Privacy

Privacy Policy

Version of 11 October 2026

This policy covers the BothSync app, which keeps HubSpot and ClickUp in step (part A), and this website with the BothSync beta list (part B).

Who we are

BothSync is made by Jivaseva OÜ, a company registered in Estonia; our full company details are in the Terms of Service. Write to us at support@bothsync.com.

A. The BothSync app

Two roles

The records and tasks in your HubSpot and ClickUp accounts belong to your organisation, which decides what BothSync does with them. For that data your organisation is the controller and we are its processor, under the data processing terms in section 13 of the Terms of Service. If you are someone whose details are in a customer’s CRM, please contact that organisation first; we help it answer you.

We are the controller of the data we need to run our relationship with the customer: who to contact, billing, and support conversations.

What BothSync reads and writes

In HubSpot, BothSync reads:

• the deals, tickets or companies, of the kinds your rules use, that changed since its last check, and of those only the properties your rules, task templates and field mappings use;
• the names and choices of properties and pipelines, so the settings page can offer them;
• the names and email addresses of HubSpot users who own records, to match them with ClickUp members by email address;
• the email address of the HubSpot user who installs BothSync;
• the portal’s time zone and currencies, so dates and amounts carry over correctly.

It writes the properties you map from ClickUp, three properties of its own on each linked record (a link to the ClickUp task, the task’s status and its latest comment), and a record’s stage when its task is done, if you set that up.

In ClickUp, BothSync reads your lists and their fields, the names and email addresses of workspace members (for the same matching), the tasks in the workspace that changed since its last check, and of the tasks it created their mapped fields, status and comments. When you copy an existing task into a template, it reads the names of recent tasks in the list you choose, and the chosen task with its description, subtasks and checklists. It creates tasks, subtasks and checklists from your templates and writes the fields you map from HubSpot.

BothSync checks the changed records and tasks in memory and keeps only what concerns your rules.

To learn about changes quickly, BothSync asks both services to notify it: HubSpot when certain properties of a deal, ticket or company change (such as its stage, owner, name or amount), and ClickUp when a task in the workspace changes or gets a comment. These notifications cover records and tasks your rules do not use too. BothSync ignores those, and deletes them with the other notifications (see below).

What we store, and for how long

While BothSync is installed we keep:

• Access to your accounts: the HubSpot and ClickUp access tokens, encrypted (AES-256), your HubSpot portal and ClickUp workspace ids, and their time zones.
• Who to tell: the email address of the HubSpot user who installed BothSync, or another address you gave us, to tell your organisation about changes to BothSync and its terms, and about a data breach.
• Your settings: rules, task templates and field mappings, with the names of the fields.
• Links: which HubSpot record belongs to which ClickUp task, by their ids, and the task’s status when it was last synced.
• Sync state: for each mapped field, a one-way fingerprint (SHA-256) of the value last synced, so BothSync can tell a new change from its own; never the value itself.
• Change notifications that HubSpot and ClickUp send us, which can contain the changed values or a comment’s text. We delete them 30 days after they are handled.
• The sync log you can read in the settings page: what was synced, when, between which fields, and whether it worked. It names the fields, not their values, but it identifies tasks and records by their names and gives a task’s status, and an error can quote the value that caused it. We delete entries after 90 days, except the newest one for each linked record, which its BothSync card uses to show when a change was last synced.
• AI usage: which AI feature was used, when, the model and the amount of text, to limit use and cost; never what was sent or answered.
• Server logs: the IP address and time of each request to our servers, and the ids, counts and error messages of BothSync’s work. Our hosting provider keeps them for 90 days, on its servers in the USA.

When BothSync is uninstalled, in its settings page or in HubSpot, we delete all of the above for that portal at once and remove BothSync’s notification hook from ClickUp. Nothing is kept for a later reinstall, which starts afresh. The tasks in ClickUp and BothSync’s properties on your HubSpot records stay, since they are in your own accounts. We take an encrypted backup of our database every night and keep each one for up to 30 days, so deleted data is gone from the backups within 30 days.

AI suggestions

Two settings screens offer AI help: suggested field mappings, and a task template drafted from a description of your process. They run only when someone clicks for them. We then send the AI model the names of the HubSpot properties and ClickUp fields involved and, for a template, the text you typed. We never send the values in your records or tasks. The request goes through OpenRouter to a provider that runs the model, at present Anthropic’s Claude models, run by Anthropic, Amazon Web Services or Google Cloud. We allow only providers that neither keep the data nor train on it. AI never decides what BothSync syncs; a person checks and saves each suggestion.

Support and billing

When you write to support@bothsync.com we keep the conversation for up to 24 months after it ends. Once BothSync is a paid service, Stripe handles payments: we receive the billing contact’s name and email address, the company’s name, address and tax number, and the payment status, and never the full card number. Estonian accounting law requires us to keep invoices and payment records for 7 years.

Why, and on what basis

• Data in your HubSpot and ClickUp accounts: we process it on your organisation’s instructions, as its processor; your organisation’s basis applies.
• Customer contact, billing and support: to provide the service you signed up for (GDPR Article 6(1)(b)), and to keep accounting records (Article 6(1)(c)).
• Server logs and the sync log: our legitimate interest in keeping BothSync secure and working (Article 6(1)(f)).

B. This website and the beta list

What we collect

• Your email address, when you ask for an invite.
• Your answers to the four optional questions, if you give them.
• The campaign name in the link that brought you here (such as utm_source), if there was one, and the date you signed up.
• Our server’s request logs: your IP address and the page you asked for. Our hosting provider keeps them for 90 days, on its servers in the USA.
• Visit counts: which pages you view, the site or campaign link that brought you here, whether you asked for an invite, your browser and device type, and the country your IP address points to.

This site sets no cookies and stores nothing on your device. We count visits with PostHog, served from our own domain, in a mode that cannot recognise you across visits: each visit counts as a new one, and PostHog does not keep your IP address. It tells us how many people come and from where, not who they are.

Why, and on what basis

We use your email to invite you to the BothSync beta and to tell you when BothSync launches, and your answers to choose the first beta teams. The basis is your consent (GDPR Article 6(1)(a)), given when you send the form. You can withdraw it at any time by writing to us; we then delete your data.

We count visits to know whether the site works and which posts bring people to it. The basis is our legitimate interest (GDPR Article 6(1)(f)).

How long we keep it

Until the beta and the launch are behind us, and no longer than 24 months from the day you signed up. Sooner if you ask.

Who else handles data

• Railway hosts BothSync, this site and our database, on servers in Amsterdam, the Netherlands (EU), and keeps the server logs in the USA. Railway is a US company; its data processing agreement includes the EU Standard Contractual Clauses.
• OpenRouter (USA) passes AI requests to the model provider, only when someone asks for an AI suggestion; its data processing agreement includes the EU Standard Contractual Clauses.
• Anthropic (USA) makes the AI model, run by Anthropic, Amazon Web Services or Google Cloud as described above.
• Stripe (Stripe Payments Europe, Ireland) handles payments, once BothSync is paid.
• PostHog (PostHog EU, hosted in the European Union) counts visits to this website.
• Cloudflare runs our domain.
• Zoho hosts our email, including support@bothsync.com, in its EU data centre.
• Google (Gmail) receives a copy of the email sent to support@bothsync.com, which we read there.

Where one of them handles data outside the EU, the transfer rests on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. We never sell data or share it with anyone else. HubSpot and ClickUp are not on this list: they are your own providers, and BothSync works inside the accounts you have with them.

Security

All traffic to and from BothSync is encrypted (HTTPS). Access tokens and backups are stored encrypted, and every change notification from HubSpot and ClickUp is checked for its signature before BothSync acts on it. Our servers and database are in the EU, and only the people at Jivaseva OÜ who run BothSync can reach them; our hosting provider keeps the server logs in the USA.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to stop using it. Write to support@bothsync.com and we will answer within 30 days. You can also complain to the Estonian Data Protection Inspectorate (aki.ee).

Changes

If this policy changes, the new version is published here with a new date. We tell customers about material changes by email before they take effect.