Subtell is a forensic-linguistic analysis tool operated by an independent developer based in the United Kingdom. For the purposes of UK GDPR and EU GDPR, we are the data controller for personal data processed through the Service.

Subtell is registered with the Information Commissioner's Office (ICO). Registration number: C1887574

2.1 Account Data

When you register, we collect:

• Email address
• Name (optional, as provided)
• Authentication credentials (managed via secure session tokens)

2.2 Conversation and Document Data

To provide forensic analysis, we process text you upload or paste into the Service. This may include:

• WhatsApp exports, email content, chat screenshots, or plain text documents
• Content that may reference or identify third parties (people mentioned in or party to the conversations)

Important: You are responsible for ensuring you have the right to upload and analyse any content you submit, particularly content involving third parties. See Section 8 (Your Responsibilities) for more.

2.3 Usage Data

We collect technical data about how you use the Service, including:

• Word count of submitted content (for usage quota management)
• Analysis job metadata (timestamps, input type, processing status)
• Error logs and performance data for service improvement

2.4 Payment Data

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your card details. Stripe's privacy policy applies to payment processing.

We use your data for the following purposes:

• To provide the Service - analysing submitted text and generating reports
• To manage your account and usage quota
• To send transactional emails (account confirmation, password reset)
• To improve the Service through anonymised usage analytics
• To comply with legal obligations

We do not use your conversation content for training AI models. Analysis is performed in real-time and conversation data is deleted from our processing infrastructure after your analysis is complete.

We use the following third-party processors who may handle your data:

• OpenAI - AI language model processing. Conversation content is sent to OpenAI's API for analysis. OpenAI's data processing agreement applies. OpenAI does not use API data to train models by default.
• Pinecone - Vector database used temporarily during analysis for semantic search. Data is stored in a per-analysis namespace and deleted after each analysis run.
• Vercel - Hosting and infrastructure. Our application runs on Vercel's servers.
• Neon / Supabase / PostgreSQL - Database hosting for account data and reports.
• Stripe - Payment processing for paid subscriptions.
• Google Cloud Vision - Used for OCR processing of uploaded screenshots. Images are processed and not retained by Google beyond the API call.

All third-party processors are contractually required to handle your data securely and in accordance with applicable data protection law.

• Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Analysis reports: Retained until you delete them or close your account.
• Conversation content submitted for analysis: Not stored permanently. Processed in-memory and via temporary Pinecone namespaces that are deleted after each analysis run.
• Usage logs: Retained for up to 12 months for service improvement purposes.

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access - request a copy of the personal data we hold about you
• Right to rectification - request correction of inaccurate data
• Right to erasure - request deletion of your account and associated data
• Right to restriction - request we limit processing of your data
• Right to data portability - receive your data in a machine-readable format
• Right to object - object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@subtell.ai. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk, or your local supervisory authority in the EU.

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Environment variable management for API keys and secrets
• Authentication via secure session tokens
• Per-analysis data isolation in processing infrastructure

No system is completely secure. If you become aware of a security issue, please contact us immediately at hello@subtell.ai.

By uploading content to Subtell, you confirm that:

• You have the right to upload and process the content, including any content involving third parties
• You will not upload content that you have obtained unlawfully
• You understand that content involving other people raises privacy considerations you are responsible for
• You will comply with applicable data protection laws in your own use of the analysis outputs

We use only strictly necessary cookies for authentication and session management. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required for strictly necessary cookies under UK GDPR.

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests:

Email: hello@subtell.ai

Website: www.subtell.ai