Privacy Policy

1. Introduction

At SubDoc, we value the trust you place in us to manage your vendor compliance documents. This Privacy Policy explains how we collect, use, and protect information when you visit our website, set up a workspace, or submit documents through our platform.

This policy applies to workspace administrators, company team members, and the vendors or subcontractors who upload documents at the request of our customers.

2. Information We Collect

We collect information necessary to run our service, communicate with you, and process document uploads.

• Account Information: When you register for SubDoc, we collect your name, email address, and company name. If you sign in using Google, we access your basic profile information (such as your name and email address) as permitted by your Google settings.
• Workspace Information: We store details related to your workspace settings, including your company name, URL slug, selected plan tier, and information about the team members you invite.
• Vendor Compliance Documents: We collect and store documents you or your vendors upload to our platform. These typically include certificates of insurance (COIs), tax documents (such as W-9 forms), business licenses, and other compliance verification documents. These files may contain information like business names, tax identification numbers, policy numbers, and expiration dates.
• Usage Information: We collect basic information about how you interact with our service, such as pages visited, buttons clicked, and upload activity. This helps us ensure the platform operates smoothly and allows us to provide customer support.
• Payment Information: If you sign up for a paid plan, your payment details are processed directly by our third-party payment processor. We do not store full credit card details or CVV codes on our servers. The payment processor handles this information in accordance with their own security standards.

3. How We Use Information & Administrative Access

We use the information we collect to:

• Provide and maintain our vendor compliance tracking service.
• AI & OCR Data Extraction: Utilize artificial intelligence (AI) and automated Optical Character Recognition (OCR) algorithms to parse uploaded COIs and extract key fields (policy numbers, effective/expiration dates, insurance carriers, and policy limits).
• Process, store, and manage uploaded documents to update your workspace compliance status.
• Send transactional emails, such as signup codes, compliance requests, and automated renewal or expiration reminders.
• Respond to support tickets and resolve technical issues.
• Monitor and maintain the stability and performance of our platform.

SubDoc Administrator & Support Viewing Rights: You acknowledge and agree that SubDoc administrators, authorized engineers, and customer support personnel hold full right and authorization to access, view, and inspect your workspace pages, vendor profiles, requirements, compliance records, and uploaded documents if needed. This access is exercised when necessary to provide customer support, troubleshoot technical errors, investigate AI extraction anomalies, verify platform data integrity, prevent fraud or misuse, and perform essential system maintenance.

4. Google API User Data & Limited Use

If you choose to connect your Google Calendar account to SubDoc, we will access and process information from your Google account.

• Information We Access: We access your primary Google account email address (to identify the connected account) and your Google Calendar events (to create, update, and manage policy expiration reminders on your calendar).
• How We Use It: We only use Google Calendar access to automatically synchronize your workspace policy expiration dates with your Google Calendar, so that Google can send you push notifications or email alerts.
• Sharing and Transfer: We do not transfer or share your Google user data with any third parties, except as required to provide this feature, comply with applicable law, or as part of a merger or acquisition.
• Limited Use Policy Adherence: SubDoc's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. QuickBooks Online Data

If a workspace administrator connects SubDoc to QuickBooks Online, we access a limited set of data from your QuickBooks company through Intuit's API in order to sync your vendor list.

• Information We Access: We request only the QuickBooks Online Accounting scope and read vendor (payee) records — vendor display names, company names, contact names, email addresses, phone numbers, billing addresses, and active/inactive status. We use this solely to match and import your vendors into SubDoc and to keep linked vendor records current.
• Information We Do Not Access: We do not access, store, or process your bills, invoices, purchase orders, payments, bank or credit card accounts, transactions, general ledger, payroll, customers, or financial statements. The integration reads vendors and nothing else.
• Optional Write-Back: Every write-back option is off by default. If you explicitly enable it, we may maintain a marked [SubDoc] block in a vendor's QuickBooks Notes summarizing compliance status, attach an approved certificate of insurance to the vendor record, and/or set a SubDoc-linked vendor to inactive while it is on a compliance hold. We never modify any other field, or any text outside our marked block.
• Storage & Security: QuickBooks OAuth access and refresh tokens are encrypted at rest. Vendor data retrieved from QuickBooks is stored in your SubDoc workspace under the same protections as the rest of your workspace data.
• Sharing: We do not sell your QuickBooks data or share it with third parties, except with the cloud infrastructure providers that host our platform and as required to comply with applicable law.
• Retention & Disconnection: You can disconnect QuickBooks at any time from Settings → Integrations. Disconnecting revokes our token with Intuit, deletes the QuickBooks-to-SubDoc vendor mappings, and removes any [SubDoc] note block we added to your books. Vendors, documents, policies, and compliance history already in SubDoc are retained.
• Intuit's Terms: Your use of the QuickBooks connection is also governed by Intuit's own terms and privacy policy. SubDoc is not affiliated with, endorsed by, or sponsored by Intuit Inc.

6. Legal Basis for Processing

We process your information under the following legal bases:

• Contractual necessity: To fulfill our agreement with you and provide the SubDoc service.
• Legitimate interests: To improve our services, secure our platform, and send essential notifications about your compliance requests.
• Consent: Where you have explicitly agreed to receive specific communications from us.
• Legal obligation: When we must comply with applicable tax, financial, or regulatory requirements.

7. Data Security & Administrative Access Controls

We take data security seriously and focus on protecting the information you trust us with. Key measures and operational access protocols include:

• Data Protection: We use industry-standard encryption protocols (TLS/SSL in transit and encrypted object storage at rest) to protect all workspace data and documents.
• Administrator Viewing Rights: SubDoc administrators and authorized operational staff retain full administrative rights to access, view, and review your workspace pages, vendor profiles, requirements, and uploaded compliance files when needed to troubleshoot customer-reported issues, verify AI extraction accuracy, diagnose platform anomalies, or perform necessary system maintenance.
• Internal Access Controls: Internal administrative access is restricted to authorized personnel who need the information to perform technical and operational roles, and all administrative interactions are governed by confidentiality obligations.
• Security Monitoring: We regularly review our security measures and internal practices to defend against unauthorized access, loss, or alteration of data.

8. International Data Transfers

SubDoc is based in India, and the information we collect is stored and processed on secure cloud infrastructure. If you access our service from outside of India, your data may be transferred to, stored, and processed in cloud environments located in other regions. We take steps to ensure that your information receives an adequate level of protection, in compliance with applicable data protection laws.

9. Data Retention & Deletion

We retain your workspace data and uploaded documents for as long as your workspace is active.

Deletion Process: When you delete a document or close your workspace, the associated files and metadata are immediately removed from active systems. These files are permanently deleted and overwritten from our secure backups within a scheduled cycle of 30 days.

10. Your Rights

Depending on where you are located, you may have rights regarding the personal information we hold about you. These include the right to access, correct, export, or request the deletion of your personal data.

If you are a vendor who uploaded a document at the request of one of our customers, you can contact the customer's workspace administrator directly to manage your records, or email us at [email protected] and we will assist you.

11. Children's Privacy

SubDoc is designed for business-to-business contractor compliance and is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will delete it immediately.

12. Updates & Contact Information

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the platform dashboard or by email.

If you have any questions or concerns about this policy or our data practices, please get in touch:

For details on subscription billing, our 14-day free trial, and our strict policy of no refunds following the 14-day free trial period, please view our Refund Policy.