Privacy Policy

SubbyApps is provided by Subby Apps Ltd (“SubbyApps”, “we”, “us”, “our”), a company registered in England and Wales with its registered office at 41 Horsley Close, Epsom, KT19 8HB, United Kingdom.

For the purposes of UK data protection law, Subby Apps Ltd is the data controller for the personal data described in this policy.

This policy explains what personal data SubbyApps collects, how we use it, who we share it with, and the rights you have over it. It applies to everyone who uses the SubbyApps application — company admins, company accounts, quantity surveyors/project managers, and staff users — and to visitors to our public marketing pages.

We collect and process the following categories of personal data:

• Account details: your name, email address, a securely hashed version of your password (we never store your password in readable form), and your role within your company.
• Company/business details: your company’s name, address, bank account name and number, sort code, VAT or company registration number, and logo — entered by a company admin to appear on generated payment applications.
• Project and application data: the projects, claims, valuations, percentage-complete figures, variation details, comments, and other information you or your colleagues enter to prepare payment applications. Free-text fields such as comments could incidentally include personal data if you choose to include it.
• Communications: messages you send us through the contact form or by email, and correspondence about your account.
• Technical data: standard web server logs (such as IP address, browser type, and pages requested), collected automatically for security and troubleshooting.

Some of the information above — bank details, VAT numbers — belongs to your business rather than to you personally, but we treat it with the same care described in this policy.

We use your data for the following purposes:

• To provide the service — creating your account, running the application/claim workflow, generating PDF payment applications, and letting your colleagues collaborate on shared projects. This is necessary to perform our contract with you and your company.
• To keep you informed — sending password reset emails and submission-deadline reminder emails. This is necessary to provide the service and is in our legitimate interest of running it properly.
• To keep the service secure and working — monitoring for misuse, diagnosing faults, and enforcing the role-based access controls that keep your data visible only to people who should see it. This is in our legitimate interest of protecting the service and your data.
• To respond to you — when you contact us with a question or support request.
• To meet legal obligations — such as keeping financial records where the law requires it.

We do not use your data for advertising, and we do not sell it.

We share personal data only where it’s needed to run the service:

• Colleagues at your own company see project and application data according to the role your company admin gives you — that’s how the service is designed to work.
• Resend, our transactional email provider, sends password reset and reminder emails on our behalf. Resend is based in the United States; where personal data is transferred there, we rely on Standard Contractual Clauses or an equivalent recognised safeguard.
• Our hosting and database providers — the application runs on a UK/EU-based server, and the database is hosted in Frankfurt, Germany.
• We may also disclose data where required by law, or to protect the rights, property, or safety of SubbyApps, our users, or others.

We do not share your data with third parties for their own marketing purposes.

SubbyApps uses a single strictly-necessary cookie to keep you signed in. It doesn’t track you across other websites, and we don’t use advertising or analytics cookies. Because this cookie is essential to the service working, we don’t need to ask for your consent to use it.

We keep account and project data for as long as your company’s account with us is active, so applications remain available and the service keeps working correctly. If your company’s account is closed, we’ll delete or anonymise personal data within a reasonable period, except where we’re required to keep it for longer (for example, financial records for tax purposes).

Passwords are stored using a one-way cryptographic hash, never in plain text. Traffic to and from SubbyApps is encrypted in transit (HTTPS). Access to project and company data is controlled by the role-based permissions built into the application, so staff only see the projects they’re assigned to.

Under UK GDPR, you have the right to:

• ask us what personal data we hold about you, and get a copy of it;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, in certain circumstances;
• ask us to restrict or object to how we use your data;
• ask for your data in a portable format, where technically feasible; and
• complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk if you think we’ve mishandled your data.

To exercise any of these rights, contact us using the details below. If you use SubbyApps as part of a company account, some requests (for example, changing role permissions) may need to go through your company admin.

SubbyApps is a business tool intended for use by adults in a professional capacity. It isn’t directed at, or knowingly used to collect data from, children.

We may update this policy from time to time — for example, as the service changes or the law requires. We’ll update the “Last updated” date at the top of this page when we do.

If you have any questions about this policy or how we handle your data, contact us at info@subbyapps.co.uk or write to us at Subby Apps Ltd, 41 Horsley Close, Epsom, KT19 8HB, United Kingdom.