Privacy Policy

For your Ancil account data (your name, email, workspace info), INSIDEA is the controller.

For HubSpot CRM data we read or write at your direction, you are the controller and we are the processor.

Account information you provide: name, work email, workspace name, role.

HubSpot data we access via OAuth: the scopes you grant on connect, including (subject to your portal’s subscription) contacts, companies, deals, lists, workflows, and other CRM objects.

Usage telemetry: pages visited, audit runs, feature flags. We do not sell this data.

Generate audits, findings, drafted fixes, and the Daily Brief.

Improve the product: aggregated, de-identified patterns inform new audit rules.

Send transactional and product emails. We do not send marketing email to anyone in your HubSpot CRM.

Account and CRM-derived data sits in Supabase-backed Postgres in encrypted form at rest. HubSpot OAuth tokens are encrypted at the application layer with AES-256-GCM before they touch the database.

TLS 1.2+ in transit at every hop. Backups are encrypted.

Hosting and database: Vercel and Supabase.

Email: Resend.

Background jobs: Inngest.

AI inference: OpenAI (and Anthropic where flagged).

A current sub-processor list is available on request: hello@ancil.ai.

Account data: while your workspace is active, plus 90 days after deletion.

Audit data: while your workspace is active, plus 30 days after deletion.

You can request earlier deletion at hello@ancil.ai.

Subject to applicable law, you can request access, rectification, deletion, restriction, portability, or objection. Reach us at hello@ancil.ai. We respond within 30 days.

We may transfer data outside your country. We rely on standard contractual clauses where required.

Ancil is not intended for use by anyone under 18. We do not knowingly collect data from children.

We will post changes here and update the version + effective date. Material changes will also be emailed to workspace owners.

Questions or requests: hello@ancil.ai.