Privacy Policy

Business Owners:

• Business information: business name, description, location, website URL, Google Maps URL, business category, and any additional details you provide during onboarding.
• Account information: email address, hashed password (managed by Supabase Auth), and your chosen storefront URL slug.
• Billing information: Stripe customer ID, Stripe subscription ID, current plan tier, billing cycle, and GMV data. We do not store card numbers — these are held exclusively by Stripe.
• Platform usage data: storefront state, package configuration, Stripe Connect account status, and webhook event records for idempotency.
• Terms acceptance: the timestamp and version string of the Terms and Conditions you accepted.

End Customers:

• Subscription information: full name, email address, subscribed package name and price, subscription status, Stripe subscription ID, and Stripe customer ID.
• Payment information: handled exclusively by Stripe. SubRobin only receives tokenised identifiers.
• Terms acceptance: the timestamp and version string of the Terms and Conditions accepted at checkout.

All users:

• Technical data: IP address, browser type, operating system, pages visited, and timestamps — collected via Vercel Analytics.
• Cookies: session authentication cookies (HttpOnly, SameSite=Strict) set by Supabase Auth. See Section 6 for details.

What we do not collect:

• Credit card numbers, CVVs, or bank account details (these never touch SubRobin servers).
• Government-issued ID numbers or passport numbers.
• Biometric data of any kind.

We share data with the following third-party processors strictly for the purpose of operating SubRobin. We do not sell your data to third parties and do not allow advertisers to access your data.

Note: A future update to this Privacy Policy will add details about phone number / SMS verification processing when that feature is introduced.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data. Note that some data must be retained for legal or financial compliance reasons (see Section 4).
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@subrobin.com. We will respond within 30 days.

If you are in the EU/EEA, you also have the right to lodge a complaint with your local Data Protection Authority.

SubRobin uses a minimal set of cookies:

We do not use advertising cookies, tracking pixels, or third-party marketing cookies. Vercel Analytics is privacy-friendly and does not use persistent cookies for analytics purposes.

SubRobin is not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us at privacy@subrobin.com and we will delete that data promptly.

SubRobin is operated from Bangladesh. Data is stored by Supabase in Singapore (ap-southeast-1). Payment data is processed by Stripe across their global infrastructure. AI processing is performed by Groq in the United States.

By using SubRobin, you consent to the transfer of your data to these locations. Where required, we rely on standard contractual clauses or equivalent safeguards for international transfers.

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The effective date at the top of this page will always reflect the most current version.

For any privacy-related questions, requests, or concerns:

• Email: privacy@subrobin.com
• General support: support@subrobin.com