How FunnelLedger handles your data.

What FunnelLedger does — and does not do

In one screen: FunnelLedger reads the structural evidence behind your HubSpot lifecycle stages and returns a read-only report. It is not an auto-cleanup tool, and it does not change your CRM on its own.

What it does

• Reconstructs lifecycle-stage history and judges whether each advanced-stage label is supported by the evidence in your portal.
• Reads structural evidence only: lifecycle history, timestamps, source / conversion / form labels, categorized activity, deal and ticket timing and counts, selected business-context fields, property schema metadata, and HubSpot Contact IDs.
• Produces a report and, when you ask, a CSV export.
• Records a per-scan privacy manifest of exactly what was used and what was blocked.

What it does not do

• It does not read names, emails, phone numbers, notes, message bodies, call transcripts, or free-text customer content.
• It does not write your lifecycle stages.
• It does not write contact, company, or deal properties.
• It does not auto-clean, remediate, or change records on its own.
• It does not let AI decide lifecycle verdicts — verdicts are deterministic.

The only write FunnelLedger can make to HubSpot is creating a static list from a cohort you explicitly approve (an approved Segment Action), with the required scopes. Everything else is read-only. Each of these statements is explained in detail below.

Two ingestion paths

FunnelLedger has two ways to read your data. The same privacy contract holds for both; the difference is how the data reaches us.

The privacy difference. In upload mode, identifying data never has to leave HubSpot at all — the filtering happens at ingestion, and you choose the files. In connected mode, FunnelLedger reads from HubSpot directly but only requests the allowlisted evidence properties, and the same firewall sanitizes and minimizes before anything is stored. Neither path reads or retains raw customer PII.

What FunnelLedger reads

These are the structural and evidence categories the audit uses. They describe the shape of lifecycle movement, not who the contacts are.

• HubSpot Contact ID — the only contact identifier we use, for stable joins inside our process and for handing off approved cohorts to HubSpot static lists.
• Lifecycle-stage history — current value and the sequence of stage transitions. The core audit subject.
• Timestamps — created date and stage entry / exit times, used to judge staleness and sequence.
• Source & conversion / form labels — the categorized source and conversion-event labels around a transition (for example form_submission), not the free-text answers inside a form.
• Activity date / property labels — categorized activity signals (email opened, page seen, meeting booked) as a class plus a timestamp or count — never the subject line, body, or page query string.
• Deal & ticket timing and counts — association counts and timing as support evidence, where available.
• Company / context fields — structured business-context values (country, region, industry, employee band, ICP tier, persona enum, segment enum) when selected by the Evidence Property Catalog for cohort cuts.
• Workflow / source context — attribution for how a stage changed (workflow, import, integration, user), where HubSpot exposes it.
• Property schema metadata — property definitions used to classify which fields are safe evidence and which are identifying.
• Approved static-list cohort IDs — only for a Segment Action you explicitly approve.

Custom properties are not guessed. Known HubSpot-defined fields are interpreted by a deterministic property-semantics registry; ambiguous HubSpot-defined fields may be checked against official HubSpot documentation only where the registry allows it; custom fields stay deterministic, ambiguous, or operator-confirmed. See section 6.

What FunnelLedger never reads or retains

• Names — firstname, lastname, fullname, name
• Emails — email, work_email, email bodies, email subject lines
• Phone numbers — phone, mobilephone, fax, messaging numbers
• Addresses — address, street, city, state, zip, postalcode
• Notes, call transcripts, call notes, meeting notes
• SMS / chat bodies, form free-text answers, attachment contents
• Raw page URLs with query strings or hash fragments (sanitized to a safe category and path)
• HubSpot-flagged sensitive-data properties
• Unknown custom free-text properties, by default

This is not a list of values we receive and then decline to display. PII-like values are ignored or suppressed and never rendered. The firewall prevents them from being fetched or ingested in the first place — they never enter our process, never reach our database, and never reach our AI provider.

The PII firewall (three layers)

The contract above is enforced by a firewall applied in three layers, in series:

• Read-time allowlist (connected) · upload-time filter (upload). In connected mode, the scan only requests enumerated evidence properties from HubSpot's API; directly-identifying fields are never on the request list. In upload mode, PII-like columns in the uploaded files are ignored or suppressed at ingestion and never rendered.
• Persistence-time minimization. The tables that back the audit (lifecycle history, support strength, activity observations) store HubSpot Contact IDs, timestamps, and categorized signal classes — not raw property values and not free-text content. A deep PII strip runs before anything is persisted.
• AI-prompt firewall and value-level PII scan. Every prompt sent to our AI provider passes through a runtime gate that scans for email shape, phone shape, and known HubSpot PII keys. If the gate trips, the prompt is rejected and the block falls back to deterministic output. The AI never receives contact-level data.

The gate is enforced by code, not policy. A future contributor who tries to add a prompt containing a contact's email will see the gate refuse the call — both at runtime and in the test suite.

AI: where it is used, and where it is not

FunnelLedger's verdicts are produced by a deterministic verdict engine — threshold-based logic over your portal's evidence. AI does not decide whether a lifecycle stage is supported, stale, missing evidence, or conflicting.

• AI does not decide lifecycle verdicts, metrics, or recommendations.
• AI does not receive contact-level data, Contact IDs, names, emails, phones, raw property values, or free-text content.

• AI may paraphrase wording — the intro paragraph and the industry-context summary — grounded only in aggregate, deterministic scan outputs (verdict counts, top findings, top actions, and the industry context you confirmed). It does not change verdicts, findings, or recommendations, and AI-assisted blocks are labelled.
• Property-semantics lookup is conservative: only eligible HubSpot-defined fields may be checked, and only against official HubSpot documentation. Custom properties are never guessed by AI. If a lookup times out, lacks an official HubSpot citation, or sees anything unsafe, FunnelLedger falls back to the deterministic registry result unchanged.

Every AI prompt passes through the PII firewall described in section 5 before it leaves our process.

HubSpot writes

FunnelLedger is read-only on HubSpot by default. To be exact:

• No lifecycle-stage writes. FunnelLedger never writes lifecyclestage.
• No contact, company, or deal property writes.
• No automatic cleanup, remediation, or record changes.

The single exception is an approved Segment Action: creating a HubSpot static list from a cohort you explicitly approve. It requires per-action consent and the verified crm.lists.write and crm.lists.read scopes. Every list creation is audit-logged with the list ID, name, and contact count. You can revoke list-creation consent at any time; lists already in your HubSpot remain under your control.

Retention & deletion

FunnelLedger retains only what is needed to re-render your audit and to honor the audit log: HubSpot Contact IDs, lifecycle-stage transitions, deal and ticket counts, categorized activity signals, and the deterministic verdicts computed for each scan. We do not retain names, emails, phones, addresses, notes, email bodies, or free-text customer content. An optional purge-after-report retention mode is planned but is not the current default.

Tenant delete · 24-hour SLA

You can delete your tenant from FunnelLedger at any time. The deletion is a single transaction that cascades across every table holding tenant-scoped rows. Operationally it completes in milliseconds; the 24-hour SLA is the legal-side ceiling, not the operational target.

When you trigger a tenant delete, FunnelLedger:

• Writes a single forensic audit row recording the deletion request, the portal identifier, the row counts being cleared, and the timestamp. It carries no tenant linkage, so it survives the cascade as a regulator-grade receipt that the deletion occurred.
• Clears every row in every dependent table within the same transaction — no partial state.
• Runs a residual-rows self-check afterward; the deletion is only acknowledged when every table reports zero rows for the deleted tenant.
• Returns a structured response carrying the row-count summary, the residual check, and a privacy_boundary: funnelledger_local_only_no_hubspot_writes marker.

How to request a tenant delete

Email support@funnelledger.com with the HubSpot portal ID and a confirmation. We will reply with the deletion receipt (the forensic audit row contents) within one business day.

Subprocessors

The subprocessor that receives any portion of scan-derived data is listed below.

If we add or change a subprocessor, we will update this page and notify pilot customers by email at least 14 days before the change takes effect.

Per-scan privacy manifest

Every scan emits a structured privacy manifest recording what it saw and did not see. The manifest is persisted alongside the scan and rendered in the report itself, so you or any reviewer can confirm the contract was honored on that specific scan — not just as a marketing claim.

An example manifest:

The manifest is the most concrete artifact we can give a security reviewer or DPO. It is generated per scan, persisted, and rendered inside the report.

Legal posture

This section is a technical explanation of the legal framework we believe our processing fits under. It is not legal advice, and the exact wording is pending review by privacy counsel before commercial launch.

GDPR / UK GDPR

The data FunnelLedger processes consists of HubSpot Contact IDs, lifecycle-stage history, timestamps, association counts, and categorized signal classes. We do not receive, and cannot reconstruct, directly-identifying customer information. We do not claim this data is fully anonymous: HubSpot Contact IDs are pseudonymous, and the data remains personal data in your hands as the HubSpot account controller, where you can map IDs back to people.

Whether such data is "personal data" turns on whether the recipient has reasonable means to re-identify the individuals. The CJEU addressed this contextual test in its September 2025 judgment in EDPS v SRB: data may be personal data in one party's hands and not in another's, depending on the means available to each. FunnelLedger receives data pseudonymized at source by the decision not to send directly-identifying fields, and we lack the means to reverse it — no parallel contact database, no cross-customer identity linkage. We believe the architectural separation between identity (which stays in HubSpot) and lifecycle evidence (which we audit) is real and that the legal frame supports the position.

CCPA / CPRA

For California consumers, data meeting the statutory definition of "deidentified" sits outside the personal-information scope, provided the business takes reasonable measures to prevent association, publicly commits to maintain the data in deidentified form and not re-identify it, and contractually requires downstream recipients to comply. This is FunnelLedger's public commitment:

Contact us

For privacy questions, deletion requests, subprocessor inquiries, or to request the technical inventory behind the claims on this page:

• Privacy, deletion requests, subprocessor & commercial questions: support@funnelledger.com — include your HubSpot portal ID for a deletion request.

For data-protection authority complaints, the relevant authority depends on your jurisdiction: in the EU / EEA, the supervisory authority where your business is established; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency.

Last reviewed: 2026-05-30. Canonical claim language is maintained in our internal WEBSITE_COPY.md and PRIVACY_FIREWALL_MILESTONE.md. This page is a technical privacy explanation, not legal advice, and is pending privacy-counsel review before commercial launch.