Holded by Vexco privacy policy

Last updated: 27/10/2026

This policy explains how the Holded by Vexco app for HubSpot handles data. Vexco's general privacy policy covers its other services.

Controller

Soluciones Digitales Vexco, S.L. (Tax ID B44978617), Av. Francesc Macià, 35 (Cambra de Comerç de Sabadell), 08206 Sabadell (Barcelona), España. Contact: javier@vexcosolutions.com.

For your customers' data that the app copies between HubSpot and Holded, your company is the controller and Vexco acts as processor (GDPR art. 28), following only your instructions (your configuration in the app).

What data we process

• Account data: HubSpot portal ID, domain, email of the installing user, language and app settings.
• Credentials: HubSpot OAuth tokens and your Holded API key, stored encrypted with AES-256-GCM. They are never displayed and never leave our server.
• Synced data: data from the objects you enable (companies, contacts, products, sales documents, invoices, payments, opportunities and projects) moving from one system to the other. We don't keep a copy of your CRM: only the IDs linking each record, a summary of the last synced state to detect changes and conflicts, and the activity log.
• Billing data for the app subscription, where applicable.

Why

Only to provide the service: syncing HubSpot and Holded as configured, showing cards and the activity log, alerting you about errors, support and billing. We don't sell data or use it for advertising or model training.

Where and with whom

• Cloudflare (hosting and database, with data in the European Union jurisdiction).
• HubSpot and Holded, the two systems you connect.
• Stripe, only to charge the subscription if you pay by card.

How long

• The activity log is deleted after 30 days.
• When you uninstall the app, we stop using your credentials and delete everything we store for your account after 30 days. You can request immediate deletion in the app (Connection → «Delete all app data») or by email.
• Billing data is kept as long as the law requires.

Security

Encrypted connections (TLS), credentials encrypted at rest, signature verification on every HubSpot and Holded notification, app access restricted to authorized users of your portal, and per-portal data isolation.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing javier@vexcosolutions.com, and complain to the Spanish Data Protection Agency (aepd.es).