This notice explains how we handle personal information when you visit SUBSURE, request a free scan, use an account or connect a billing provider.
Who we are
SUBSURE is operated by Valico Services Ltd trading as SUBSURE (company number 14313622). Our registered office is 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. Contact support@subsure.io.
Information we handle
- Account details: work email, sign-in and account records, organisation name, website and setup choices.
- Free Protection Scan: the website and email you submit, answers you provide, public pages fetched from that website, and the scan score, findings and technical metadata.
- Billing connections: provider account identifiers, encrypted OAuth credentials and the product, price, plan, subscription status, renewal and event details available through the permissions you approve.
- Documents and monitoring evidence: PDFs you upload, file names, extracted text or analysis findings, journey URLs, check results, alerts and records of what was checked and when. Contract PDFs are stored in a private bucket.
- Plan, support and technical records: SUBSURE plan and checkout status, payment references, support correspondence and technical or security logs generated by the service and its providers.
How and why we use it
- To run a scan or take steps you request before an account contract, and to provide your account and monitoring service.
- To connect your chosen billing provider, compare subscription information with websites or terms you provide, prepare evidence and show findings in your Control Room.
- To secure the service, prevent misuse, troubleshoot faults and improve reliability. We rely on our legitimate interests in operating a safe, reliable service, balanced against your rights.
- To process plan billing and keep financial records where required by law.
- To answer support and privacy requests.
We do not sell personal information or use it for targeted advertising. Automated checks produce monitoring signals for a person to review; we do not make decisions with legal or similarly significant effects about individuals.
Business customer data
A merchant decides why it connects its billing account or uploads documents. Where those materials contain personal information about the merchant’s customers, the merchant is generally the controller and SUBSURE processes that information to provide the merchant’s monitoring service. The merchant must have authority to provide it and give its customers appropriate privacy information. The Data Processing Agreement applies to processing SUBSURE performs on your behalf once an authorised representative accepts it in the account flow. Do not connect or submit data that you are not authorised to provide.
Who receives information
We use Supabase for authentication, database, private file storage and backend functions; Vercel for website hosting; Stripe for SUBSURE plan checkout when enabled and for Stripe connections you choose; GoCardless for connections you choose; Microsoft 365 for support email; Resend for service emails when delivery is configured; and jsDelivr to deliver the Supabase browser library used by the site. Connected billing providers also process data under their own terms. SUBSURE does not send merchant customer notices automatically at present.
Supabase is configured in London and the Vercel application runs in London. Other providers may process or access some information in other countries. Where a transfer requires safeguards, we rely on the safeguards in the relevant provider arrangements. Contact us for current provider-specific details.
How long we keep it
We keep account, connection and monitoring records while needed to provide the service and maintain the evidence history you request. Scan results and contact details are kept while needed to deliver the scan, respond to you, protect the service or resolve a dispute. Uploaded documents and analyses are kept while needed for your account and requested evidence. Financial, security and dispute records are kept for as long as needed for those purposes and applicable legal obligations.
We review information against those purposes and delete or anonymise it when it is no longer needed. You can request access or deletion at support@subsure.io. We may retain limited records where law requires it or where needed for a legal claim; backup copies may remain until the provider’s normal backup cycle expires.
Your rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. If we rely on consent, you can withdraw it. Email support@subsure.io. If we process information for a merchant, contact that merchant first; we will assist the merchant as required.
You can complain to the UK Information Commissioner’s Office at ico.org.uk.
Changes
We will update this notice when our processing changes. The revision date is shown above.