Privacy Policy

1. Introduction

At SubDoc, we value the trust you place in us to manage your vendor compliance documents. This Privacy Policy explains how we collect, use, and protect information when you visit our website, set up a workspace, or submit documents through our platform.

SubDoc is operated by Jalwan K., an individual, doing business as SubDoc. For the account and billing information of workspace users, Jalwan K. is the party responsible for your data. For the vendor and subcontractor data that customers upload, see Section 6.

This policy applies to workspace administrators, company team members, and the vendors or subcontractors who upload documents at the request of our customers.

2. Information We Collect

We collect information necessary to run our service, communicate with you, and process document uploads.

• Account Information: When you register for SubDoc, we collect your name, email address, and company name. If you sign in using Google, we access your basic profile information (such as your name and email address) as permitted by your Google settings.
• Workspace Information: We store details related to your workspace settings, including your company name, URL slug, selected plan tier, and information about the team members you invite.
• Vendor Compliance Documents: We collect and store documents you or your vendors upload to our platform. These typically include certificates of insurance (COIs), tax documents (such as W-9 forms), business licenses, and other compliance verification documents. These files may contain information like business names, tax identification numbers, policy numbers, and expiration dates.
• Usage Information: We collect basic information about how you interact with our service, such as pages visited, buttons clicked, and upload activity. This helps us ensure the platform operates smoothly and allows us to provide customer support.
• Payment Information: If you sign up for a paid plan, your payment details are processed directly by Paddle.com, our Merchant of Record and reseller. We do not store full credit card details or CVV codes on our servers. Paddle handles this information in accordance with its own privacy policy and security standards.

3. How We Use Information & Administrative Access

We use the information we collect to:

• Provide and maintain our vendor compliance tracking service.
• AI & OCR Data Extraction: Utilize artificial intelligence (AI) and automated Optical Character Recognition (OCR) algorithms to parse uploaded COIs and extract key fields (policy numbers, effective/expiration dates, insurance carriers, and policy limits).
• Process, store, and manage uploaded documents to update your workspace compliance status.
• Send transactional emails, such as signup codes, compliance requests, and automated renewal or expiration reminders.
• Respond to support tickets and resolve technical issues.
• Monitor and maintain the stability and performance of our platform.

SubDoc Administrator & Support Viewing Rights: You acknowledge and agree that SubDoc administrators, authorized engineers, and customer support personnel hold full right and authorization to access, view, and inspect your workspace pages, vendor profiles, requirements, compliance records, and uploaded documents if needed. This access is exercised when necessary to provide customer support, troubleshoot technical errors, investigate AI extraction anomalies, verify platform data integrity, prevent fraud or misuse, and perform essential system maintenance.

4. Google API User Data & Limited Use

If you choose to connect your Google Calendar account to SubDoc, we will access and process information from your Google account.

• Information We Access: We access your primary Google account email address (to identify the connected account) and your Google Calendar events (to create, update, and manage policy expiration reminders on your calendar).
• How We Use It: We only use Google Calendar access to automatically synchronize your workspace policy expiration dates with your Google Calendar, so that Google can send you push notifications or email alerts.
• Sharing and Transfer: We do not transfer or share your Google user data with any third parties, except as required to provide this feature, comply with applicable law, or as part of a merger or acquisition.
• Limited Use Policy Adherence: SubDoc's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. QuickBooks Online Data

If a workspace administrator connects SubDoc to QuickBooks Online, we access a limited set of data from your QuickBooks company through Intuit's API in order to sync your vendor list.

• Information We Access: We request only the QuickBooks Online Accounting scope and read vendor (payee) records — vendor display names, company names, contact names, email addresses, phone numbers, billing addresses, and active/inactive status. We use this solely to match and import your vendors into SubDoc and to keep linked vendor records current.
• Information We Do Not Access: We do not access, store, or process your bills, invoices, purchase orders, payments, bank or credit card accounts, transactions, general ledger, payroll, customers, or financial statements. The integration reads vendors and nothing else.
• Optional Write-Back: Every write-back option is off by default. If you explicitly enable it, we may maintain a marked [SubDoc] block in a vendor's QuickBooks Notes summarizing compliance status, attach an approved certificate of insurance to the vendor record, and/or set a SubDoc-linked vendor to inactive while it is on a compliance hold. We never modify any other field, or any text outside our marked block.
• Storage & Security: QuickBooks OAuth access and refresh tokens are encrypted at rest. Vendor data retrieved from QuickBooks is stored in your SubDoc workspace under the same protections as the rest of your workspace data.
• Sharing: We do not sell your QuickBooks data or share it with third parties, except with the cloud infrastructure providers that host our platform and as required to comply with applicable law.
• Retention & Disconnection: You can disconnect QuickBooks at any time from Settings → Integrations. Disconnecting revokes our token with Intuit, deletes the QuickBooks-to-SubDoc vendor mappings, and removes any [SubDoc] note block we added to your books. Vendors, documents, policies, and compliance history already in SubDoc are retained.
• Intuit's Terms: Your use of the QuickBooks connection is also governed by Intuit's own terms and privacy policy. SubDoc is not affiliated with, endorsed by, or sponsored by Intuit Inc.

6. Vendor & Subcontractor Data

Most vendor data in SubDoc is provided by our customers (the companies that use SubDoc to track their vendors). For that data the customer decides what to collect and why, and SubDoc processes it on the customer's behalf under the customer's instructions and our Terms. The customer is the party responsible to you for that data, and SubDoc acts as its service provider (processor).

If you are a vendor, subcontractor, or broker, the documents you upload through a request link are shared with the company that requested them and are processed by SubDoc, including by automated text extraction, to check them against that company's requirements. Documents such as W-9 forms can contain tax identification numbers. Upload only what the requesting company asks for. We do not use vendor documents for advertising and we do not sell them.

To see, correct, or delete your records, contact the company that asked you to upload them, or email [email protected] and we will route the request to them or handle it where we are able to.

7. Service Providers We Use

We share data only with the providers that help us run SubDoc, and only as needed to provide the service. We do not sell personal information and we do not share it for advertising. Our current providers are:

• OpenAI: automated text extraction from uploaded documents. Documents are sent to OpenAI's API for this purpose. We do not train models on your documents, and under OpenAI's API terms API inputs are not used to train its models.
• Supabase: managed PostgreSQL database for workspace and account data.
• Cloudflare (R2): encrypted storage of uploaded files.
• Heroku and Vercel: hosting of our API and web application.
• Resend: delivery of transactional and reminder emails.
• Paddle: payment processing and billing as our Merchant of Record.
• Google: sign-in, optional Google Calendar sync, and (only if you accept analytics cookies) Google Analytics.
• Intuit: QuickBooks Online, only if a workspace administrator connects it.

We may also disclose information where the law requires it, or in connection with a merger or sale of the business. We will update this list when providers change.

8. Cookies & Analytics

• Essential cookies keep you signed in and protect your session. They are required for the service to work and are always on.
• Analytics cookies (Google Analytics) tell us which pages are used. They load only after you click Accept in the cookie notice, and nothing is sent to Google if you decline or ignore it. You can change your choice any time with Cookie Settings in the site footer.
• We do not use advertising or cross-site tracking cookies.

9. Legal Basis for Processing

We process your information under the following legal bases:

• Contractual necessity: To fulfill our agreement with you and provide the SubDoc service.
• Legitimate interests: To improve our services, secure our platform, and send essential notifications about your compliance requests.
• Consent: Where you have explicitly agreed to receive specific communications from us.
• Legal obligation: When we must comply with applicable tax, financial, or regulatory requirements.

10. Data Security & Administrative Access Controls

We take data security seriously and focus on protecting the information you trust us with. Key measures and operational access protocols include:

• Data Protection: We use industry-standard encryption protocols (TLS/SSL in transit and encrypted object storage at rest) to protect all workspace data and documents.
• Administrator Viewing Rights: SubDoc administrators and authorized operational staff retain full administrative rights to access, view, and review your workspace pages, vendor profiles, requirements, and uploaded compliance files when needed to troubleshoot customer-reported issues, verify AI extraction accuracy, diagnose platform anomalies, or perform necessary system maintenance.
• Internal Access Controls: Internal administrative access is restricted to authorized personnel who need the information to perform technical and operational roles, and all administrative interactions are governed by confidentiality obligations.
• Security Monitoring: We regularly review our security measures and internal practices to defend against unauthorized access, loss, or alteration of data.

11. International Data Transfers

The information we collect is stored and processed on secure cloud infrastructure operated by our service providers, which may be located in the United States and other countries. We take steps to ensure that your information receives an adequate level of protection, in compliance with applicable data protection laws.

12. Data Retention & Deletion

We retain your workspace data and uploaded documents for as long as your workspace is active, or as needed to provide the service and meet legal obligations.

Deletion Process: When a workspace owner deletes a workspace, its database records and stored files are permanently removed. Copies held in our infrastructure providers' backups age out on their backup cycle, which we target at 30 days. Items you delete individually (such as a document) are removed from your workspace; they are purged from storage and backups on a rolling basis. Records we must keep for legal, tax, fraud-prevention, or dispute purposes (for example billing records held by Paddle) are kept as long as the law requires.

13. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Email [email protected] from the address on your account and we will respond within 30 days. We may need to verify your identity first. Workspace owners can also export workspace data from within the app. You will not be treated differently for making a request.

If you are a vendor who uploaded a document at the request of one of our customers, see Section 6: that customer is usually the right first contact, and we will help route your request.

SubDoc is designed for businesses in the United States and Canada. We do not sell or share personal information for cross-context advertising.

14. Children's Privacy

SubDoc is designed for business-to-business contractor compliance and is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will delete it immediately.

15. Updates & Contact Information

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the platform dashboard or by email.

If you have any questions or concerns about this policy or our data practices, please get in touch:

For details on subscription billing, our 14-day free trial, and our 14-day refund guarantee, please view our Refund Policy.