Subsettle ← Back to site

⚠️ Starter template — not legal advice. This document is a customizable draft, not a lawyer-reviewed policy. Replace every [bracketed] placeholder with your real details, and have an attorney review it before launch — especially the data-handling and rights sections.

Privacy Policy

Last updated: [June 22, 2026]

This Privacy Policy explains how Subsettle ("Subsettle", "we", "us"), operated by [Your legal entity name], collects, uses, and protects information when you use our website and application (the "Service"). By using the Service, you agree to this Policy.

1. Information we collect

Account information. When you create an account, we collect your email address and a password. Authentication and password storage are handled by our provider (Supabase); your password is stored hashed and we never see it.
Business data you enter. The information you add to track your work — jobs, pay applications, general contractors, amounts billed/paid/outstanding, retainage, project details, generated demand-letter drafts, and the business identity you put on those letters (e.g., business name, address, license number).
Payment information. Subscriptions are processed by Stripe. Stripe collects and stores your payment details; we never receive or store your full card number. We receive limited billing metadata (e.g., subscription status, the last four digits, renewal dates) needed to manage your access.
Local device storage. We use your browser's local storage to run the app and keep you signed in. In local-only mode (no account), your data stays in your browser and is never transmitted to us.
Limited technical data. Standard server logs from our hosting providers (e.g., IP address, timestamps) for security and reliability. [If you add analytics, disclose it here.]

2. How we use your information

To provide, operate, and maintain the Service.
To create and manage your account and process your subscription.
To send you service- and billing-related messages (e.g., receipts, renewal or payment-failure notices, important changes).
To provide support and respond to your requests.
To protect the Service against fraud, abuse, and security threats.
To comply with legal obligations.

We do not sell your personal information, and we do not use your business data for advertising.

3. How your data is stored and protected

In cloud mode, your data is stored in a managed PostgreSQL database hosted by Supabase [region, e.g., US]. Access is protected by row-level security so each account can only read and write its own data, and all traffic is encrypted in transit (HTTPS). No method of storage or transmission is 100% secure, but we take reasonable measures to protect your information. In local-only mode, your data never leaves your device.

4. Sharing and service providers (subprocessors)

We share information only as needed to run the Service, with:

Supabase — database hosting and authentication (supabase.com/privacy).
Stripe — payment processing (stripe.com/privacy).
Legal/safety. When required by law, or to protect our rights, users, or the public.

We do not sell or rent your data to third parties.

5. Your rights and choices

Access & export. You can view your data in the app and export it as JSON at any time (Settings → Data).
Correct. Edit or update your data directly in the app.
Delete. You can delete your account and associated data by contacting us at [contact email] [or describe in-app deletion].
Cancel. Cancel your subscription anytime; see the Terms of Service.
Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA/CPRA (access, correction, deletion, portability, and to opt out of "sales" — which we do not do). To exercise these, contact [contact email].

6. Data retention

We keep your data while your account is active. After you delete your account, we delete your business data within [e.g., 30 days], except where we must retain records to comply with legal, tax, or accounting obligations (for example, Stripe transaction records).

7. Cookies and local storage

We use your browser's local storage to operate the app and maintain your login session. We do not use third-party advertising or cross-site tracking cookies. [Update if this changes.]

8. Children

The Service is a business tool intended for adults and is not directed to children under [18]. We do not knowingly collect information from children.

9. International users

We operate from [your country/state] and your information may be processed there and in the regions where our providers operate. By using the Service you consent to this processing.

10. Changes to this Policy

We may update this Policy from time to time. We'll post the new version here and update the "Last updated" date; significant changes will be communicated where appropriate.

11. Contact us

Questions about this Policy or your data? Contact [contact email] [, mailing address].