Privacy Policy

CleanMerge · Effective September 3, 2026

This policy describes what data CleanMerge accesses, stores, and shares when you connect it to a HubSpot account. It is written to match how the app actually behaves today, not aspirationally.

What CleanMerge accesses

When you install CleanMerge, HubSpot grants it read-only access to Contact and Company records (via OAuth scopes crm.objects.contacts.read and crm.objects.companies.read) and issues an access/refresh token pair identifying your HubSpot portal.

Data	Why we access it
HubSpot OAuth tokens	To maintain the connection between CleanMerge and your HubSpot account.
Contact fields: `firstname`, `lastname`, `email`, `phone`	To detect likely duplicate Contact records.
Company fields: `name`, `domain`, `phone`	To detect likely duplicate Company records.
Workflow action input text	The value you choose to normalize (e.g. a name or phone number) inside a HubSpot workflow.

How we use it

Normalize CRM Data workflow action: the text value HubSpot passes in is transformed (case conversion, domain extraction, phone formatting, name splitting) and the result is returned to HubSpot's workflow engine. This happens in memory only — CleanMerge does not store the input or output text, and does not call the HubSpot CRM API for this feature.
Duplicate detection: Contact and Company field values are periodically read from your HubSpot portal to identify records that likely refer to the same person or company. Candidate duplicate pairs, their similarity scores, and (for ambiguous cases) an AI-generated judgment are stored so they can be reviewed. This tooling is currently operated internally by CleanMerge's developer and is not yet self-serve for installers.

Third parties we share data with

Party	What they receive	Why
Anthropic (Claude API)	Contact or Company field values for a specific candidate pair (e.g. two names, emails, or phone numbers being compared)	Only for pairs deterministic scoring can't confidently resolve, to get an AI judgment on whether they're the same real-world entity. Never sent for high-confidence or clearly-different pairs.
Railway (hosting)	All data described above, as our infrastructure and database provider	CleanMerge's server and database run on Railway's infrastructure.
HubSpot	N/A — HubSpot is the source of this data, not a recipient	—

We do not sell your data, and we do not share it with any party not listed above.

Storage and security

OAuth tokens are encrypted at rest (AES-256-GCM) before being stored.
Data in transit is encrypted via TLS.
Duplicate-candidate records (field snapshots, scores, AI judgments) are stored in our Postgres database, scoped to your HubSpot portal ID.

Data deletion: Uninstalling CleanMerge from HubSpot immediately stops it from accessing your data going forward, but does not automatically delete data already stored (OAuth tokens and duplicate-candidate records). To request deletion, email us at jay@kinetify.com and we will delete it. We are working toward automatic deletion on uninstall; until then, deletion requests are handled manually.

Your rights

You can request a copy of the data we hold about your portal, or request its deletion, at any time by emailing jay@kinetify.com.

Children's privacy

CleanMerge is a business tool intended for use by HubSpot customers and is not directed at children. We do not knowingly collect data from children.

Changes to this policy

If we change what data we collect or how we use it, we will update this page and revise the effective date above.