OneSignal's Privacy Policy.
  • Gmail SMTP - Fallback transactional email delivery when OneSignal is unavailable.

7. Your Rights

Under applicable data protection laws (including GDPR and CCPA), you have the right to:

  • Access - Request a copy of the personal data we hold about you.
  • Rectification - Update or correct inaccurate personal data.
  • Deletion - Request deletion of your personal data ("right to be forgotten").
  • Portability - Request your data in a machine-readable format.
  • Restriction - Request that we limit processing of your data.
  • Objection - Object to processing based on legitimate interests.
  • Withdraw consent - Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at sales@auperate.com. We will respond within 30 days.

8. Cookies and Local Storage

AuPerate uses minimal browser storage:

  • localStorage - Authentication tokens (auperate_user_token, auperate_portal_token) and cached user data. Essential for the Service to function.
  • Google Analytics - Our marketing pages load Google Analytics, which sets its own cookies to count visits and tell repeat visits apart. We use it to understand which pages are read, not to build a profile of you.
  • HubSpot - Our marketing pages load HubSpot's tracking script, which sets a visitor cookie (hubspotutk) so that a form submission can be attributed to the pages that visitor read beforehand.

We do not use advertising cookies, and we do not sell or share this data with advertising networks.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 13 (or 16 in the EU). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States (AWS infrastructure). We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last Updated" date at the top indicates when the policy was last revised.

12. Contact Us

For privacy-related questions or to exercise your data rights:

Email: sales@auperate.com
BlueOshan Digital Private Limited, India