Privacy Policy

Last updated: June 2026

SubChex (“SubChex”, “we”, “us”) provides a building-approval tracking platform for UAE architecture and engineering firms at subchex.com and app.subchex.com. This policy explains what information we collect, how we use it, and the choices you have. Questions: privacy@subchex.com.

SubChex is operated from 9230 Old Coach Rd, Cincinnati, Ohio 45249, USA.

1. Information we collect

• Account information — your name, email address and role within your firm.
• Workspace data you enter — projects, approvals, statuses, dates, notes and documents you upload.
• Connected-mailbox data — if you connect a Google account, then with your authorization we access messages and metadata in that mailbox related to your submissions and authority correspondence, and the ability to send email on your behalf (Gmail scopes gmail.readonly and gmail.send).
• Technical data — log and device/browser information, and essential cookies needed to keep you signed in.

2. How we use information

• To provide the service: track approvals, store documents, send submissions to authorities, and read & organize their replies in Responses.
• To generate AI summaries and classifications of authority email threads.
• For security, support, and to comply with applicable law.

3. Google user data & Limited Use

When you connect a Google account, SubChex’s access to and use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Gmail data only to provide and improve the user-facing features you connected it for — sending submissions, and reading, threading and summarizing authority replies.
• We do not transfer Gmail data to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
• We do not use Gmail data for advertising.
• We do not allow humans to read your Gmail data except: with your affirmative consent for specific messages; as necessary for security or to comply with applicable law; or where the data has been aggregated and anonymized for internal operations.

AI processing. To produce summaries, the text of relevant authority email threads is sent to our AI provider (Anthropic, accessed via Vercel AI Gateway) for processing. This content is not used to train their models and is handled under their data-processing terms.

You can disconnect your Google account at any time in Settings, which revokes our access and stops further reading or sending.

4. How we store and protect data

Data is hosted on Supabase (Postgres database, storage and authentication) and Vercel (application hosting). It is encrypted in transit (HTTPS) and at rest. OAuth refresh tokens are stored server-side only and are never exposed to the browser. Row-level security isolates each firm’s data from every other firm.

5. Sharing and subprocessors

We do not sell your data. We rely on the following subprocessors, each of which processes data only to provide its service to us:

• Supabase — database, file storage, authentication.
• Vercel — application hosting and AI Gateway.
• Brevo — transactional email delivery (invites, password resets).
• Anthropic — AI summarization of authority correspondence.
• Google — Gmail API, for connected mailboxes.

6. Data retention

We keep your data while your account is active. When you delete your account or disconnect a mailbox, the associated data and tokens are deleted or anonymized within a reasonable period.

7. Your rights

You may access, correct, export or delete your data, and disconnect any connected Google account, at any time. Contact us at privacy@subchex.com for assistance.

8. Cookies

We use only essential cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new “last updated” date.

10. Contact

Privacy questions: privacy@subchex.com.