Privacy Policy

Sublex Chat, a service of Sublex Digital, a business registered in The Gambia (contact: info@sublexdigital.com) Last updated: 14 August 2026

This policy explains what personal data Sublex Chat handles, why, who it is shared with, and your rights. We have tried to say plainly what we do, including the parts that are less flattering, because a privacy policy that hides the answer is worse than none.

1. Two different roles

Sublex Chat handles personal data in two distinct ways, and it matters which is which:

• Data about you, our customer (the business or person who opens an account

and the people on your team). For this data, we are the controller and this policy governs it.

• Data about your customers (the people who chat with an assistant you have

set up). For this data, you are the controller and we are your processor — we handle it on your behalf and on your instructions. How we do that is set out in our Data Processing Addendum. You are responsible for telling your own customers how their data is used, in your own privacy notice.

2. Data we hold about you (our customer)

• Account and team data: your name, email address, and sign-in details.

Sign-in (including any Google sign-in) is handled by our authentication provider, Supabase. When you invite a colleague, we store the email address you invite until the invitation is used or withdrawn.

• Billing data: your plan, currency, amounts, subscription status and dates,

and a reference to your customer record with our payment provider. We never see or store your card number — card details are entered directly on our payment provider's checkout (see section 5).

• Support and feedback: messages you send us, and feedback you submit in the

product.

• Audit records: a record of administrative actions taken in your account

(who did what, and when), which we keep as a security and accountability measure and do not delete.

• Technical data: we use your network address to protect the service against

abuse — but we store only a one-way hash of it, never the address itself.

3. Data your customers give an assistant (we process for you)

When someone chats with your assistant, we process, on your behalf:

• The messages they send and the answers given, stored as the conversation

transcript.

• Contact details they choose to leave — name, phone number, email, and any

answers to a pre-chat form you have set up — stored as a lead.

• On WhatsApp (once enabled), the customer's WhatsApp number, used to

identify the thread and reply.

We do this only to provide the assistant service to you: to answer the question, keep the conversation continuous, capture leads you asked for, and show you the transcript and analytics in your dashboard.

A note on masking. In your dashboard, phone numbers and email addresses in a transcript are hidden by default (you can turn this off). This masking is applied when the transcript is shown; the underlying message is stored as written, because when a customer leaves their number as a lead, you need it. Contact details captured as a lead are shown to you in full — that is the point of a lead.

4. Why we use data, and our lawful basis

We use the data above to: provide and run the service; authenticate you; take payment; protect the service from abuse and overspending; send you service and account emails (such as escalation alerts, quota warnings, and your value digest); and meet our legal obligations. Where a data-protection law applies to you — The Gambia's Personal Data Protection and Privacy Act, 2025, or the GDPR for customers in the EU or UK — our lawful bases are performance of a contract (to run your account and answer your customers), legitimate interests (to keep the service secure and improve it), and consent where the law requires it.

We do not sell personal data, and we do not use your customers' conversations to train AI models.

5. Who we share data with (our subprocessors)

We use a small number of trusted providers to run the service. Each receives only what it needs:

Each provider processes data under its own data-protection terms: Supabase, Vercel, OpenRouter, DeepInfra, Resend, Paddle, Meta and Sentry.

6. Where data is processed (international transfers)

Our database, file storage and sign-in are hosted in the European Union (Paris, France). To generate answers and search vectors, a customer's question text and your knowledge are sent to our AI and embedding providers, whose processing may take place outside that region. We keep these transfers to what is necessary to answer a question. Where the law requires a safeguard for such a transfer, we rely on the provider's standard contractual clauses and data-processing terms.

7. How long we keep it

• You control conversation retention. Each account has a retention setting.

By default it is off, which means conversations are kept until you delete them or close the account. When you set a retention period, conversations older than it — and the leads and messages attached to them — are deleted automatically. By default, conversations are kept until you delete them or your account; you choose the retention period.

• Abandoned demo accounts created by our try-before-signup flow are deleted

automatically after seven days if never claimed; an account left with no members is removed within an hour.

• Account and billing records are kept for as long as your account is open and

as long as we need them to meet legal and accounting obligations.

• Audit records are kept as a security measure and are not editable or

deletable.

Closing your account removes your organisation and the data attached to it, subject to any records we must keep by law.

8. How we protect it

• Tenant isolation is enforced in the database itself (row-level security),

not only in application code, so one business's data cannot be read by another.

• **Our own staff and administrators cannot read your customers' conversation

content** — not for support, not for account management. This is enforced by the same database rules: the tables holding messages, leads and private notes are never exposed to a support view. We describe this commitment in our Terms too.

• Network addresses are stored only as hashes, never in readable form.
• Data is encrypted in transit. At-rest protection is provided by our hosting

provider. Our database and file-storage provider encrypts data at rest (AES-256).

• Error reports are stripped of request content before they leave our servers.

No system is perfectly secure, but security is treated here as a database-level guarantee rather than a convention.

9. Your rights

Depending on the law that applies to you, you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email info@sublexdigital.com.

If your request is about data an assistant collected — a customer's conversation or lead — the business that runs that assistant is the controller, and we will help that business respond rather than acting on the data ourselves.

If you are in The Gambia, you can complain to the Information Commission, the supervisory authority under the Personal Data Protection and Privacy Act,

1. If you are in the EU or UK, you can complain to your local supervisory

authority.

10. Cookies

The service uses a small number of essential cookies and browser storage, and no advertising or analytics tracking. This is described in our Cookie Notice.

11. Children

Sublex Chat is a business tool and is not directed at children. We do not knowingly collect data from children. The service is for users aged 18 and over, consistent with our Terms.

12. Changes and contact

We may update this policy; material changes will be notified reasonably (by email or in the dashboard). Questions, or to exercise a right:

info@sublexdigital.com — Sublex Digital, The Gambia.