Subtell is a forensic-linguistic analysis tool operated by an independent developer based in the United Kingdom. For the purposes of UK GDPR and EU GDPR, we are the data controller for personal data processed through the Service.

Subtell is registered with the Information Commissioner's Office (ICO). Registration number: C1887574

2.1 Account Data

When you register, we collect:

• Email address
• Name (optional, as provided)
• Authentication credentials (managed via secure session tokens)

2.2 Conversation and Document Data

To provide forensic analysis, we process text you upload or paste into the Service. This may include:

• WhatsApp exports, email content, chat screenshots, or plain text documents
• Content that may reference or identify third parties (people mentioned in or party to the conversations)
• Content may incidentally reveal sensitive matters such as health, relationships, beliefs, or sexual life; Subtell does not require these details and you should remove information that is unnecessary for your analysis

Important: You are responsible for ensuring you have the right to upload and analyse any content you submit, particularly content involving third parties. See Section 8 (Your Responsibilities) for more.

2.3 Usage Data

We collect technical data about how you use the Service, including:

• Word count of submitted content (for usage quota management)
• Analysis job metadata (timestamps, input type, processing status)
• Error logs and performance data for service improvement

2.4 Payment Data

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card details. Stripe's privacy policy applies to payment processing.

We use your data for the following purposes:

• To provide the Service - analysing submitted text and generating reports
• To manage your account and usage quota
• To send transactional emails (account confirmation, password reset)
• To understand aggregate website and product usage through privacy-focused analytics
• To comply with legal obligations

We do not use your conversation content for training AI models. Analysis is performed in real-time and the full source text is removed from the processing job after the analysis completes or fails. Evidence excerpts needed to support findings remain in your saved report until you delete that report or account.

Our lawful bases

We rely on performance of our contract with you to create your account, process material you submit, and deliver requested reports. We rely on legitimate interests to secure, operate, troubleshoot, measure, and prevent misuse of the Service, balanced against the rights of affected people. We process data where necessary to meet legal obligations, and rely on consent where we specifically ask for it. Submitted material can contain information about other people; you are responsible for having a lawful basis to provide it and for removing information that is not necessary.

We use the following third-party processors who may handle your data:

• OpenAI - AI language model processing. Conversation content is sent to OpenAI's API with application storage disabled. OpenAI does not train its models on API data by default; unless Subtell's API project has an approved reduced-retention control, abuse-monitoring logs that may contain customer content can be retained for up to 30 days.
• Pinecone - Vector database containing Subtell's private forensic methodology. Subtell sends search embeddings to retrieve relevant methodology; your transcript is not uploaded to the knowledge-base namespaces.
• Vercel - Hosting and infrastructure. Our application runs on Vercel's servers.
• PostgreSQL hosting provider - Database infrastructure for account data, processing jobs, and saved reports.
• Stripe - Payment processing for paid subscriptions.
• Google Cloud Vision - Used for OCR processing of uploaded screenshots. Images are processed and not retained by Google beyond the API call.

All third-party processors are contractually required to handle your data securely and in accordance with applicable data protection law.

Some processors may handle data outside the United Kingdom. Where this occurs, we use the transfer safeguards made available under the processor's data-processing terms, such as an adequacy decision or approved contractual clauses. Contact us if you would like more information about a relevant safeguard.

• Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Analysis reports: Retained until you delete them or close your account. Reports can contain the excerpts needed to support their findings.
• Conversation content submitted for analysis: Stored temporarily in a processing job while analysis runs, then removed from that job when it completes or fails. It is not uploaded to Pinecone. Evidence excerpts needed to support the report remain in the saved report until that report is deleted.
• Usage logs: Retained for up to 12 months for service improvement purposes.

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access - request a copy of the personal data we hold about you
• Right to rectification - request correction of inaccurate data
• Right to erasure - request deletion of your account and associated data
• Right to restriction - request we limit processing of your data
• Right to data portability - receive your data in a machine-readable format
• Right to object - object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@subtell.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk, or your local supervisory authority in the EU.

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Environment variable management for API keys and secrets
• Authentication via secure session tokens
• Per-analysis data isolation in processing infrastructure

No system is completely secure. If you become aware of a security issue, please contact us immediately at hello@subtell.ai.

By uploading content to Subtell, you confirm that:

• You have the right to upload and process the content, including any content involving third parties
• You will not upload content that you have obtained unlawfully
• You understand that content involving other people raises privacy considerations you are responsible for
• You will comply with applicable data protection laws in your own use of the analysis outputs

We use only strictly necessary authentication and session storage. We do not use advertising cookies. We use Vercel Web Analytics to understand aggregate product usage; it is designed to operate without placing cookies on visitors' devices.

The Service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests:

Email: hello@subtell.ai

Website: www.subtell.ai