Who we are
FileFetch is a HubSpot application operated by Market Disrupt (marketdisrupt.io). It lets authorized users of a HubSpot account bulk-download files stored on or attached to their CRM records. This policy explains what data FileFetch handles, what we store, who we share it with, and how deletion works. It supplements the Market Disrupt Privacy Policy, which governs our business generally.
Data we collect and store
We collect and store the following user and account data:
- HubSpot connection credentials — when you connect your HubSpot account via OAuth, we store the resulting access and refresh tokens, your HubSpot account (portal) ID, the granted permission scopes, and the email address of the connecting user. Tokens are stored in our database encrypted at rest and are never exposed to your browser.
- Download activity records — for each download run we store run summaries and per-file access records: the object type, file IDs and file names, success/failure counts, timestamps, and the email address of the acting user as reported by the HubSpot interface (recorded as user-provided context).
- Terms of Service acceptance records — the portal ID, user email, terms version, and timestamp when a user accepts our Terms of Service.
- Billing records — when a portal subscribes, we store its subscription status, trial dates, and Stripe customer and subscription identifiers. We never see or store card numbers — payment details are collected and processed entirely by Stripe.
- Session data — a signed, HTTP-only browser cookie containing only your HubSpot portal ID (no personal information), used to keep you connected for up to 12 hours.
- Technical logs — our hosting provider (Vercel) generates standard request logs (IP address, user agent, request paths) as part of operating the service.
Data we do not collect
- Your files never touch our storage. Downloaded file contents are transferred directly from HubSpot's file infrastructure to your browser (or streamed through our server without being written to disk) and are packaged into a zip on your own device. We do not store, copy, or retain the contents of any file you download.
- We do not use advertising trackers or third-party analytics inside FileFetch.
- We do not sell or rent any data to anyone.
Artificial intelligence
FileFetch does notuse artificial intelligence or machine learning to process your CRM data, your files, or any data described in this policy. Market Disrupt uses third-party AI tools (such as Anthropic’s Claude) in its broader business operations — including software development and customer support — as described in the Market Disrupt Privacy Policy; the CRM data and files FileFetch accesses are not provided to those AI tools. If FileFetch ever adds AI-powered features, we will update this policy and the in-app terms before they take effect.
Third parties we share data with
FileFetch shares data only with the service providers required to operate the app:
- Vercel Inc.— application hosting. All app traffic and serverless processing runs on Vercel; request metadata appears in Vercel’s operational logs.
- Neon Inc. — managed Postgres database hosting. Stores the connection credentials and activity records described above, encrypted at rest.
- HubSpot, Inc.— the platform FileFetch connects to. We call HubSpot APIs on your behalf using the permissions you grant at install; your use of HubSpot is governed by HubSpot’s own terms and privacy policy.
- Stripe, Inc.— payment processing for FileFetch subscriptions. When you subscribe, Stripe receives your email address and payment details directly; FileFetch receives back only account identifiers and subscription status. See Stripe’s privacy policy for how they handle payment data.
No other third party receives your data.
Data retention and deletion
- On uninstall, deletion is automatic.When FileFetch is uninstalled from a HubSpot account, we automatically delete — within 24 hours — that account’s stored OAuth tokens and connection record, its download run history, its per-file access records, and our copy of its billing identifiers. Any active subscription is set to cancel so no further charges occur. Financial records remain with Stripe as required for accounting and legal purposes.
- Terms acceptance records are retained after uninstall as evidence of agreement during the period the app was in use.
- Hosting logsare retained per Vercel’s standard rotation and are not archived by us.
- To request deletion of any remaining data (including acceptance records where legally permissible), email contact@marketdisrupt.io — we respond within 30 days.
Security
- Authentication uses HubSpot OAuth 2.0 — FileFetch never sees your HubSpot password.
- All traffic is encrypted in transit (TLS); tokens are encrypted at rest.
- FileFetch operates no file storage buckets, public or private — file contents are never persisted on our infrastructure. Database access requires authenticated, TLS-encrypted connections; nothing is publicly readable.
- File downloads use HubSpot’s own short-lived signed URLs.
Your rights
Depending on your jurisdiction (e.g., GDPR, CCPA), you may have rights to access, correct, export, or delete personal data we hold. Contact contact@marketdisrupt.io to exercise them. Note that most personal data in CRM records you download belongs to your organization, which controls it — requests about CRM contents should go to your administrator.
Changes to this policy
We will update this page when our practices change and revise the “Last updated” date. Material changes will also be reflected in the in-app Terms of Service, which require re-acceptance.
Contact
Market Disrupt · contact@marketdisrupt.io · marketdisrupt.io
← Back to FileFetch