Privacy Policy

1. Introduction

This Privacy Policy applies to all information collected through our website (sublake.com), our application platform, and any related services, sales, marketing, or events (collectively, the "Service").

By using our Service, you consent to the collection and use of information in accordance with this Privacy Policy. We will not use or share your information with anyone except as described in this policy.

This Privacy Policy is governed by the laws of the State of Delaware, United States. Our registered mailing address is available on written request to contact@sublake.com.

2. Information We Collect

Information You Provide

• Account Information: Name, email address, password, phone number, company name, and job title
• Payment Information: Billing address and payment card details for your subscription (processed by our payment processor; we do not store full card numbers)
• Payment & Payout Account Information: If you use SUBLAKE Payments to accept payments from your own customers, we facilitate collection of your bank or debit-card payout account details and identity/tax information through our payment processor (Stripe). SUBLAKE does not store full bank-account or card numbers.
• Payment & Transaction Records: For businesses that accept payments through SUBLAKE, we process transaction records of your customers' payments (amount, timestamp, tokenized payment reference, receipt details).
• Partner Program Data: If you join the SUBLAKE Partner Program, we collect your referral identifiers, referral activity, and the payout and tax details needed to pay your bounties.
• Business Data: Contacts, conversations, appointments, reviews, and other business records you create or import
• Communications: Messages you send through our platform, support tickets, and emails to our team
• Preferences: Notification settings, integration configurations, and AI behavior settings

Voice Calls & Call Recordings

When the AI Receptionist answers calls for a business, we process the call audio, recordings, and transcripts of those calls. We use this information to answer callers, book appointments, surface call summaries in the business's dashboard, and improve the quality of the service.

The business that uses SUBLAKE (our customer) is responsible for providing any call-recording disclosures or obtaining any consent required by law in the jurisdictions where its callers are located, including two-party (all-party) consent jurisdictions. See our Terms of Service for the business's responsibilities.

Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, time spent on the platform
• Device Information: Browser type, operating system, device identifiers, IP address
• Log Data: Server logs including access times, pages viewed, referring URLs, and system activity
• Cookies: Session cookies, preference cookies, and analytics cookies (see our Cookie Policy)

Information from Third-Party Integrations

When you connect third-party services (Gmail, Google Calendar, Facebook, Instagram, WhatsApp, etc.), we receive data from those services as authorized by you. This may include emails, calendar events, messages, reviews, and social media interactions.

3. Google User Data

When you connect your Google account to SUBLAKE, we access the following data:

• Gmail: Email messages to enable AI-powered email responses, contact extraction, and inbox management
• Google Calendar: Calendar events for scheduling, appointment management, and availability detection
• Business Profile: Publicly listed business details (such as address and hours) used to set up and personalize your account

How we use Google data: We use Google data solely to provide our AI automation services to you. We do not sell, share, or use Google user data for advertising purposes. We do not use Google user data to train general-purpose AI models.

Data retention: Google user data is retained only as long as necessary to provide our services or as required by applicable law. You can revoke access and request deletion at any time.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription
• Power AI features including automated responses, contact enrichment, scheduling, and business communications
• Personalize your experience and improve our platform
• Communicate with you about your account, updates, and promotions (with consent)
• Respond to your support requests and inquiries
• Monitor and analyze usage patterns to improve performance and security
• Detect, investigate, and prevent fraudulent or unauthorized activities
• Comply with legal obligations and enforce our Terms of Service

SMS & Text Messaging

When you provide your mobile number — by booking an appointment on a business's booking page, or by adding it to your SUBLAKE account — we use it to send transactional text messages (SMS): appointment confirmations and reminders to a business's customers, and account and payment alerts to business owners. These are not marketing messages. Message frequency varies, and message and data rates may apply. You can opt out at any time by replying STOP, or get help by replying HELP.

We do not sell or share your mobile number or SMS opt-in with third parties for their marketing. Mobile information collected for text messaging is used only to deliver the messages you signed up for. See our Messaging (SMS) Terms for full details.

5. AI Data Processing

SUBLAKE uses artificial intelligence to process your business communications and data. This includes:

• Contact Extraction: AI analyzes incoming messages to identify and create contact records
• Sentiment Analysis: Messages are analyzed for tone and urgency to prioritize responses
• Response Generation: AI generates suggested replies based on conversation context and your business information
• Engagement Scoring: Customer interactions are scored to identify high-value relationships and churn risk

Automated Decision-Making

Our AI qualifies inquiries and books appointments automatically, without a person reviewing every interaction in advance. A human can review and override the AI's actions, and businesses control how the AI behaves in their account. If you have questions about how your data is handled by our automated systems, or you would like a person to review a specific decision, contact us at contact@sublake.com.

6. Information Sharing

We do not sell your personal information. We may share your information only in these limited circumstances:

• Sub-Processors: With a set of vetted service providers who process data on our behalf to run the Service — covering payments, telephony and SMS, voice call handling, AI processing, hosting, and email. Each is bound by a data processing agreement and may use your data only to provide services to us.
• Legal Requirements: When required by law, subpoena, or government request
• Safety: To protect the rights, property, or safety of SUBLAKE, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• With Your Consent: In any other circumstance where you provide explicit consent

We maintain a complete, current list of our sub-processors — including what each one processes and where — on our Sub-processors page. Our current sub-processors include:

• Supabase, Inc.: Database and file storage hosting
• Vercel, Inc.: Website and application hosting / content delivery
• Railway Corp.: Application (backend) hosting
• Anthropic, PBC: AI processing — understanding messages and drafting responses
• Vapi, Inc.: Real-time voice call handling for the AI Receptionist
• Twilio Inc.: Telephony and SMS delivery (phone numbers, calls, texts)
• Stripe, Inc.: Payment processing and payouts
• Resend (Plus Five Five, Inc.): Transactional email delivery
• Loops (Loops Software, Inc.): Product and lifecycle email
• Functional Software, Inc. (Sentry): Application error monitoring
• Google LLC: Calendar sync and sign-in — only when you connect a Google account (only when you connect it)
• Meta Platforms, Inc.: WhatsApp, Instagram, and Messenger messaging — only when you connect those channels (only when you connect it)

Your data is never used to train general-purpose AI models. Our AI provider processes your data only to deliver responses for your account, under terms that prohibit training on your data.

7. Data Security

We protect your information with the following measures:

• Encryption in transit: Data moving between you and the Service is encrypted using TLS 1.2 or higher
• Encryption at rest: Stored data is encrypted using AES-256 encryption
• Tenant isolation: Each workspace's data is logically isolated from every other customer's
• Least-privilege access: Internal access to data is limited to what each role needs to do its job
• Encrypted connection tokens: The access tokens for services you connect (such as Google) are encrypted before storage
• Verified webhooks: Incoming automated messages are cryptographically signed and verified before they are processed
• Audit logging: Security-relevant events are recorded in audit logs
• Backups & recovery: We take regular backups with point-in-time recovery
• Incident response: We maintain a documented incident-response process with internal escalation procedures
• Availability: The Service is designed for high availability with redundant systems
• Card data: We never store your or your customers' card numbers — card payments are handled by our payment processor, which is PCI-DSS Level 1 certified

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), gives you specific rights regarding your personal information. This section is our notice at collection and describes those rights.

Categories of Personal Information We Collect

In the twelve months before the effective date of this policy, we collect the following categories of personal information, for the purposes described in "How We Use Your Information" above — to provide, operate, secure, and improve the Service, process payments, and communicate with you:

• Identifiers: Name, email address, phone number, account credentials, IP address, and device identifiers
• Customer communications content: The content of messages, emails, and calls handled through the Service, including call audio recordings and transcripts
• Commercial and appointment information: Subscription and billing records; appointments, bookings, and related CRM records; and, for businesses that accept payments through SUBLAKE, payment and transaction records of their customers
• Financial information: For businesses using SUBLAKE Payments, the bank or debit-card payout account and identity/tax details needed to send payouts (collected and stored by our payment processor; SUBLAKE does not store full account numbers)
• Partner Program information: For partners, referral identifiers, referral activity, and payout/tax details
• Internet and network activity: Usage data, pages viewed, features used, and log data
• Professional information: Company name and job title

Sensitive Personal Information

The only categories of sensitive personal information we collect are your account log-in credentials and, for businesses that use SUBLAKE Payments, financial-account information. We use this information solely to operate and secure the Service and to send payouts. We do not sell or share it, and we do not use or disclose it to infer characteristics about you.

Your California Rights

• Right to know / access: Request the categories and specific pieces of personal information we have collected about you
• Right to delete: Request deletion of personal information we have collected from you
• Right to correct: Request correction of inaccurate personal information
• Right to opt out of sale or sharing: Direct us not to sell or share your personal information
• Right to limit: Limit the use and disclosure of sensitive personal information
• Right to non-discrimination: Exercise your rights without receiving discriminatory treatment

How to Exercise Your Rights

To exercise any of these rights, email us at contact@sublake.com or visit our Do Not Sell or Share My Personal Information page. We honor Global Privacy Control (GPC) browser signals as a valid request to opt out of sale or sharing. You may also use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly. We will not discriminate against you for exercising any of your rights.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account data: Retained while your account is active. If you delete your workspace, there is a 30-day recovery grace period, after which the data is permanently deleted; residual encrypted backups are overwritten on a rolling basis within 90 days
• Business data (CRM, messages, recordings): Retained while your account is active and exportable at any time; permanently deleted within 30 days of workspace deletion (residual backups within 90 days), except records we must keep by law
• Usage analytics: Aggregated and anonymized after 24 months
• Server logs: Retained for 90 days for security and debugging
• Billing and financial records: Retained as required by tax and accounting law (typically 7 years)

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of your personal data in a portable format
• Correction: Update or correct inaccurate personal information
• Deletion: Request permanent deletion of your personal data
• Restriction: Limit how we process your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or direct marketing
• Withdraw Consent: Revoke consent for optional data processing at any time
• Non-Discrimination: Exercise your rights without penalty or reduced service quality

To exercise any of these rights, contact us at contact@sublake.com. We will respond within 30 days (or sooner where required by law).

11. International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the US, your information may be transferred to, stored, and processed in the US. We protect international transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Addendum for transfers subject to UK GDPR
• Equivalent safeguards for transfers subject to the Swiss FADP
• Data Processing Agreements (DPAs) with all sub-processors

Data breach notification. If a breach affects your personal data, we will notify you and any applicable authorities without undue delay and consistent with applicable law.

12. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

13. Policy Changes

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by email and by posting the updated policy on our website at least 30 days before the changes take effect.

14. Contact Us

For privacy-related inquiries, data requests, or to report a concern: