Privacy Policy
Last updated October 26, 2026
This policy explains what SubSignoff, operated by SubSignoff, collects and why. Questions or requests: support@subguard.live.
What we collect
- Account details: your email address, the workspaces you belong to, and your role.
- Workspace content: subcontractor business contacts, projects and requirements, uploaded documents, document details, review decisions, and activity history. This includes prequalification details a contractor or subcontractor enters: company profile and license numbers, references (names and contact details of people the subcontractor lists) and past projects, approvals, exceptions, post-job ratings and notes, and any private “restricted” flag a contractor records. Ratings, notes and restricted flags are visible only inside the contractor’s workspace; restriction details are limited to its owners and admins and are never shown to the subcontractor.
- W-9s: W-9 files are hidden from read-only viewers and broker upload links, and are left out of audit packs unless an owner or admin turns that on.
- Messages: reminder and invitation emails or texts sent through SubSignoff, with their delivery status.
- Billing: your plan and Stripe subscription status. Card details are collected by Stripe; SubSignoff never receives your card number.
- Technical data: essential cookies that keep you signed in (session, 7 days) and remember your selected workspace. We don’t use advertising or cross-site tracking cookies.
How we use it
Only to run SubSignoff for you: storing and showing your records, checking documents against your requirements, sending the reminders and invitations you set up, billing, security, and support. We don’t sell personal information.
Who processes it
- Cloudflare hosts the application, database, and private file storage, provides sign-in bot protection (Turnstile), and runs Smart Review (Workers AI).
- Resend sends email. Stripe handles payments.
Smart Review
When someone in your workspace chooses to read a certificate with Smart Review, that file is processed by an AI model to suggest policy details. Suggestions are saved with the document so it isn’t read twice. A person confirms every value; nothing is approved automatically. Avoid uploading personal information that isn’t needed, such as Social Security numbers.
Who can see your data
Members of your workspace, according to their role. A person with a document upload link (the subcontractor or their insurance broker) can see your company name, the subcontractor’s name, the requested document types and how many files were sent through that link, and can upload those files; links expire, are capped, and can be revoked. SubSignoff staff access data only to provide support you request, to keep the service secure, or when required by law.
How long we keep it
| Data | Kept for |
|---|---|
| Workspace records: subcontractors, projects, document details, review decisions, requests, settings | For as long as the workspace exists. Deleted within 30 days of a confirmed deletion request. |
| Uploaded documents (certificates, W-9s, licenses and other files) | For as long as the workspace exists. Deleted within 30 days of a confirmed deletion request. |
| Activity history (who uploaded, reviewed, or changed what) | For as long as the workspace exists, so your review trail stays complete. |
| Account email and team membership | Until the account or workspace is deleted. |
| Sign-in codes | Codes expire after 10 minutes. Deleted 1 day after it expires. |
| Sign-in sessions | Sessions last 7 days. Deleted when it expires. |
| Team invitations | Invitations expire after 7 days. Deleted 30 days after it expires. |
| Document upload links | Links expire after 7, 14 or 30 days (you choose). Deleted 90 days after they expire or are revoked. |
| Email unsubscribes (the address and workspace it applies to) | For as long as the workspace exists, so we keep honoring the request. |
| Email and text-message log (recipient, subject, message, delivery status) | Deleted 180 days after the message was created. |
| Smart Review results | Kept with the document they describe. Failed attempts are deleted after 90 days. |
| Billing status (plan, subscription status, Stripe customer ID) | While the workspace exists. Stripe keeps payment records under its own policy. |
| Notification IDs from Stripe and our email service (used only to ignore duplicates) | Deleted after 90 days. |
| Database backups | Point-in-time backups roll off after at most 30 days, so deleted data can remain in backups for up to 30 days. |
| Request logs kept by our hosting provider (may include IP address) | Up to 7 days. |
Expired items are removed automatically by a scheduled job that runs every 10 minutes.
Your choices
- Export: download your workspace data, CSV reports, and original documents from the app anytime.
- Access, correction, deletion: email support@subguard.live from your sign-in address. Workspace deletion requests must come from the owner.
- Text messages (only if text reminders are turned on for a workspace): reply STOP to opt out.
- Request and reminder emails: every one has an unsubscribe link; after that, the workspace that sent it can’t email that address through SubSignoff.
- Account and service emails, such as sign-in codes, are needed to operate the app.
Changes
We’ll update the date above when this policy changes and email workspace owners about significant changes.