Privacy Policy

We collect information you provide directly to us when you create an account, join our waitlist, or use Subpay.ai. This includes:

• Account Data: Name, email address, and company information.
• Financial Data: Payment information is collected and processed securely by our third-party payment processor (Stripe). Subpay does not store raw credit card numbers.
• User Content: Documents, change orders, contracts, and blueprints you upload to the platform.
• Live demo usage: On our public demo (/demo), we count which links visitors click that the demo doesn't include yet, and on which demo page. Only the link and the page are recorded — no IP address, cookie, or anything that identifies you.

We use your information to provide, maintain, and improve our services. Specifically, we use your data to:

• Process and route your subcontractor documents.
• Utilize our AI Smart Import features to classify Request for Change Orders (RCOs) and executed Change Orders (COs).
• Send you technical notices, security alerts, and support messages.
• Support & communications: Messages you send through the in-app support chat are processed by an AI assistant (Anthropic's Claude API) to generate answers; questions the assistant cannot answer are relayed to our team via Telegram, and support conversations are stored so the assistant can answer similar questions in the future.

We do not sell your personal data or uploaded documents to data brokers. We share data only with trusted third-party sub-processors necessary to run the platform:

• Cloud Hosting & Storage: Supabase and Vercel for database and application hosting.
• AI Processing: We utilize external AI APIs for document classification. Your data is sent to these services exclusively for processing your specific requests and is strictly opted out of being used to train their base models.
• Billing: Stripe for payment processing.
• AI & Support: Anthropic (Smart Import document extraction and the AI support chat — opted out of model training under our API terms) and Telegram (relays escalated support questions to our team for answering).
• API Payments: PayAI, the x402 payment facilitator that submits pay-per-read API payments to the Base and Solana networks.
• Email: Resend for transactional email (billing-deadline reminders and support notifications).
• Infrastructure: Upstash for rate limiting and abuse protection.

We implement commercially reasonable security measures to protect your data. File uploads are authenticated and access-controlled. However, no digital transmission is 100% secure, and we cannot guarantee absolute security.

Subpay uses only essential cookies — the session cookie that keeps you signed in. We do not use advertising cookies or cross-site tracking.

We retain your data for as long as your account exists (including read-only periods after a subscription lapses — we never delete your records for non-payment). You may request deletion of your account and data at any time by contacting support@subpay.ai; we will delete your account data within 30 days of a verified request, after which residual copies age out of encrypted backups.

Depending on where you live — including under the Florida Digital Bill of Rights (FDBR) and the California Consumer Privacy Act (CCPA) — you may have the right to access, correct, delete, or obtain a portable copy of your personal information, and the right not to be discriminated against for exercising those rights. To exercise any of these rights, email support@subpay.ai from your account email. We will verify and respond to requests within 45 days. We do not sell personal information.

Subpay offers a document reading API at https://subpay.ai/api/v1/, governed by our API Terms of Use. The API can be used without a Subpay account, and API users have no access to any Subpay account or the data in it. When you or your software use the API, we process:

• Submitted documents: Each document is sent to Anthropic's Claude API to read it, used only to produce the response to that request, and not stored by Subpay once the request completes. Documents are not used to train AI models.
• Payment information: API reads are paid in USDC on the Solana (SOL) and Base networks. To process a payment we receive the paying wallet's public address, the network, the amount, and the blockchain transaction identifier. We never receive or store private keys, recovery phrases, or other wallet credentials.
• Operational records: Request time, document type, file size, response status, and IP address, as recorded by our hosting provider's logs. We also keep an activity log of API use — time, outcome, document type, file size, processing time, and the requesting software's name (user agent or MCP client name) — without IP addresses or document contents. We use these to operate and secure the API, prevent abuse, handle billing questions, and meet legal obligations, and keep them only as long as needed for those purposes.
• Capability requests: What you submit through the free request endpoint or the request_capability tool (document type, fields, volume, price, notes), used to decide what to build. Please don't include personal information; we don't ask for contact details.
• Agent Tool Finder: The free tool search at /api/v1/find and /find/mcp logs each search — the words searched, filters, how well it matched, the top results, time, and the requesting software's name — and anything submitted as an unmet need (the need, details, price, volume). No IP addresses are stored. We use them to learn what AI agents need and decide what to build. Please don't put personal information in searches.

Blockchain payments are recorded on public networks that we do not control. Wallet addresses, amounts, and transaction identifiers on those networks are public, permanent, and cannot be changed or deleted by Subpay or anyone else.