Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account data: name, email, password (hashed), profile information
• Location data: an approximate location (country and, where available, city) derived from your IP address when you sign up or sign in — see "Location & Member Map" below
• Transaction data: purchase history, payout details, Stripe Connect ID
• Usage data: IP address, device, browser, pages visited, interactions
• Communication data: messages sent through the Service, support requests

2. Location & Member Map

When you create an account or sign in, we derive an approximate location (your country and, where available, your city) from your IP address, and store it on your profile. IP-based location is approximate by nature and can be inaccurate (mobile networks, VPNs). You stay in control:

• You can change or remove your location at any time in your profile settings; a location you set or remove yourself is never overwritten by automatic detection
• Your location may be shown on your public profile and, as a point placed on your city (never your exact position), on the member map of communities you belong to — the map is only visible to members of that community
• You can hide your location everywhere with the "Show location" setting in your profile
• The products you have joined may be visible on your public profile and on community member maps; you can hide them with the "Joined stores" setting

3. How We Use Your Data

We process your data to:

• Provide, maintain and improve the Service
• Adapt the Service to your region (language) and show your approximate location as described above
• Process payments and payouts
• Communicate with you about your account and the Service
• Detect and prevent fraud or abuse
• Comply with our legal obligations

4. Legal Basis

We process your personal data on the following legal grounds: performance of the contract (your use of Subicon), our legitimate interest (security, improvement of the Service, localisation of the Service), your consent (marketing emails) and legal obligations (tax, accounting).

5. Data Sharing

We share data only with trusted service providers needed to operate Subicon:

• Stripe — payment processing and payouts
• Supabase — database and authentication hosting (EU, Dublin)
• Vercel — application hosting and IP-based geolocation of requests
• ipwho.is — fallback IP geolocation (your IP address is sent to this service only when our host cannot resolve your country)
• Resend — transactional emails
• Cloudflare R2 / Bunny — file storage and delivery

6. Cookies

We use cookies and similar technologies to operate the Service and analyse usage. See our Cookie Policy for details.

7. Your Rights (GDPR)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing — including objecting to the display of your location (use the "Show location" setting or contact us)
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encrypted database storage, regular security audits and access controls.

9. Data Retention

We retain your personal data for as long as your account is active, and for additional periods required by law (e.g., accounting records: 10 years). You can request earlier deletion by contacting us.

10. International Transfers

Some of our service providers are located outside the European Economic Area. When data is transferred, we ensure appropriate safeguards (e.g., Standard Contractual Clauses) are in place.

11. Children

Subicon is not intended for users under 16. We do not knowingly collect data from minors. If we become aware of such data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or via the Service.

13. Contact

For privacy questions or to exercise your rights, contact us at contact@subicon.io.