Privacy Policy
Last updated 29 July 2026
This policy describes how Turbyn handles data. It reflects how the service is actually built, not a template.
Turbyn provides a workflow action for HubSpot. You write code in Turbyn; HubSpot calls it as a step in your workflows. That arrangement determines most of what follows.
Two roles
For account data (your name, email, workspace settings) Turbyn is the controller. We decide what to collect and why.
For CRM data that passes through an execution Turbyn is a processor acting on your instructions. Your code decides what to read and write; we run it and record the result so you can inspect and replay it. You remain the controller of that data and of your relationship with the people it describes.
What we collect
Account data
Your name, email address and workspace membership, handled by our authentication provider. We store an identifier plus your workspace preferences against it. We do not collect payment card details directly; if and when billing is enabled, card data is handled by the payment processor and never reaches our servers.
HubSpot connection data
When you connect a portal we receive OAuth access and refresh tokens and your portal identifier. Tokens are encrypted using envelope encryption: a per-tenant key, itself wrapped by a key held in Google Cloud KMS. They are decrypted server-side only at the moment of use, are never sent to the browser, and are excluded from logs.
CRM data passing through an execution
This is the significant category. When one of your actions runs, HubSpot sends the enrollment payload: the object identifier and whichever properties the action was configured to request. Your code may fetch additional records through the provided HubSpot client. That data is:
- held in memory inside an isolated sandbox for the duration of the run;
- recorded as part of the run’s input and output payloads, so you can inspect and replay the execution;
- captured in console output if your code logs it.
Logging is under your control. We do not filter what you choose to log, so treat the run console as a place your own data will be stored.
Secrets
Values you store in the secrets vault are encrypted at rest, decrypted only immediately before an execution, and injected as environment variables. They are never returned to the browser after being saved and are excluded from logs.
Your code
The code you write is stored so that it can be executed, and each published version is retained so you can roll back. It is not read, analysed or used for any other purpose, and it is not used to train anything.
Where data is stored
Turbyn runs on Google Cloud in the United States (us-central1).
| Purpose | Provider |
|---|---|
| Authentication | Clerk |
| Database, file storage, functions, hosting | Google Cloud / Firebase |
| Key management for token and secret encryption | Google Cloud KMS |
| Code execution sandboxes | E2B |
| Rate limiting | Upstash |
| Log storage | Axiom |
| Transactional and alert email | Resend |
| The CRM you connect | HubSpot |
If you are in the UK or EEA, your data is transferred to and processed in the United States. Where required, those transfers rely on Standard Contractual Clauses with the providers above.
How long we keep it
Run history, including stored payloads and console output, is retained for the period stated in your plan (7, 30 or 90 days). After that the records and their stored blobs are deleted.
Deleting an action removes its code and its versions. Closing your workspace deletes your actions, versions, run history and stored secrets. Connection tokens are deleted when you disconnect a portal.
Backups are retained for up to 30 days beyond deletion, after which they expire.
Who we share it with
We do not sell personal data, and we do not share it for advertising.
Data is shared only with the infrastructure providers listed above, each acting as a sub-processor under contract, and with HubSpot, to whom we return your action’s results so your workflow can continue.
We may disclose data if legally required to do so, and will tell you unless prohibited from doing so.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to processing, or withdraw consent.
Most of this you can do yourself: run history and actions are deletable from the app, and closing a workspace removes the rest. For anything else, email the address below. We will respond within 30 days.
If we process CRM data on your behalf and one of your contacts exercises a right against you, we will assist you in meeting it.
Security
Data is encrypted in transit and at rest. OAuth tokens and vault secrets use envelope encryption with keys held in a managed key service. Each execution runs in an isolated single-use sandbox, so no two customers’ code shares a runtime. OAuth scopes are requested at the minimum needed for the object types you choose.
If a breach affects your data, we will notify you without undue delay and in any case within 72 hours of becoming aware of it.
Cookies
The marketing site sets no cookies and runs no analytics or tracking scripts. The application sets only the cookies required to keep you signed in.
Changes
If this policy changes materially we will email workspace owners before the change takes effect. The date at the top always reflects the current version.
Contact
Questions about this policy, or to exercise any of the rights above: hello@useturbyn.com