Privacy Policy

Who we are

subba.pro is a service operated by Polarize Ltd, a company registered in England and Wales under company number 12944077, with its registered office at 20-22 Wenlock Road, London, England, N1 7GU.

For the purposes of UK data protection law, Polarize Ltd is the data controller for this website and your account data, and our Information Commissioner’s Office registration number is ZA825619. For the contact-form enquiries and bookings we handle on your behalf as a business using subba, we act as your data processor and you remain the controller of your customers’ data. Our data processing agreement with you is part of our Terms (section 11a).

What we process

Account data: when you sign in with Google we receive your email address, name, and a Google account identifier, which we store to create and secure your account.

Contact-form enquiries: when a visitor submits your form, we process their message to filter spam, classify the enquiry, and draft or send a reply. Alongside the enquiry itself we keep a short record of it (its classification, intent and status, with the sender’s email only as a salted hash), which also counts your monthly enquiries.

End-customer data: when a business uses subba, we hold personal data about that business’s customers on the business’s behalf, as its processor. This includes the name, email, phone number, and details of bookings, orders (click-and-collect and shop), quote requests, memberships, store credit, loyalty cards, and any notes the business adds. We do this to provide the service to the business; the business is the controller of this data.

Booking and order data: for a booking or order we store the customer name, email, chosen service or items, pickup or appointment time, amount, and status, to make and confirm it and place it in the calendar.

Phone calls: when someone rings a business’s AI phone line (the voice add-on) or subba’s own number, they are told at the start that the call is recorded and monitored and that they are speaking to an AI assistant. The call is recorded and transcribed by our phone providers (listed below), and we keep the caller’s number, the transcript, a short summary, and any booking or message from the call, so the business can see what was said and follow up. For a business’s line, the business is the controller and we act as its processor; for calls to subba’s own number, we are the controller.

Activity log: we keep a log of service activity (for example emails sent, with the recipient masked, and account changes) to run, support, and secure the service.

Calendar: if you connect Google Calendar, we store a refresh token so subba can create events on your behalf. We request the minimum scope needed (calendar events) and you can disconnect at any time.

Domains: if you order a domain, we keep your order (the name, any note you add, and who placed it) and register it for your business through our registrar, Cloudflare. The registry for that ending (Nominet, for .uk and .co.uk) records the domain’s owner and contact details, as its rules require.

Payments: booking payments are taken through Stripe into your own connected Stripe account, so you are the merchant of record. We store a Stripe customer or connected-account reference and your subscription status. We never see or store card numbers.

Technical data: standard request logs and security signals (such as IP address and rate-limit counters) used to run the service and prevent abuse.

Free-trial protection: so each person gets one free trial, we keep a salted hash (a one-way scrambled value) of the email address and of the card identifier Stripe gives us for each trial, and of the internet address each new account was opened from. These cannot be turned back into your email address, card or internet address.

If you are a customer of a business that uses subba

Many businesses use subba for their booking page, website chat, contact and quote forms, shop, and AI phone line. When you book, order, enquire, chat or call one of them, the business decides how your details are used (it is the controller), and subba handles them for it (we are its processor). The business may have its own privacy notice, linked where you give your details.

What is collected: your name, email address and phone number; what you book, order or ask about, and when; your messages and chats; if you phone, a recording, transcript and summary of the call; a delivery address if you choose delivery; and whether you have paid (card details go straight to Stripe and are never seen by subba or the business).

What it is used for: to make and manage your booking, order or enquiry, to send you confirmations, reminders and replies, and to let the business keep its records. The business sends you offers and news (such as a reminder to book again or a request for a review) only if you say yes, by ticking the box when you give your details or on your booking’s manage page. You can change your mind at any time on the manage page, with the unsubscribe link in any offer, or by replying STOP to a text. Saying no to offers never stops messages about your bookings.

Who sees it: the business, and the providers listed under Sub-processors below that help us run the service. We never sell your data, and it is not used to train AI models.

How long it is kept: your bookings, orders and quotes stay in the business’s records while it uses subba, until it deletes you as a customer or closes its account. Other records are deleted sooner, as set out under “How long we keep data” below.

Your rights: you can ask the business for a copy of your data, to correct it, or to delete it; its subba dashboard lets it download or delete a customer’s data in a few clicks. You can also email [email protected] and we will pass your request to the business and help it respond. If you are unhappy with how your data has been handled, you can complain to the Information Commissioner’s Office at ico.org.uk.

AI processing

Enquiries, chats, and phone calls on the voice add-on, are processed by a large language model (Anthropic Claude) to classify the enquiry and draft a reply in the business’s voice, using the knowledge the business provides. We do not use your data or your customers’ data to train models, and our AI providers process it only to return a response to us.

Agent and API access

subba exposes a booking API and an MCP server so AI agents can, with a person’s direction, look up your services, check availability, and make a booking. These use the same booking data described above and are subject to the same safeguards; no additional personal data is collected by making subba agent-readable.

Cookies

On this website and in the dashboard (app.subba.pro), nothing non-essential loads until you choose. A banner lets you accept all, reject all, or choose by category, and Google Analytics and Microsoft Clarity load only if you accept Analytics. Your choice is stored in a first-party cookie and recorded with AllowKit, against a random id kept in your browser (not your name or email), so we can show what you agreed to and when. Google Consent Mode v2 keeps tags denied unless you opt in, and turning Analytics off later removes their cookies.

You can change your choice at any time, here or from Cookies at the foot of the dashboard:

Manage cookie preferences

We also use local storage for one small value: subba_sid, a random id that links your consent record. It stays on your device and is not sent to advertisers. The booking page, chat and forms that businesses put on their own websites set no cookies.

Sub-processors

We use the third parties below to process personal data on our behalf, each under its own data-processing terms. The voice and SMS providers apply only when a business uses those add-ons. We will tell businesses using subba of changes to this list at least 14 days in advance (see Terms, section 11a).

Some of these operate outside the UK; see “International transfers” below for the safeguards that apply.

Legal bases

We rely on: performance of a contract (running the service and your account); legitimate interests (securing the service, preventing spam and abuse, keeping an audit trail, and keeping an accurate record of phone calls); and consent (analytics and marketing cookies). As a business using subba, you are responsible for the lawful basis to reply to and process your own customers’ data. Offers to your customers rely on the “soft opt-in”: subba asks them whether they want offers when they give their details, and puts an unsubscribe link in every offer it sends for you.

How long we keep data

We keep personal data only as long as it is needed, then delete it automatically, every night.

When a business deletes a customer, their bookings, orders and payments stay in the business’s records with no name or contact details, as businesses must keep their accounts. Everything else about them is deleted, including their call recordings.

International transfers

Some processors operate outside the UK, mainly in the United States (for example Anthropic, Vapi, Twilio and Deepgram). Where they do, transfers are protected by the UK’s data bridge for providers certified under it, or otherwise by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Referrals and affiliates

If you reach subba through a partner or affiliate link, we record which partner referred you so we can pay them a commission if you become a customer. This uses the subba_ref cookie, which stores only a short partner code, not your personal data, and is set only if you accept Marketing cookies. If you sign up in the same visit, the code may also travel in the link and sign-in flow to complete that referral.

Partners never receive your personal data. They see only that a referral converted and the commission owed. The legal basis is consent for the cookie and our legitimate interest in running a referral programme for the commission calculation. You can withdraw at any time by rejecting Marketing cookies.

If you are a referral partner, we use your name, email address and sign-in details to give you your referral account, and your payout details, which Stripe holds, to pay you. We keep records of commission and payouts for as long as the law requires for tax and accounting. The legal basis is the contract under our Referral Programme Terms.

Security

Customer names, email addresses and phone numbers, their messages, chats and call transcripts, and notes about them are encrypted in our database, with the key held separately. API keys are stored only as salted hashes and verified in constant time. Transport is encrypted, requests are strictly validated and rate limited, sessions are signed and can be ended on every device at once (Settings, Your account), calendar and payment tokens are never exposed to the browser, and the security log cannot be deleted while it is kept.

Your rights

You have the right to access, correct, delete, restrict, or object to our use of your personal data, to portability, and to withdraw consent at any time. You can close your account and delete its data yourself in Settings, Your account. For anything else, or to opt out, email [email protected] and we will respond within one month.

Businesses using subba: when one of your customers asks for their data or for it to be deleted, open them in Customers and use “Download their data” or “Delete this customer”.

End customers: see “If you are a customer of a business that uses subba” above.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would welcome the chance to resolve it with you first.

Children

subba is a business tool and is not directed at children. We do not knowingly collect data from children through this service.

Changes and contact

We may update this policy; the version published here applies from the date shown above. All communications are by email only. Contact [email protected], or [email protected] for data protection requests.