Zoho vs HubSpot: Comparing Data Ownership
This is the third piece in a short series that started with HubSpot's withdrawn enrichment terms and continued through data sovereignty and legitimate interests under UK GDPR. This one is more direct: a factual, side-by-side comparison of how Zoho and HubSpot actually handle customer data, drawn from each vendor's own published policies rather than either company's marketing.
We work with Zoho, so we will say upfront that this comparison is not neutral in the sense of having no stake in the outcome. What we have tried to keep neutral is the sourcing. Every claim below is attributed to a specific published policy, dated where the date matters, with the caveat that vendor policies change and you should verify the current wording yourself before making a decision based on it.
Data Ownership and Advertising, Side by Side
| Dimension | Zoho | HubSpot |
|---|---|---|
| Advertising business model | States it does not run an advertising business and does not monetise customer data for ads | Its privacy policy states it allows advertising networks to collect interaction data and may share personal data, such as email addresses, with advertising partners for personalised ads |
| Ownership structure | Privately held, no external shareholders | Publicly listed company |
| Cross-customer data enrichment | No announced programme pooling one customer's CRM data to enrich another customer's records | Announced a shared enrichment dataset (Contact Discovery) on 1 July 2026, then withdrew the terms on 5 July 2026 after customer backlash |
| Data centre regions | Multiple regions including the EU, with migration on request | Offers regional data hosting options; check current documentation for which regions apply to your subscription tier |
| Government data request transparency | Publishes a Data Processing Addendum and privacy documentation; a dedicated public transparency report was not identified during our research | Publishes a dedicated data disclosure and transparency policy stating it had not received a National Security Letter or FISA order as of 1 March 2026 |
Two rows are worth reading carefully rather than skimming. HubSpot's own privacy policy is explicit about sharing data with advertising partners for personalised ads, which is a materially different starting position from a vendor that states outright it does not run an ad-tech business. On the other side, HubSpot publishes a specific, dated government-request transparency report, which is a level of disclosure we could not find an equivalent public document for on Zoho's side during our research. Neither vendor comes out ahead on every row.
What Actually Happened, and What Didn't
It's worth being precise about the July episode, since the coverage has ranged from measured to alarmist.
What Changed at HubSpot
On 1 July 2026, HubSpot updated five linked documents, its customer terms of service, product-specific terms, privacy policy, sub-processors page, and Data Processing Agreement, to enable a new Contact Discovery feature built on pooled enrichment data. Participation was reported to be on by default, with customers needing to actively opt out before 4 August. Reporting also indicated that enrichment participation, AI model training, and tracking-code intent sharing sat as three separate settings, meaning turning one off did not turn off the others.
What Didn't Happen
No regulator intervened, and no lawsuit was filed. The reversal was driven entirely by public criticism, mainly on LinkedIn and in HubSpot's own community forum, over the four days between the announcement and the withdrawal. No customer data was reported to have actually been pooled under the new terms before they were withdrawn, since the underlying feature had not gone live.
Zoho's Position, By Comparison
Zoho has not announced a comparable cross-customer enrichment programme. Its published privacy materials state a long-standing position of not selling personal data and not building an advertising business on customer data. That is Zoho's own stated position, not an independently audited guarantee, and the same standard of verification applies: read the current Zoho privacy policy and DPA yourself rather than taking any summary, including this one, as final.
A fair comparison checks both vendors' own current policies, not one company's marketing page against the other's worst week.
Who This Actually Matters To
Enrichment, AI training, and advertising-sharing settings are often separate toggles, on any vendor's platform, worth checking individually rather than assuming one switch covers all three.
A vendor's marketing page and its actual current terms of service can say different things, so procurement decisions should reference the terms directly, not a summary.
A publicly listed vendor answers to shareholders in ways a privately held one does not, which can influence future data monetisation decisions over time.
If you manage CRM instances for clients, a periodic review of enrichment and advertising-sharing settings protects your client relationship as much as it protects the end customer.
Four Questions for Comparing Any Two CRM Vendors
Check the current privacy policy directly for language about advertising partners and personalised ads, not just a marketing claim.
Ask specifically whether any enrichment feature draws on other customers' data, or only on public and licensed third-party sources.
Ask for a full list of every data-sharing and AI-training toggle relevant to your account, rather than assuming one setting covers all of them.
Note whether the vendor is privately held or publicly listed, and factor that into how much the current policy might change in future.
What This Means for UK and Irish Businesses
If you are choosing between Zoho and HubSpot, or reviewing either one you already use, the comparison above is a starting point, not a verdict. Zoho's stated position on advertising and cross-customer data sharing is genuinely different from what HubSpot's own privacy policy currently describes, and that difference is worth weighing if it matters to your business. It is equally fair to note that HubSpot's public transparency reporting on government data requests is more detailed than anything we could find published in the same format by Zoho, which is a point in HubSpot's favour worth acknowledging rather than glossing over.
The broader lesson from this three-part series holds regardless of which vendor you choose: read the current terms yourself, check every relevant toggle rather than one, and treat a vendor's public commitments as a starting point for your own due diligence rather than a substitute for it.
If you would like help working through either vendor's current terms against your own compliance requirements, we are happy to talk it through with you, no obligation attached.