Privacy Policy

This Privacy Policy explains how subpoof ("subpoof", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the subpoof website, dashboard, and API (the "Service"), and the choices and rights you have over your data. By using the Service you agree to the practices described in this Policy.

1. Information we collect

Account information

When you create an account we collect your email address and the public credential created when you register a passkey, managed through a third-party passwordless authentication provider. We also generate an API key associated with your account so you can authenticate to the API. As described in Section 2, we never receive or store a password.

Billing information

Paid plans are processed by a third-party payment processor. As described in Section 2, we do not collect or store full payment-card numbers. We retain limited billing metadata such as your plan, subscription status, and transaction identifiers needed to operate and reconcile your subscription.

Communications

If you email our support or sales addresses, we receive the contents of your message and your email address, and we store the resulting support ticket. As described in Section 4, an automated initial reply may be generated using a third-party AI language-model provider.

Usage, device, and log data

When you use the Service we automatically collect technical information including your IP address, browser type and user-agent, the pages and endpoints you access, referring pages, and timestamps. This is collected through our own first-party request logging and through a third-party web analytics provider. We also keep an audit log of security-relevant actions, such as sign-ins and account changes, to secure the Service and investigate abuse.

Data you submit to the Service

When you run a scan or query, we process the domains and parameters you submit and the resulting findings, such as discovered subdomains and certificate information. Much of this concerns publicly observable internet infrastructure rather than individuals. Some sources, such as domain-registration records, may include personal data relating to third parties, which we process to provide the Service's domain-intelligence features.

2. Credentials and payment data

Authentication credentials. subpoof uses passwordless authentication. You sign in with a passkey, a cryptographic credential bound to your device, and we store only the corresponding public credential through our passwordless authentication provider. We do not create, receive, or store passwords or any other reusable shared secret. Because there is no secret on our side to steal, an attacker who reached our systems would find no credential to replay, and a password leaked from any other service cannot be used to access subpoof. We consider this a mutual security benefit for you and for us.

Payment data. When you subscribe to a paid plan, your payment-card details are collected and processed directly by a PCI-compliant third-party payment processor. subpoof never receives or stores your full card number, expiry, or security code. We retain only the limited billing metadata, such as plan, subscription status, and a transaction or customer identifier, that we need to provide and reconcile your subscription.

3. How we use information

• To provide, operate, and maintain the Service and authenticate your access.
• To process payments and manage your subscription.
• To respond to your support and sales inquiries.
• To secure the Service, prevent abuse, and enforce our terms and usage quotas.
• To understand and improve how the Service is used.
• To comply with legal obligations and respond to lawful requests.

4. Use of artificial intelligence

We use artificial intelligence in a limited and specific way: to help draft an initial reply when you email our support or sales addresses. We want you to understand exactly what that means for your data.

• What is processed. When you email us, the contents of your message and limited context are transmitted to a third-party AI language-model provider, acting as our processor, for the sole purpose of drafting a reply.
• No model training. We do not use your communications to train AI models, and our AI provider is contractually bound not to train its models on the data we send through its interface.
• A human stays in the loop. AI assists with an initial response only. A person reviews and handles your request, and you can ask to be handled solely by a person at any time by saying so in your message.
• No automated decisions about you. We do not use AI to make decisions that produce legal or similarly significant effects about you. Any figures that matter, such as pricing, are computed by our own software, not generated by the AI model.
• Limits and accuracy. AI-generated text can be imperfect. We apply input and output limits and operating budgets, and the final responsibility for any response rests with us, not the model.

5. Cookies and analytics

We use a strictly necessary cookie to keep you signed in to the dashboard. We also use a third-party web analytics provider that sets cookies to measure traffic and usage. You can block or delete cookies through your browser settings and opt out of analytics using available browser controls or extensions. Disabling the strictly necessary cookie will prevent you from signing in.

6. Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract - to provide the Service, including authentication and billing.
• Legitimate interests - to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Consent - for non-essential analytics cookies, where required; you may withdraw consent at any time.
• Legal obligation - to comply with applicable laws and lawful requests.

7. How we share information

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share personal data only as described below:

• Service providers (processors) who process data on our behalf and under contract, by category: a cloud hosting and managed-database provider, a payment processor, an email delivery and inbound-email provider, a passwordless authentication provider, an AI language-model provider, a web analytics provider, and a content-delivery and network-security provider.
• Legal and safety - where required by law, regulation, or legal process, or to protect the rights, property, or safety of subpoof, our users, or the public.
• Business transfers - in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

8. International data transfers

We and our service providers may process and store personal data in the United States and other countries whose data-protection laws may differ from those in your jurisdiction. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum, or another lawful transfer mechanism.

9. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. Security audit logs are retained for a limited period, by default up to twelve months, and then deleted automatically. First-party request logs and analytics data are kept for a limited period for security and product-improvement purposes. When you close your account, we delete or de-identify your personal data within a reasonable period, except where we must retain it to comply with legal, accounting, or security obligations.

10. Security

We protect data in transit using TLS, authenticate users with passkeys rather than passwords, manage application secrets through a dedicated secrets manager, and restrict internal access to personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

EEA and UK

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data-protection supervisory authority.

California and other US states

Subject to applicable law, you may have the right to know what personal data we collect and how we use and disclose it, to access or obtain a copy of that data, to request correction or deletion, and to opt out of the "sale" or "sharing" of personal data and the use of sensitive personal data for certain purposes. We do not sell or share personal data as those terms are defined under California law. We will not discriminate against you for exercising any of these rights.

How to exercise your rights

Submit a request using the form below, or email privacy@subpoof.com. Either way it reaches our team directly. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law permits.

12. Children's privacy

The Service is not directed to children and is intended for users aged 16 and older. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above, and, for material changes, we will provide additional notice as required by law.

14. Contact us

For privacy questions or requests, contact privacy@subpoof.com, or write to Subpoof, 350 Mass Ave, Ste 300, Indianapolis, IN 46204. This Policy is governed by the laws of Marion County, Indiana, without regard to its conflict-of-laws rules.