Privacy Policy

1. Introduction
Welcome to Subsights. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with our website (subsights.com), our AI-powered chatbot widget, and our related services (collectively, the "Service").
This policy is designed to be transparent about our data practices and is a part of our Terms of Service.

2. Our Roles as Data Controller and Data Processor
This Privacy Policy covers two distinct scenarios based on how you interact with our Service. It is important to understand our role in each case:
Subsights as Data Controller: When you visit our website (subsights.com), contact us directly, or interact with our own chatbot on our website, Subsights is the Data Controller. We determine the purposes and means of processing your personal data to market and provide our services.

3. Subsights as Data Processor: When you interact with a Subsights-powered chatbot on a third-party website (one of our "Customers"), that Customer is the Data Controller. They determine the purposes of collecting your data. In this relationship, Subsights acts as the Data Processor, processing your data on behalf of and at the direction of our Customer.
This policy will specify which sections apply to our role as a Controller versus a Processor. Where not specified, the terms apply to both scenarios.

Information We Collect and Process
We collect various types of information to provide and enhance our Service.

3.1 When Subsights is the Data Controller (Our Website & Direct Communications)
Personal Data You Provide: When you sign up for our Service, request a demo, or contact us, you may provide us with personal information such as your name, email address, and company name.
Interactions with our Chatbot: When you use the chatbot on subsights.com, we collect the data outlined in Section 3.2, and we act as the Controller for that data.

Cookies and Usage Data: We use cookies and similar tracking technologies to track activity on our website and hold certain information. This may include your IP address, browser type, pages visited, and other standard usage data.

3.2 When Subsights is the Data Processor (Our Service on Customer Websites)
When you interact with our Service on a Customer's website, we process the following information on their behalf:
Conversation & Interaction Data: We process the full text transcripts of your conversations with the chatbot, including all questions you ask and the responses provided. We also track which links are provided by the chatbot and which specific URLs you click on to help our Customers measure the effectiveness and resolution rate of the Service.
Location Information: At the beginning of a chat session, we automatically determine your approximate geographic location (Country, State/Region, and City) by analyzing your IP address. We do not collect precise GPS coordinates. Our Customers use this data for aggregated analytics and to understand their user base.
Technical Usage Data: We automatically collect your IP address and information about your device and browser to ensure the security and proper functioning of our Service across different platforms.

4. How We Use Information
As Data Controller: We use the information we control to provide you with the Service, manage your account, communicate with you (including marketing communications, with your consent), and to improve our own website and service offerings.
As Data Processor: We use the information we process to provide the Service to our Customer, allow them to analyze chatbot performance and user engagement within their secure workspace, and to maintain and troubleshoot the Service.

5. Data Sharing and Disclosure
We do not sell your personal data. We may share information under the following limited circumstances:
With Our Customers: We provide our Customers with access to the data generated from their chatbot implementation, including conversation transcripts and analytics.
With Our Partners: If our Customer has engaged with a Subsights-certified partner for setup or administration, that partner may have access to account information as a Sub-processor, acting on the Customer's behalf.
With Third-Party Sub-processors: To provide our Service, we use a number of third-party infrastructure providers and AI models ("Sub-processors"). Our policy is to use commercial APIs from these providers under terms that prohibit them from using any data we send to train their own models. For a complete and up-to-date list of our sub-processors, please see our sub-processor list at https://www.subsights.com/dpa.
For Legal Reasons: We may disclose your data if required by law, in connection with a business transaction (like a merger or acquisition), or to protect the rights, property, or safety of Subsights, our customers, or the public.

6. Data Retention and Security
Data Retention: When acting as a Data Processor, we retain a Customer's data for as long as their account is active. Upon termination of a Customer's account, we retain the data in a deactivated state for a 90-day grace period to allow for easy account reactivation. After this grace period, all personal data is permanently deleted from our active systems within a further 30 days. A Customer may request immediate deletion during the grace period by contacting us.
Data Security: We implement reasonable administrative, technical, and physical security measures to protect your information. However, no electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Data Protection Rights & How to Exercise Them
Data protection laws in certain jurisdictions (like the GDPR in Europe and the CCPA in California) provide you with rights regarding your personal data.
As Subsights primarily acts as a Data Processor, any requests to exercise your data protection rights (such as the right to access, correct, or delete your personal data) should be directed to the company or owner of the website where you used the chatbot (the Data Controller).
You may initiate such a request directly within the chatbot interface. These requests will be routed as a notification to the Data Controller, who is responsible for verifying your request and instructing Subsights to take the appropriate action (e.g., deleting a specific conversation transcript).
If you have a direct account with Subsights, you may exercise your rights by contacting us at the email below.

8. International Data Transfers
Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and that appropriate safeguards, such as the Standard Contractual Clauses, are in place.

9. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically for any changes.

10. Contact Us
If you have any questions about this Privacy Policy, please contact us at: support@subsights.com