Privacy Policy

Information We Collect

Subix collects information you provide directly and information generated through your use of our platform — including LeadOS CRM, HRMS, and our digital services.

Account & Identity Data: Name, email address, phone number, company name, designation, and billing information collected during signup or service onboarding.

Business Operations Data: Lead records, employee profiles, attendance logs, payroll configurations, and activity history created and managed within our software products.

Usage & Analytics Data: Pages visited, features used, session duration, click patterns, and device information collected automatically via PostHog analytics and system logs.

Communication Data: Emails, support ticket content, and form submissions sent to us through contact forms or direct email.

How We Use Your Information

We use your data solely to operate, improve, and support the Subix platform and services. We do not sell your personal data to third parties — ever.

• To create and manage your Subix account and active subscriptions
• To operate LeadOS CRM — tracking leads, activities, pipeline stages, and follow-ups on your behalf
• To operate HRMS — employee directory, attendance records, leave management, and payroll processing
• To deliver digital services including web development, paid marketing, content creation, and PR
• To send transactional emails (receipts, alerts, system notifications) and service-related updates
• To diagnose bugs, improve product performance, and develop new features based on usage patterns
• To comply with legal obligations under the Indian IT Act, 2000 and applicable data regulations

Who We Share Data With

We share your data only with trusted third-party service providers who help us deliver our platform. All sub-processors are bound by data processing agreements.

• Supabase — Cloud database and authentication infrastructure (data hosted in secure AWS regions)
• Vercel / Cloudflare — Website hosting, CDN, and edge functions
• PostHog — Product analytics (anonymized usage data only)
• Resend / SMTP providers — Transactional email delivery
• Razorpay / Stripe — Payment processing (we never store full card details)
• Google Ads / Meta Business — Only aggregated campaign data for performance marketing clients

We will disclose your data if required by a valid court order, government authority, or legal process under Indian law.

Data Storage & Retention

All Subix data is stored on Supabase infrastructure hosted on secure, encrypted servers. Business-critical data is replicated and backed up with point-in-time recovery.

We retain your data for as long as your account is active. Upon account deletion or subscription cancellation:

• Your CRM and HRMS data is retained for 30 days before permanent deletion
• You may request an export of all your data before deletion at any time
• Billing records are retained for 7 years as required by Indian financial law
• Anonymous analytics data may be retained indefinitely as it cannot be tied to individuals

Your Rights & Choices

You have full rights over your personal data. To exercise any of the following, email us at contact@subix.in:

• Access: Request a complete copy of all personal data we hold on you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request permanent deletion of your account and associated data
• Portability: Request your data in a machine-readable format (CSV / JSON)
• Opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link in any email
• Restrict processing: Request that we limit how we process your data in specific circumstances

We will respond to all verified requests within 30 days.

Security Measures

Subix takes data security seriously. Our platform is built on Supabase with Row Level Security (RLS) ensuring each organisation can only access its own data — even if they share the same database infrastructure.

• All data in transit encrypted via TLS 1.3
• All data at rest encrypted using AES-256
• Row Level Security (RLS) policies enforced at the database level for every table
• API keys stored as environment variables — never committed to source code
• Authentication via Supabase Auth with secure HttpOnly cookie sessions
• Regular security audits and dependency vulnerability scanning

Despite our best efforts, no system is 100% immune. In the event of a data breach affecting your data, we will notify you within 72 hours via the email on your account.

Cookies & Tracking

We use essential and analytical cookies on our website. For full details on the types of cookies we use and how to control them, please read our Cookie Policy.

In summary, we use: session cookies for authentication, analytics cookies for product improvement (PostHog), and no third-party advertising cookies on our own website.

Contact Us

For privacy-related questions, data requests, or to report a concern, contact our Data Controller: