Maps by Vexco privacy policy

Last updated: 12/11/2026

This policy explains how the Maps by Vexco app for HubSpot handles data. Vexco's general privacy policy covers its other services.

Controller

Soluciones Digitales Vexco, S.L. (Tax ID B44978617), Av. Francesc Macià, 35 (Cambra de Comerç de Sabadell), 08206 Sabadell (Barcelona), España. Contact: javier@vexcosolutions.com.

For the CRM data the app reads to draw the map, your company is the controller and Vexco acts as processor (GDPR art. 28), following only your instructions (your configuration in the app).

What data we process

• Account data: HubSpot portal ID, domain, email of the installing user, language and app settings.
• Credentials: HubSpot OAuth tokens and, if you add one, your address service key, stored encrypted (AES-256-GCM). They are never displayed and never leave our server except to call that service.
• Map data: for the objects in the layers you enable, the address, coordinates, title, subtitle, owner and the properties you choose to show. The app only reads from HubSpot: it never creates, changes or deletes records.
• Address cache: a fingerprint (hash) of each address with its coordinates, so they are not calculated again.
• In the browser: if "Remember the view" is on, each user's last area, style and filters are stored in their own browser (localStorage), not on our server.

Why

Only to provide the service: drawing the map and the record card as configured, turning addresses into coordinates, support and error alerts. We don't sell data or use it for advertising or model training.

Where and with whom

• Cloudflare (hosting and database, with data in the European Union jurisdiction).
• HubSpot, where the records are read from.
• Address service: the address text (not names or any other data) is sent to Geoapify (included service) or to the provider of your own key (Google, OpenCage, Geoapify or Mapbox) to get its coordinates.
• Base map: map tiles are downloaded from OpenFreeMap by each user's browser; no CRM data is sent to them.

How long

• Map data is refreshed every 5 minutes and removed when a record stops matching the filters, is deleted or merged.
• When you uninstall the app, we stop using your credentials immediately and delete everything we store for your account after 30 days. You can request immediate deletion by email.

Security

Encrypted connections (TLS), credentials encrypted at rest, signature verification on every HubSpot request, signed temporary map links, and per-portal data isolation.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing javier@vexcosolutions.com, and complain to the Spanish Data Protection Agency (aepd.es).