Skip to content
Ledion
Join the beta
Menu

Data processing agreement

Last updated:

This data processing agreement (DPA) is part of Ledion’s terms of service and takes effect when you accept them. It applies whenever Ledion processes personal data on your behalf. “You” means the business that uses Ledion. “Ledion” means Ledion LLC, a Florida limited liability company, at 10461 SW 204th Ter, Miami, FL 33189, USA.

1. Roles

  • You are the controller of the personal data Ledion processes for you, and Ledion is your processor. If you use Ledion for a client and are yourself a processor for that client, Ledion is your subprocessor, and this DPA applies the same way.
  • Where US state privacy laws apply, such as the California Consumer Privacy Act, Ledion is your service provider or processor as those laws define it. Ledion:
    • doesn’t sell the personal data, or share it for cross-context behavioral advertising
    • uses, keeps and discloses it only to provide Ledion to you, for the purposes in section 2, and only within its direct business relationship with you
    • doesn’t combine it with personal data it gets from anyone else, except as those laws allow
    • gives it the same level of privacy protection those laws require, and tells you if it can no longer meet its obligations under them
  • You can take reasonable steps to make sure Ledion uses the data as this DPA says, and to stop and fix any use it doesn’t allow. Ledion understands these restrictions and will comply with them.
  • Sending your conversions to the ad networks you connect is a disclosure you direct. What you send them, and any opt-out or limited data use setting that applies, is your decision.

2. The processing

  • Subject matter: sending your conversions from HubSpot to the ad networks you connect.
  • Duration: while you use Ledion, and until the data is deleted under section 8.
  • Nature: when a HubSpot workflow runs the Send conversion step, Ledion reads the record’s identifiers from HubSpot, normalizes them, hashes them where the network requires it, sends them to the networks you selected, and drops them. It keeps the HubSpot record ID and each network’s result, never the identifiers. The optional capture script runs in your visitors’ browsers, keeps ad click IDs in a first-party cookie and local storage, and fills your HubSpot forms. Nothing it reads reaches Ledion’s servers.
  • Purpose: uploading your conversions, with their values, to the ad networks you choose, and reporting each result back to you.
  • Categories of personal data: email addresses, phone numbers, names, address fields, and ad click and browser IDs (for example Google’s GCLID, Meta’s fbc and fbp, Microsoft’s MSCLKID and Reddit’s click ID), plus HubSpot record IDs and each conversion’s time, value and currency.
  • Data subjects: your leads and customers.
  • Special categories of data: none. Don’t set Ledion up to send them.

3. Your instructions

Ledion processes personal data only on your documented instructions: these terms, this DPA, and the way you set up Ledion (conversions, networks, workflows and settings). That includes sending data to the ad networks you connect, wherever they are. If a law requires Ledion to process the data in another way, Ledion tells you first, unless that law forbids it. If Ledion believes an instruction breaks data protection law, it tells you.

4. Confidentiality and security

  • Everyone Ledion authorizes to process your personal data is bound by confidentiality.
  • Ledion applies the technical and organizational measures in Annex 2, and helps you meet your own security obligations as far as the nature of the processing and the information Ledion has allow.

5. Subprocessors

  • You authorize Ledion to use the subprocessors in Annex 3.
  • Before Ledion adds or replaces a subprocessor, it updates the Subprocessors page and emails the person who installed Ledion, at least 30 days before the change. You can object on reasonable grounds. If Ledion can’t address your objection, you can cancel before the change takes effect.
  • Ledion puts each subprocessor under data protection terms that protect your data at least as well as this DPA, and stays responsible for its subprocessors.
  • The ad networks you connect aren’t Ledion’s subprocessors. They receive data on your instruction and are independent controllers or processors under their own terms with you.

6. Helping you

  • Data subject requests. Ledion helps you answer requests to access, correct or delete personal data, and passes on any request it receives about your data. Ledion doesn’t store identifiers, so it usually has nothing to retrieve.
  • Assessments. Ledion gives you the information you reasonably need for data protection impact assessments and for consulting a supervisory authority about Ledion.

7. Personal data breaches

Ledion tells you without undue delay, and within 72 hours of becoming aware of it, about any personal data breach that affects your data. The notice says what’s known at the time: what happened, which data is affected, and what Ledion is doing about it. Ledion sends updates as it learns more.

8. Deletion

  • When you uninstall Ledion, it stops processing at once and deletes everything it stores for your HubSpot account 30 days later.
  • If you ask for deletion before then, Ledion deletes it within 30 days of confirming the request.
  • Network credentials are deleted as soon as you disconnect the network.
  • One exception: if a paid plan is still billing when Ledion is uninstalled, Ledion keeps your account’s data until the subscription is canceled, so the subscription isn’t lost or charged twice. Santi gets an alert from the day after the uninstall to cancel it with you. Once it’s canceled, the data is deleted within a day, or 30 days after the uninstall if that’s later.
  • Ledion holds no copies of your contacts’ identifiers. If you want a copy of what it does store for your account (the send log, with record IDs and results) before it’s deleted, ask before the deletion date and Ledion sends it to you. Deleted data can stay in the database’s point-in-time backups for up to 30 days more.

9. Audits

Ledion gives you the information you need to show that it meets this DPA. On reasonable request and with reasonable notice, Ledion allows and contributes to audits by you or an auditor you appoint who is bound by confidentiality.

10. International transfers

  • When personal data from the EEA goes to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 apply, with you as data exporter and Ledion as data importer: Module 2 (controller to processor) where you’re a controller, and Module 3 (processor to processor) where you’re a processor. They’re part of this DPA by reference.
  • In those clauses: the optional docking clause in Clause 7 doesn’t apply. In Clause 9, option 2 (general written authorization) applies, with 30 days’ notice as in section 5. The optional language in Clause 11 doesn’t apply. In Clause 17, option 1 applies, and the clauses are governed by the law of Ireland. Under Clause 18(b), disputes go to the courts of Ireland. Annexes 1 to 3 below complete the clauses’ annexes.
  • For personal data from the UK, the International Data Transfer Addendum to those clauses, issued by the UK Information Commissioner, applies too, with Annexes 1 to 3 below as its appendix information. Neither party may end it when the Commissioner issues a new version. It’s part of this DPA by reference, as “Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.”
  • If the clauses and this DPA conflict, the clauses win. If this DPA and the terms conflict, this DPA wins.

Annex 1: Parties and processing

  • Data exporter: you, as identified in your HubSpot account and your Ledion billing details. Contact: the person who installed Ledion. Role: controller, or processor for your client.
  • Data importer: Ledion LLC, 10461 SW 204th Ter, Miami, FL 33189, USA. Contact: Santi, santi@ledion.io. Role: processor.
  • Processing and purpose: as described in section 2. It happens each time one of your workflows runs the Send conversion step.
  • Retention: identifiers aren’t stored. Send logs (no identifiers) are kept for 90 days, and everything else as in section 8.
  • Transfers to subprocessors: Cloudflare runs the processing and stores the send log. Stripe receives your billing details only, never your contacts’ data.
  • Competent supervisory authority: the one that Clause 13 of the clauses points to for you.

Annex 2: Technical and organizational measures

Data handling

  • No identifiers at rest. Email addresses, phone numbers, names, addresses, IP addresses, user agents and click IDs, raw or hashed, are never written to the database, queue messages, logs or error messages. Ledion fetches them from HubSpot at send time, normalizes and hashes them, sends them, and drops them.
  • Ledion stores only yes or no for each kind of identifier that was present on a send.
  • Besides HubSpot record IDs and send results, the only personal data Ledion stores for your account is your alert recipients’ email addresses and HubSpot user IDs.
  • Queue messages carry IDs only.
  • Error messages from the networks are cleaned before they’re stored or shown: anything that looks like an email address, phone number, token or long hex string is removed, and the length is capped at 300 characters.

Secrets and encryption

  • Every credential and key is kept as a Cloudflare Worker secret, never in code or configuration files.
  • Access tokens are encrypted at rest with AES-256-GCM, a new random 12-byte IV for every encryption, and the row they belong to bound into the encryption, so a token can’t be moved to another account. Keys are versioned and can be rotated.
  • Sign-in flows (OAuth) use a random, single-use state that expires after 10 minutes, plus PKCE where the provider supports it.
  • Signed links use HMAC-SHA256 and expire: the link that starts connecting a network after 10 minutes, and the Manage billing link to Stripe’s customer portal after 1 hour.

Checking every request

  • Requests from HubSpot must carry a valid HubSpot signature no more than 5 minutes old, compared in constant time.
  • Stripe webhooks are verified with Stripe’s signature.
  • Public endpoints that need no sign-in, such as the beta form and the HubSpot install link, sit behind a per-IP rate limit at Cloudflare’s edge. The beta form also requires Cloudflare Turnstile.
  • The admin area sits behind Cloudflare Access, and Ledion verifies Access’s token on every request.
  • Account isolation: every query for customer data is limited to the HubSpot account in the verified request.

Least privilege

  • Ledion asks HubSpot only for the scopes it uses, and each ad network only for what uploads and listing destinations need.
  • Automated builds hold no Cloudflare credentials. Any Cloudflare API token Ledion’s automation is given is limited to Ledion’s Workers, database and queues.

Logging

  • Logs are structured and contain IDs and result codes only.
  • Ledion never logs requests to or responses from the networks, HubSpot record properties, tokens or authorization headers. A redaction list removes fields such as email, phone, tokens and click IDs if they’re ever passed to a log.

Deletion

  • Uninstalling stops processing at once, and the account’s data is deleted 30 days later, or once a subscription that’s still billing is canceled, if that’s later.
  • Deletion requests are completed within 30 days.
  • Disconnecting a network deletes its credentials at once.

Annex 3: Subprocessors

Subprocessor Purpose Location
Cloudflare, Inc. Hosting, database, queues, alert and account email, web analytics Global edge network
Stripe, Inc. Payments and billing USA

Ad networks you connect (Google, Meta, Microsoft, Reddit) receive data on your instruction and are independent controllers or processors under their own terms.