Privacy Policy
Last Updated: March 14, 2026 | Effective Date: March 14, 2026
Third Space, LLC ("Thirdspace," "we," "us," or "our") operates Emergency Unmerge by Third Space ("the Service"), a HubSpot integration that provides proprietary record recovery for accidental CRM merges. This Privacy Policy describes how we collect, use, store, share, and protect information when you use the Service.
If you have questions about this Privacy Policy, contact us at joshua@thirdspaced.com.
Data Controller: Third Space, LLC. Email: joshua@thirdspaced.com. Website: https://emergencyunmerge.com
Data Processor: When we process HubSpot CRM data on your behalf, your organization is the Data Controller and we act as a Data Processor.
1. Information We Collect
1.1 HubSpot CRM Data (Processed, Stored Encrypted for a Limited Time)
When you use Emergency Unmerge, we access the following data from your HubSpot portal via HubSpot's API:
- Record properties and property history (contacts, companies, deals)
- Association data (linked records, activities, notes, emails, tasks, calls)
- Merge metadata (hs_merged_object_ids, timestamps)
This data is used to reconstruct your pre-merge records. It is stored encrypted (AES-128, the same protection we use for backup snapshots) as part of your operation record for 30 days after the operation completes, so you can review the results and we can support you. After that window it is automatically purged and is never used for anything except your operation. See Section 3 for how it is handled during processing and Section 5 for the full retention schedule.
1.2 Account and Billing Data (Stored)
- HubSpot Portal ID: Used to identify your account and manage credits.
- OAuth tokens: Encrypted and stored to maintain your HubSpot connection.
- Credit balance and transaction history: Stored for billing and audit purposes.
- Operation metadata: Job IDs, timestamps, record IDs, status (success/failure), processing model used, token counts, and complexity metrics for audit trail.
- Analysis and reconstruction data: The reconstruction output (property assignments, associations, confidence scores), any manual corrections you make, and recovery snapshots (pre/post execution record states) are stored encrypted as part of the operation record for 30 days after the operation completes, to support the Property Editor and snapshot download features. See Section 5 for the retention schedule.
1.3 Payment Information
Payment processing is handled by Stripe, Inc. We do not store credit card numbers, bank account details, or other payment instrument information. See Stripe's Privacy Policy.
2. How We Use Your Data
- Reconstruction: CRM data is sent to Anthropic's Claude API to analyze and reconstruct pre-merge records. This is the core function of the Service.
- Billing: Portal ID and credit transactions are used to manage your account balance.
- Audit Trail: Operation metadata is stored to provide a history of unmerge operations.
- Support: We may access operation metadata to diagnose issues you report.
- Service Improvement: Aggregate, anonymized usage statistics (e.g., success rates, average complexity) may be used to improve the Service.
3. Data Processing (Anthropic Claude)
Emergency Unmerge sends CRM data to Anthropic's Claude API for reconstruction. You should understand how this data is handled.
- Data is sent to Anthropic via encrypted HTTPS API calls.
- Per Anthropic's commercial API terms, your data is NOT used to train models.
- Anthropic may retain API inputs/outputs for up to 30 days for trust and safety monitoring.
- After 30 days, data is deleted from Anthropic's systems.
- See Anthropic's Privacy Policy for full details.
4. Lawful Basis for Processing (GDPR)
As a Data Processor for CRM data, the lawful basis determination falls on you (the Data Controller). We process CRM data solely on your documented instructions.
As a Data Controller for our own account and operational data, we rely on:
- Contract performance (Article 6(1)(b)): Processing necessary to deliver the Emergency Unmerge service.
- Legitimate interest (Article 6(1)(f)): Security monitoring, fraud prevention, and service reliability.
- Legal obligation (Article 6(1)(c)): Retaining billing records and tax documentation as required by law.
5. Data Retention
| Data Category | Retention Period |
|---|---|
| Operation metadata (job IDs, timestamps, status, credits; no CRM record content) | Kept as billing and audit history. All CRM record content within these records is purged per the row below, including within 30 days of account termination. |
| CRM record data, reconstruction output & recovery snapshots | Stored encrypted (AES-128, same protection as backup snapshots) for 30 days after the operation completes, then automatically purged. Operations left unfinished (for example, a scan or review you never complete) are automatically expired and purged after 90 days of inactivity. The operation record itself (status, credits, timestamps) is kept per the row above. |
| OAuth tokens (encrypted) | Duration of active integration; deleted on uninstall |
| Credit balances | Duration of active account |
| Processing data (Anthropic) | 30 days maximum per Anthropic Commercial Terms |
| Billing and payment records | 7 years (tax/legal compliance) |
6. Data Sharing and Sub-Processors
We do not sell your data. We share data only with the following sub-processors, each bound by data processing agreements:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Anthropic | Reconstruction analysis | United States |
| Render | Application hosting, database | United States |
| Stripe | Payment processing | United States |
| Sentry | Error monitoring (PII disabled) | United States |
7. International Data Transfers
Our infrastructure is hosted in the United States. If you are located in the EEA, UK, or Switzerland, personal data is transferred to the US. We rely on:
- EU-US Data Privacy Framework (DPF) where sub-processors are certified.
- Standard Contractual Clauses (SCCs) as supplementary safeguards with all sub-processors.
- UK International Data Transfer Agreement / UK Addendum for UK transfers.
8. Security
- All data in transit encrypted via TLS 1.2 or higher
- OAuth tokens encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256)
- Database access restricted to application service only (no public access)
- HTTPS enforced across all endpoints with HSTS headers
- Error monitoring via Sentry with PII sending disabled
- Infrastructure hosted on Render.com (SOC 2 Type II certified data centers)
9. Your Data Protection Rights
Depending on your jurisdiction, you may have the following rights:
- Right of Access: Request a copy of the personal data we hold about you or your portal.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
- Right to Restriction of Processing: Request that we limit how we process your data.
- Right to Data Portability: Receive your data in a structured, machine-readable format (JSON).
- Right to Object: Object to processing based on legitimate interests.
- Right Related to Automated Decision-Making: Emergency Unmerge includes mandatory human review before execution. No fully automated decisions with legal effects are made.
To exercise these rights, contact joshua@thirdspaced.com. We respond within 30 days.
10. California Privacy Rights (CCPA/CPRA)
If you are a California resident:
- Right to Know: Request the categories and specific pieces of personal information we have collected.
- Right to Delete: Request deletion of your personal information.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing: We do not sell or share personal information. No opt-out is necessary.
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights.
CCPA Service Provider Designation: For CRM data processed on behalf of our customers, Third Space, LLC is a "Service Provider" as defined by the CCPA.
11. Cookies
We use only strictly necessary session cookies for authenticated sessions. We do not use analytics, advertising, or third-party tracking cookies.
12. Children's Privacy
Emergency Unmerge is a business-to-business product not directed at individuals under 16. We do not knowingly collect data from children.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify installed portal administrators via email at least 30 days before changes take effect.
14. Complaint Rights and Contact
If you believe your data protection rights have been violated, you may lodge a complaint with:
- EU: Your local Data Protection Authority (edpb.europa.eu)
- UK: The ICO (ico.org.uk)
- California: The CPPA (cppa.ca.gov)
Third Space, LLC
Email: joshua@thirdspaced.com
Website: https://emergencyunmerge.com