Legal

Privacy policy

Last updated: 20 July 2026

1. Who we are

Card Studio (hubspotcards.com) is provided by Consile ApS ("Consile", "we"), a Danish company. We are the data controller for the personal data described in this policy. You can always reach us at support@consile.dk.

2. What we process

Account data: your name, email address and either a password (stored as a salted hash, never in clear text) or the identity reference from your chosen sign-in provider (Google or HubSpot).
Workspace content: the cards you design, their versions, templates and publication settings.
HubSpot connection data: your portal id and the OAuth tokens or personal access keys needed to read CRM data and deploy apps on your behalf. Tokens and keys are encrypted at rest (AES-256-GCM), are scrubbed from logs, and never leave our servers.
CRM data in transit: when a card is previewed or rendered, the requested CRM properties pass through our service. We do not store your CRM records; card history contains the card design, not your CRM data. Values your team types into card forms are stored so the card can show them again.
Operational data: server logs with IP address, request metadata and timestamps, kept for security, troubleshooting and abuse prevention.

3. Why we process it

We process this data to deliver Card Studio to you (performance of contract), to keep the service secure (legitimate interest) and to comply with the law. We do not sell personal data, we show no advertising, and we do not profile you.

4. Where it lives

The application and its database run in the EU (Heroku's EU region, operated by Salesforce). We use these sub-processors: Salesforce/Heroku (hosting and backups), Google (only if you sign in with Google) and HubSpot (the platform the product integrates with).

5. How long we keep it

We keep your data for as long as your organization has an account. Encrypted backups are taken daily and rotate on a short schedule. If you delete your account, or ask us to, we delete your data within 30 days, after which it also rolls out of the backups.

6. Cookies

Card Studio sets a single strictly necessary session cookie so you can stay logged in. Your language preference is kept in your browser's localStorage. We use no tracking cookies, no analytics cookies and no third-party cookies, which is why you see no cookie banner.

7. Your rights

Under the GDPR you can request access to, rectification of, erasure of, restriction of, or a portable copy of your personal data, and you can object to our processing. Write to support@consile.dk and we will respond promptly. You can also complain to the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk).

8. Changes

We update this page when our practices change and adjust the date at the top. If a change is material, we flag it in the product or notify you by email.