Quote Builder by Vexco privacy policy

Last updated: 11/11/2026

This policy explains how the Quote Builder by Vexco app for HubSpot handles data. Vexco's general privacy policy covers its other services.

Controller

Soluciones Digitales Vexco, S.L. (Tax ID B44978617), Av. Francesc Macià, 35 (Cambra de Comerç de Sabadell), 08206 Sabadell (Barcelona), España. Contact: javier@vexcosolutions.com.

For your customers' data that the app reads from HubSpot to prepare quotes, your company is the controller and Vexco acts as processor (GDPR art. 28), following only your instructions.

What data we process

• Account data: HubSpot portal ID, domain, email of the installing user and app settings.
• Credentials: HubSpot OAuth tokens, stored encrypted with AES-256-GCM, and a hash of your API keys. They never leave our server.
• Templates you create, with their version history.
• History: for each quote created or attempted, the date, deal, template, title, total, number of lines, result and user email.
• CRM data (deal, company, contacts, owner and products) read at that moment to calculate the quote. It isn't stored.
• Imported content (what you paste, upload or link): processed in memory and not stored unless you save it as a template.

Why

Only to provide the service: calculating and creating quotes in your HubSpot, storing your templates, showing the history and support. We don't sell data or use it for advertising or model training.

Where and with whom

• Cloudflare (hosting and database, in the European Union jurisdiction).
• HubSpot, the system you connect.
• The URLs you provide for importing, only to download them.

How long

• History is deleted after 12 months.
• When you uninstall the app we stop using your credentials and delete everything stored for your account after 30 days. You can delete it immediately in the app (Settings → Plan and data → “Delete data and uninstall”) or by email.

Security

Encrypted connections (TLS), credentials encrypted at rest, signature verification on every HubSpot request, API keys stored only as hashes, URL downloads limited to public https addresses, and per-portal data isolation.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing javier@vexcosolutions.com, and complain to the Spanish Data Protection Agency (aepd.es).