Privacy Policy

1. About This Policy

Association Mirror is operated by Bigbee Solutions LLC ("Bigbee Solutions," "we," "us," or "our"). This policy explains how we handle information when you visit associationmirror.com, create an Association Mirror account, connect a HubSpot account, or use our workflow action (collectively, the "Service").

Bigbee Solutions is responsible for account, billing, and service-administration data. When the Service processes CRM data at your direction, your organization remains responsible for that CRM data and Bigbee Solutions processes it only to provide the requested workflow functionality.

2. Information We Collect and Process

2.1 Account information

• Name, email address, optional company name, and account preferences.
• A one-way password hash. We do not store your plaintext password.
• Login session, password-reset, and account-security information.

2.2 HubSpot integration information

• Connected HubSpot portal IDs, installation status, OAuth token expiry, and the scopes granted for workflow automation, core CRM objects, optional standard objects, and custom objects.
• HubSpot OAuth access and refresh tokens, encrypted at rest.
• CRM object identifiers, object-type metadata, and association data requested from HubSpot while a workflow action is running. The available types are limited to association-capable objects enabled and authorized in the connected portal. Products and Users are not available as association targets or filters because HubSpot does not allow those objects to be associated; an execution enrolling either as a source is rejected.
• Association Mirror reads record relationships and sends default/unlabeled association changes back to HubSpot. It does not copy custom association labels or update CRM record properties. In ordinary operation, we store execution metadata such as portal ID, source and destination object IDs and types, counts, status, timing, and error details—not full CRM record contents.

2.3 Billing information

• Selected plan, subscription status, billing period, and Stripe customer/subscription IDs.
• Stripe processes payment-card and other payment details. Association Mirror does not receive or store complete card numbers.

2.4 Technical, sales, and support information

• IP address, request and security logs, browser-supplied data, and essential session cookies.
• Cloudflare Turnstile results and security signals used to protect public forms, including registration and sales inquiries.
• Contact and business details, expected portal and workflow volume, and messages you choose to send through our sales or support channels.

3. How We Use Information

• Provide accounts, authenticate users, and maintain secure sessions.
• Connect authorized HubSpot portals and execute the workflow actions you configure.
• Measure plan usage, show execution history, and enforce plan limits.
• Process subscriptions, respond to sales and support requests, and send transactional notices.
• Protect the Service, investigate errors or abuse, and comply with legal obligations.
• Maintain and improve reliability without selling personal information or using it for targeted advertising.

4. Service Providers and Disclosures

We use the following providers to operate the Service:

• HubSpot for OAuth authorization and CRM APIs.
• Stripe for Checkout, subscription billing, invoices, and the customer billing portal.
• SendGrid for account, password-reset, usage, sales-inquiry, and support-related email.
• Hostinger for application, database, and queue infrastructure.
• Cloudflare for DNS, network delivery, secure tunneling, traffic protection, and Turnstile.

These providers process information under their own terms and privacy commitments. We may also disclose information when required by law, to protect users or the Service, or as part of a merger, financing, acquisition, or sale of assets. We do not sell personal information.

5. Cookies and Similar Technologies

Association Mirror uses essential cookies for login sessions, security, and request protection. Cloudflare may also process device and network signals when providing Turnstile and other security services. We do not currently use third-party advertising cookies.

6. Security

Our safeguards include:

• HTTPS transport and Cloudflare network protections.
• bcrypt password hashing and encrypted HubSpot OAuth tokens.
• Restricted production secrets, access controls, request validation, and rate limiting.
• Separate application, database, and queue services with authenticated internal connections.

No system is completely secure. You are responsible for protecting your account credentials, reviewing the HubSpot permissions you grant, and promptly reporting suspected unauthorized access.

7. Retention

We keep account, integration, execution, and subscription records while your account is active and as reasonably needed to provide and secure the Service. After a verified deletion request, we remove eligible information from active systems. Limited records may be retained when needed for billing, tax, fraud prevention, dispute resolution, security, or other legal obligations. Residual encrypted backup copies are removed through the normal backup lifecycle.

8. Account and HubSpot Data Deletion

You can request deletion at any time. This is Association Mirror's public data-deletion procedure for users and HubSpot marketplace customers:

1. If possible, first uninstall Association Mirror from each connected HubSpot portal to revoke future access. In HubSpot, open Settings → Integrations → Connected Apps, choose Actions → Uninstall for Association Mirror, type uninstall, and confirm.
2. If you have a paid plan, open the Association Mirror dashboard and use the Stripe billing portal to cancel it. Account deletion does not by itself create a refund.
3. Email [email protected] with the subject Association Mirror Data Deletion Request. Include the email address on your Association Mirror account and the HubSpot portal ID(s) involved. Do not send passwords, OAuth tokens, or payment-card details.

After verifying the request, we will delete eligible account profile data, HubSpot installation records and OAuth tokens, workflow execution history, and active sessions from operational systems. We will confirm completion by email. Verified requests are ordinarily completed within 30 days, unless applicable law permits or requires longer retention.

Public deletion instructions are available at https://associationmirror.com/privacy-policy#data-deletion.

9. Your Privacy Choices and Rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to certain processing of personal information. You may also have the right to appeal a decision or complain to a data-protection authority. To make a request, follow the process above or email [email protected]. We may need to verify your identity and authority over the relevant account.

We do not sell or share personal information for cross-context behavioral advertising and therefore do not offer an opt-out for those practices.

10. International Processing

Our providers may process information in the United States and other countries where they operate. Where required, we rely on contractual and other lawful safeguards for cross-border transfers.

11. Children

The Service is intended for business users and is not directed to children under 18. If you believe a child provided personal information to us, contact us so we can review and remove it.

12. Changes to This Policy

We may update this policy as the Service or legal requirements change. We will post the current version here and update the date above. If a change materially affects registered users, we may also provide notice through the Service or by email.

13. Contact

Association Mirror / Bigbee Solutions LLC
Email: [email protected]
Website: https://associationmirror.com
Support: https://associationmirror.com/setup-guide#support