Privacy Policy

Subsured Last updated: March 2026

1. Introduction

Subsured ("we," "us," or "our") operates a document management platform for general contractors and their subcontractors. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

By using Subsured, you agree to the practices described in this policy.

2. Information We Collect

GC Users (Account Holders)

  • Account information: Name, email address, company name
  • Billing information: Payment method details (processed and stored by Stripe — we do not store card numbers)
  • Usage data: Log data, IP address, browser type, pages visited, actions taken in the dashboard

Subcontractors (Portal Users)

  • Contact information: Name, email address, phone number, trade
  • Uploaded documents: COIs, W-9 forms, lien waivers, trade licenses, safety certifications
  • Extracted document data: Information parsed from uploaded documents (carrier names, policy numbers, coverage limits, expiration dates, etc.)

All Users

  • Cookies and tracking: We use essential cookies for authentication. We do not use advertising cookies or sell data to advertisers.

3. Sensitive Personal Information

W-9 forms uploaded to Subsured contain Social Security Numbers (SSNs) or Employer Identification Numbers (EINs), which are classified as Sensitive Personal Information under the California Privacy Rights Act (CPRA) and similar laws.

How we handle W-9s:

  • Stored in a separate, private, access-controlled storage bucket
  • Never sent to any AI system or third-party processing service
  • Accessible only to the GC User who requested the document
  • Subject to the same 30-day deletion policy upon account cancellation

4. AI Processing

Subsured uses artificial intelligence provided by Anthropic, Inc. to extract data from Certificate of Insurance (COI) documents only.

When you upload a COI, that document is transmitted to Anthropic's API for processing. Anthropic's use of your data is governed by their privacy policy at anthropic.com/privacy.

The following document types are NEVER sent to AI:

  • W-9 forms
  • Lien waivers
  • Trade licenses
  • Safety certifications
  • Any document type other than COI

5. How We Use Your Information

We use your information to:

  • Provide and operate the Service
  • Send portal invite emails and document expiry reminder emails
  • Process subscription payments via Stripe
  • Respond to support requests
  • Improve the Service

We do not:

  • Sell your personal information to third parties
  • Use your information for advertising
  • Share your information with insurance carriers or brokers
  • Use your documents to train AI models (subject to Anthropic's policies)

6. How We Share Your Information

We share information only with:

| Recipient | Purpose | Data Shared | |-----------|---------|-------------| | Supabase | Database and file storage | All user and document data | | Stripe | Payment processing | Billing information | | Anthropic | COI document processing | COI PDFs only | | Resend | Email delivery | Name, email address | | Vercel | Hosting and infrastructure | Request logs |

We do not sell, rent, or trade your personal information.

7. Data Storage and Security

  • All data stored in Supabase (hosted on AWS)
  • Documents stored in private, access-controlled storage buckets
  • W-9 documents stored in a separate restricted bucket
  • All data transmission encrypted via HTTPS/TLS
  • Access to your data restricted to your organization only via row-level security policies
  • We do not guarantee absolute security — no system is 100% secure

8. Data Retention

  • Active accounts: Data retained for the duration of your subscription
  • Cancelled accounts: Data retained for 30 days after cancellation, then permanently deleted
  • Immediate deletion: Contact privacy@subsured.com to request immediate deletion
  • Subcontractor data: Deleted when the associated GC account is deleted

9. Your Rights

California Residents (CCPA / CPRA)

You have the right to:

  • Know what personal information we collect and how it is used
  • Access a copy of your personal information
  • Delete your personal information
  • Correct inaccurate personal information
  • Opt out of the sale of personal information (we do not sell data)
  • Limit use of Sensitive Personal Information (SSNs in W-9s)

To exercise these rights, contact privacy@subsured.com. We will respond within 45 days.

EU/UK Residents (GDPR)

If you are located in the EU or UK, our lawful basis for processing your data is:

  • Contract performance — to provide the Service you signed up for
  • Legitimate interests — to operate and improve our Service
  • Consent — for AI processing of COI documents

You have the right to access, rectify, erase, restrict, or port your data, and to lodge a complaint with your local supervisory authority.

10. Email Communications

Transactional Emails

Portal invite emails are transactional and are sent as a direct result of a GC User's request. These are not marketing emails.

Reminder Emails

Automated document expiry reminder emails are sent to subcontractors on behalf of GC Users. Each reminder email includes an unsubscribe link. Clicking unsubscribe will stop reminder emails for that subcontractor.

All emails include our physical mailing address in the footer as required by CAN-SPAM.

11. Breach Notification

In the event of a data breach affecting your personal information, we will:

  • Notify affected users by email within 72 hours of discovery
  • Notify the California Attorney General if the breach affects more than 500 California residents
  • Provide information about what data was affected and steps you can take

12. Children's Privacy

Subsured is not directed at children under 13. We do not knowingly collect personal information from children under 13.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice in the Service. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related requests or questions:

Subsured [YOUR LLC NAME] [YOUR REGISTERED ADDRESS] privacy@subsured.com

For data deletion requests: privacy@subsured.com For security concerns: security@subsured.com

← Back to Subsured