Portal Audit: Privacy Policy
Last updated: October 15, 2026
1. Who we are
Portal Audit by TJM ("Portal Audit") and its paid plans (the "Service") are operated by Jon Martin, a sole proprietor trading as TheJonMartin ("we", "us", "our"). Portal Audit is a HubSpot app that audits your portal's data quality, setup and usage, scores it, and gives a prioritized fix plan. On the Fix plan it can apply fixes you approve.
Contact: Jon Martin, sole proprietor trading as TheJonMartin, 819 E. Orange St., Lancaster, PA 17602, United States. Email: jon@thejonmartin.com. We are reachable by email only.
This policy explains what the Service reads from your HubSpot account, what we keep, who we share it with, how long we keep it, and the choices you have. Section 16 is the extra notice for people in the European Economic Area and the United Kingdom.
2. Who the Service is for
The Service is a business tool for organizations that use HubSpot, including organizations in the European Economic Area and the United Kingdom. It is not a consumer product. Users must be at least 18.
This policy covers the person who installs Portal Audit, the organization that owns the HubSpot account (the "portal"), and the HubSpot users and record owners whose details show up in the settings we read. HubSpot's own privacy policy governs your HubSpot account itself. Paid orders are placed with Paddle, the merchant of record, which calculates and collects VAT and similar taxes. Paddle's privacy notice covers the payment data Paddle controls (section 8).
3. What Portal Audit reads from HubSpot
During installation you approve a set of HubSpot permissions ("scopes"). The public install link asks for read permissions. Nothing changes in your portal unless you approve it. Write permissions are not on that public link.
Required permissions
| HubSpot data | Scope | What the audit reads |
|---|---|---|
| Account | oauth | Account details: portal ID, time zone, currency, data hosting location |
| Contacts | crm.objects.contacts.read | Record counts (including totals of calls, meetings, notes and tasks; activity text is not stored) and field-completeness checks (counts only; no contact records are copied) |
| Companies | crm.objects.companies.read | Record counts and field-completeness checks |
| Deals | crm.objects.deals.read | Record counts, field completeness, deal pipelines and stages |
| Tickets | crm.objects.tickets.read | Record counts, field completeness, ticket pipelines and stages |
| Contacts, companies, deals, tickets | crm.schemas.contacts.read, crm.schemas.companies.read, crm.schemas.deals.read, crm.schemas.tickets.read | Property definitions (names, types, groups, usage flags). Contact and company lifecycle stage options and their order. |
| Line items | crm.objects.line_items.read, crm.schemas.line_items.read | Record counts; property definitions |
| Quotes | crm.objects.quotes.read, crm.schemas.quotes.read | Record counts; property definitions |
| Users | crm.objects.owners.read | Record owners, used to find unassigned or departed owners |
| Users | settings.users.read | Users, roles and the super admin flag, used for the access review |
| Users | settings.users.teams.read | Teams and team membership |
| Segments (lists) | crm.lists.read | Segment names, types, sizes and last-updated dates |
| Account security | account-info.security.read | Login history, security activity and audit-log summaries for the last 90 days; private-app API usage |
Optional permissions (you can uncheck any of these on HubSpot's install screen; the related checks are then marked "not assessed")
| HubSpot data | Scope | What the audit reads |
|---|---|---|
| Forms | forms | Form names, types and settings (submissions are not read) |
| Marketing email | marketing-email | Marketing email status and settings (nothing is sent) |
| Workflows | automation | Workflow names, status, object type, enrollment settings and actions (no workflow is changed) |
| Marketing email | content | Marketing email inventory when marketing-email is not enough |
| Custom objects | crm.objects.custom.read, crm.schemas.custom.read | Custom object record counts, field completeness, schemas and property definitions |
| Website | cms.domains.read | Connected domains, used to find your company website for the business profile |
| Goals | crm.objects.goals.read | How many goal targets exist (the id only; owner and creator ids are not requested) |
| Leads | crm.objects.leads.read | Whether the leads object is turned on, then the lead total (one search, id only) |
| Meetings | scheduler.meetings.meeting-link.read | How many meeting links exist (the total only; link URLs and organizer ids are not stored) |
| Reporting | reporting.full.read | How many custom reports and dashboards exist (totals only) |
| Knowledge base | cms.knowledge_base.articles.read | How many knowledge base articles exist. Article bodies are not requested |
| Feedback | crm.objects.feedback_submissions.read | How many feedback survey responses exist (the total only; answers are not read) |
| Orders | crm.objects.orders.read | How many orders exist (the total only; amounts and line items are not read). Skipped when the permission is not granted or orders are turned off |
| Invoices | crm.objects.invoices.read | How many invoices exist (the total only; amounts and line items are not read). Skipped when the permission is not granted or invoices are turned off |
| Subscriptions | crm.objects.subscriptions.read | How many commerce subscriptions exist (the total only; amounts and line items are not read). Skipped when the permission is not granted or subscriptions are turned off |
| Commerce payments | crm.objects.commercepayments.read | How many commerce payments exist (the total only; amounts, status, and payer details are not read). HubSpot lists this permission for Starter accounts. Skipped when it is not granted or payments are turned off |
About four of these permissions. HubSpot offers no read-only version of forms, marketing-email, automation and content, so HubSpot's install screen describes them as permissions that can also make changes. The audit path checks every request before it goes to HubSpot. It allows reads (GET requests and a short list of search and batch-read requests). It blocks every create, update or delete request on that path before it leaves our server.
Write permissions, only after you approve a fix. A Fix reauthorize on this same app can ask for eight write permissions (crm.objects.contacts.write, crm.schemas.contacts.write, crm.schemas.companies.write, crm.schemas.deals.write, crm.objects.deals.write, crm.objects.tickets.write, crm.objects.companies.write, settings.users.teams.write). They are conditionally required: the public install link does not include them. Fixes that use them stay off until you approve them, and each change still needs a dry run and an approval. The app does not request Sensitive Data scopes, crm.export, or crm.import.
Disconnect. If you ask us to disconnect, the app calls HubSpot's uninstall-app API to remove itself from your account. That call changes none of your records or settings.
What we do not read or keep. We do not read form submissions, conversations, files or payment data from HubSpot. We do not copy contact, company, deal or ticket records. Data-quality checks keep only counts of records with missing or inconsistent fields. We do not keep the content of marketing emails. Products and one-to-one emails are listed in the object inventory as not assessed, and those APIs are not called. Call, meeting, note and task text is not stored; only those record totals are kept. Portal Audit never requests HubSpot Sensitive Data or Highly Sensitive Data permissions, and never reads or checks that data. That includes any permission whose name contains .sensitive. or .highly_sensitive., and the older ticket permissions tickets.sensitive and tickets.highly_sensitive.
4. Automated fixes
Nothing changes in your portal unless you approve it.
- Automated fixes (Fix plan). Fixes run in this app, only for an install that granted the write permissions, only for Fix Catalog items you enable, and only after a dry run and an approval of that change set. For each change we keep a fix log: the record ID, object and property changed, the old and new values, the time, and the read-back result. The previous value is stored encrypted so the change can be rolled back. Because a property value can contain personal data (for example a contact's job title), the fix log can contain personal data limited to the properties the enabled catalog items touch. You can turn fixes off, or uninstall the app, at any time.
5. What we store
| What | Details |
|---|---|
| Connection record | Your portal ID, HubSpot account domain, the HubSpot user ID of the person who installed the app, the HubSpot data center, the permissions granted, install and uninstall timestamps, and a refresh token. The refresh token is encrypted with AES-256-GCM and bound to your portal ID. Short-lived access tokens stay in memory and are never written to disk. |
| Audit reports and fix plans | Report files (JSON, Markdown, HTML, PDF), fix plans and supporting files. They contain configuration details and counts. Personal data in them is limited to: names of HubSpot record owners and HubSpot owner/user IDs; team names; for each HubSpot user, a user ID, display name (first and last, when HubSpot returns them), role and team IDs, seat names and the super admin flag; the time of each user's latest successful login in the review window; and, for users past their inactivity threshold, how many contacts, companies, deals and tickets they own and a suggested reassignment target. Login activity is also summarized as counts by event type and country code, plus the IDs of the users who logged in. A matched public job title may be stored on the org chart only when this portal has ticked the separate org-chart box (off by default) and APIFY_TOKEN is set. Website research alone does not turn that on. We do not store email addresses, IP addresses, browser user agents, cities, or public profile URLs from login history or from that people lookup, and owner email addresses are left out of reports. When the Service emails a report to the HubSpot user who installed the app, that person's email address is stored with the delivery record for that report. It is not written into the report file. |
| Fix logs (plans with automated fixes) | As described in section 4. |
| Business profile | Your industry, company size band and website, which you confirm on the page shown right after you install (or skip; see section 7). If you tick the research box on that page, we also keep a short summary and strengths/weaknesses analysis built from your public website and from public outside sources. To read your website we fetch up to five of its public pages, chosen from its sitemap and from links on the home page, we respect its robots.txt, and we remove email addresses and phone numbers from the text we keep. For outside sources, the AI agent that drafts your report may consult public pages about your company (for example a company profile or a news article) and quote a short passage with the page's address. Our server does not fetch those outside pages; the agent does, outside our systems, and only the quoted passage and address come back to us. No HubSpot data is sent to look anything up. |
| Billing and account details (paid plans) | The billing contact's name and email, business name, billing address where Paddle needs it for tax, your plan and billing period, and payment status. Card and bank details are collected and held by Paddle, the merchant of record (section 8); we do not receive or store full card or bank account numbers. |
| Support messages | Emails you send to jon@thejonmartin.com and our replies. |
| Optional inputs you give us | For example, a HubSpot Context Home score you choose to share, the cost-input ranges an admin picks (people, deal size, loaded hourly cost, hours per week; each can be N/A), and anonymous survey answers from people the admin invites. The survey asks what part of HubSpot they would skip and a few dropdowns. It does not ask for a name or an email. A written answer that contains an email, a link, a long number, or a name is dropped. Survey totals in the report are for that portal only. |
| Anonymized survey counts | When someone submits that survey, we also store a separate count of the dropdown answers (which area, how often, and whether they want the work taken off their plate). That count has no portal id, no name, no email, and no written answer. We collect it for product improvement and for future benchmarks. Collection is on. Your report shows your portal’s own anonymous answers. It does not show a comparison with other portals unless we later turn that comparison on. |
| Anonymized usage-shape data | For each audit we store a separate summary of the shape of your HubSpot usage: portal plan and size band, counts of pipelines, stages, properties, objects, lists, forms, emails, and workflows, fill rates, activity rates, user and team counts, which audit checks fired, and the multiple-choice answers on the shaping checklist. We collect this for product improvement and for future benchmarks. We do not store in that summary any person's name, any email address, the portal id, or the names or labels of your properties, pipelines, stages, teams, workflows, forms, or lists. We store a one-way code derived from the portal id so we can keep one current summary per portal and so we can delete it. Collection starts with this version of the Service. A comparison with other portals appears in your report only when the group is large enough, the range is tight and stable, and we have turned that comparison on. Until then, your report does not include one. This summary is deleted on the same schedule as the rest of your data when you disconnect, and immediately if you opt out. |
| Schedule and history | Your audit settings and a record of past runs. |
| Operational logs | Errors and timings. Each error is logged as one line with tokens and secrets removed. Logs contain no response bodies or record data. |
Our public web pages (setup guide, pricing, support, privacy, terms, refund) set no cookies and use no analytics or tracking. Our hosting provider may record technical data such as visitor IP addresses at its network edge for security and operations, under its own policies.
6. How we use it
Only to provide and support the Service: to run audits, produce reports and fix plans, apply the catalog fixes you enable, compare results over time, bill your subscription, answer support requests, and keep the Service secure. We use the anonymized usage-shape summary described in section 5 for product improvement and for future benchmarks. Product improvement means understanding which setups are common so we can make the audit more useful, including the internal review we do of those summaries. Future benchmarks means a comparison range in a report, shown only when the rules in section 5 are met. We do not sell these summaries, we do not use them to train a model, and we do not send them to our AI provider. If a report includes a comparison sentence, the draft of the surrounding narrative may include that finished sentence and not the underlying summaries. We use the anonymized survey counts in section 5 for product improvement and for future benchmarks. We do not sell those counts, we do not use them to train a model, and we do not send them to our AI provider. A comparison with other portals is not included in a report while that comparison is off. We do not sell personal information, share it for cross-context behavioral advertising, or use it for advertising. We do not use your data to train AI models, and we do not permit our AI provider to.
7. AI-assisted report writing and your consent
Right after you install Portal Audit, we show a confirmation page. There you confirm your industry, company size and website, and you choose whether to allow research. The research box is unticked until you tick it. Its label reads: "Let Portal Audit read my public website and public sources about my company."
A second box, also unticked until you tick it, reads: "Let Portal Audit look up public job titles for the org chart." That choice is per portal and off by default. Ticking the website box does not tick it. "Continue without tailoring" leaves it off.
- If you tick the website box: we read your public website (section 5) and the AI agent that drafts your report may also consult public outside sources about your company.
- If you tick the org-chart box: a public title lookup may run for the org chart, and a matched title may be stored (section 5).
- If you leave the website box unticked, or choose "Continue without tailoring": we read no website and consult no outside sources. We hold your first audit until you have made one of these choices. The report says it is not tailored to your company. Org-chart enrichment stays off unless its own box was ticked on a confirm (a skip turns it off).
Parts of each report (the written summary, strengths and weaknesses, priorities) are drafted with the help of AI.
- What goes to the AI: aggregated audit results, configuration names (property internal names and labels, workflow names, pipeline names, and role names), and, only if you ticked the research box, the public website text and outside passages described in section 5. Before anything is sent to the AI we redact personal data: email addresses, IP addresses, phone numbers, web addresses (other than your own public website pages) and the names of known people from your account are replaced with placeholders. A configuration name that is exactly a known person's name is redacted too.
- AI provider: when AI is used, the redacted material is processed by xAI (Grok). We use xAI's business API terms. As xAI publishes them (checked October 10, 2026), xAI does not train its models on API inputs or outputs without explicit permission, and keeps them for up to 30 days before deleting them. We do not give that permission.
- Authorship: reports are drafted with AI and checked against your audit data by software. They say so. A report says "Reviewed by Jon Martin" only when Jon has reviewed that report.
- Checks: before an AI draft is added to a report, software checks that every number in it appears in the audit data and that every finding it cites exists.
8. Who we share data with
We share data only with service providers that help us run the Service, and only as far as they need it:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Railway Corporation (railway.com) | Hosts the app, its database and report files | Everything listed in section 5 except card and bank details | United States (us-east4 region) |
| xAI (Grok) | Drafting the report narrative, when AI is used | Redacted, aggregated material only (section 7) | xAI's infrastructure, under xAI's terms |
| Google Workspace (email for jon@thejonmartin.com) | Support email, notices and sending you your reports | Your messages, billing notices and the reports we send you | Google's infrastructure, under Google Workspace terms |
| Resend (resend.com) | Emailing the audit report to the HubSpot user who installed the app | That person's email address and the report attached to that email | Under Resend's terms |
| Paddle (Paddle.com Market Limited, and the Paddle company that sells the order; paddle.com) | Merchant of record and reseller: checkout, payment, invoices, subscription renewal, and tax, including VAT | Billing contact name and email, business name, billing country and address where Paddle collects them, the plan, and payment status. Card and bank numbers stay with Paddle. We do not receive them. | Independent controller of that payment data. Privacy notice: paddle.com/legal/privacy. Buyer support: paddle.net |
By installing Portal Audit or subscribing, you give us express permission to share your data with the providers listed above, for the purposes listed above. We will update this list before adding a provider.
We may also disclose data when the law requires it. If the Service is transferred to another operator, this policy will continue to apply to the data that was collected under it.
9. Where data is stored
The data we host is stored in the United States. If you or your organization are in the European Economic Area or the United Kingdom, using the Service transfers that data to the United States. The companies that receive it are listed in section 8. Email jon@thejonmartin.com if you want to know how a particular transfer is protected.
10. How long we keep data
- While the app is installed: we keep reports, fix logs and history so we can show progress over time. Each anonymized usage-shape summary is kept for 24 months. The comparison, when it is turned on, uses only the latest summary per portal.
- When the app is disconnected, in any of three ways (you uninstall it in HubSpot, you ask us to disconnect, or HubSpot rejects our access): the refresh token is erased immediately, scheduled audits stop, and the in-memory access token is discarded. We check HubSpot's app-uninstall feed about every 15 minutes, so an uninstall done in HubSpot is normally picked up within that time.
- 30 days after disconnection: we delete the connection record, business profile, schedule, run history, fix logs, optional inputs and all report files for your portal, including copies we hold outside our host (such as reports sent by email and redacted AI material). The anonymized usage-shape summary is deleted on that same schedule. The anonymized survey counts in section 5 have no portal id, so they are not deleted with your portal. They cannot be tied back to it.
- Sooner on request: email jon@thejonmartin.com from an address on your HubSpot account and we will delete your data right away. Opting out deletes the usage-shape summary immediately.
- Backups: deleted data is removed from our backups within 30 days after deletion.
- Billing records are kept as long as the law requires for tax and accounting.
11. Security
- HTTPS for every connection to the app, with HTTP Strict Transport Security turned on.
- Refresh tokens encrypted at rest with AES-256-GCM.
- The audit path never changes your account. Every audit request is checked against an allowlist of reads before it is sent. Fixes use a separate write path within this same app, and it stays off until you approve a fix.
- No HubSpot Sensitive Data or Highly Sensitive Data permissions. Portal Audit never requests them and never reads or checks that data.
- Automated fixes limited to catalog items you enable in this app. Each change set is dry-run first and approved before it runs. The previous value is stored so the change can be undone.
- Administrative functions protected by a secret token.
- Data separated by portal ID.
- Report files readable only by the app's own system user.
- Secrets and tokens kept out of logs.
No system is perfectly secure. If a breach affects your data, we will tell you without undue delay.
12. Your choices
- Disconnect at any time: in HubSpot, go to Settings > Integrations > Connected Apps, then Actions > Uninstall on Portal Audit. Or email us. To stop automated fixes without uninstalling, turn fixes off.
- Opt out of anonymized usage summaries: on the confirmation page, tick "Do not include this portal in anonymized usage summaries." The box is unticked, so leaving it alone keeps the portal in. You can also opt out by emailing jon@thejonmartin.com. Opting out deletes the summary and stops new ones.
- Access, correction or deletion: email jon@thejonmartin.com. We aim to reply within 30 days.
- HubSpot users named in a report: we process your details on behalf of the organization that owns the HubSpot account, so we may pass your request to them.
13. Children
The Service is a business tool for people 18 and older. It is not directed at children, and we do not knowingly collect children's personal information.
14. Changes to this policy
We will post changes on this page and update the date above. For material changes we will email the contact on file at least 30 days before they take effect.
15. Contact
Jon Martin, sole proprietor trading as TheJonMartin, 819 E. Orange St., Lancaster, PA 17602, United States. Email: jon@thejonmartin.com. We are reachable by email only.
For payment data Paddle holds, contact Paddle at paddle.net.
16. People in the European Economic Area and the United Kingdom
This section applies when the organization, or a person whose personal data we process, is in the European Economic Area or the United Kingdom. It adds to the rest of this policy. It does not change what the app actually reads or stores.
Who is responsible
- Your organization and the HubSpot data. The organization that connects the HubSpot account decides to use the Service. We process the HubSpot data described in sections 3 to 5 (including names of users and owners that appear in a report) on that organization's behalf, to provide the audit, the score, the fix plan, and the fixes that organization approves. The Terms of Service are the instructions for that processing. A person named in a report can email us, and we may pass the request to the organization.
- Us, for our own business records. Jon Martin, sole proprietor trading as TheJonMartin, 819 E. Orange St., Lancaster, PA 17602, United States, is the controller of the account, delivery, and support data we keep for our own business: the email address of the HubSpot user a report is sent to, support messages, and the subscription details Paddle shares with us so we can tell which plan is paid. Email: jon@thejonmartin.com.
- Paddle, for the order. Paddle is an independent controller of checkout, payment, invoice, and tax data, including VAT. The buyer contracts with Paddle as merchant of record. Paddle's privacy notice is at paddle.com/legal/privacy. Paddle and we share buyer name, email, and purchase history so the subscription can be fulfilled, the order processed, and support and fraud questions answered. We use that shared data only for those purposes.
Why we use it
- Contract. To provide the audit, reports, monitoring, and approved fixes the organization installed or bought, and to keep the subscription that organization paid for.
- Consent. Website research and the public job-title lookup run only if the installing admin ticks the matching box (section 7). The boxes start unticked. Withdrawing consent later does not affect a lookup that already ran. Email jon@thejonmartin.com, or disconnect the app, to withdraw.
- Legitimate interests. To keep the Service secure, to debug it, and to keep the anonymized usage-shape summaries and survey counts in section 5 for product improvement and future benchmarks. Those summaries have no portal id and no person's name. You can opt out of usage summaries as described in section 12.
We do not use this data for advertising, and we do not sell it.
Your rights
Where the law gives them, you can ask us to:
- confirm whether we process your personal data, and for a copy of it;
- correct data that is wrong;
- delete it;
- restrict how we use it;
- receive data you provided to us, or data we process for a contract with you, in a portable form;
- object to processing based on legitimate interests;
- withdraw a consent you gave (the research box or the org-chart box).
Email jon@thejonmartin.com. We aim to reply within 30 days. We may need to confirm that the request comes from the HubSpot account or from the person named in a report. For data we process on an organization's behalf, we may refer the request to that organization. For card, bank, invoice, and tax data, contact Paddle at paddle.net, because Paddle holds that data and we do not.
You can also complain to a data protection authority. In the United Kingdom that is the Information Commissioner's Office. In the European Economic Area it is the authority in your country. You can complain to us first if you want to.
Where it goes
Section 9 describes the transfer to the United States. We have not appointed a representative in the European Economic Area or the United Kingdom. Use the address and email in this section to reach us.