Privacy and Personal Data Policy
What data the SUBXCAT website collects, why, who receives it, how long it is kept and how to have it deleted.
Version of October 25, 2026.
1. General
1.1. This policy describes how the SUBXCAT team (“we”, “the controller”) processes personal data of visitors to subxcat.com (“the site”).
1.2. By using the site you confirm that you have read this policy. By sending a request — through the assistant or the form — you consent to the processing of the data it contains under this policy. If you do not agree, do not send a request, and leave the site or disable cookies and analytics in your browser.
1.3. For any question about your data, contact us at hello@subxcat.com.
2. What data we process
2.1. Data you provide in the conversation with the assistant or in the request form: name, contact (email or Telegram), your role, project stage, budget range, links to the product or repository, a description of the project and the conversation with the assistant, and whether you need an NDA.
2.2. Data collected automatically: IP address, browser and device type, language, time zone, pages visited, referrer, time of visit, actions on pages, and cookie identifiers — through analytics services (section 5).
2.3. We do not ask for or process special categories of data (health, beliefs, etc.) or biometrics. Please do not include them in your request.
2.4. Do not send passwords, API keys, access tokens, payment card data or trade secrets through the site. The chat and the form are not meant for that. If the work requires access to code or services, we will agree on a secure channel after an NDA is signed. Whoever submits information is responsible for its content and for having the right to share it.
3. Why we process data
- to answer your request, prepare a project review and a rough estimate;
- to contact you through the channel you chose;
- to discuss and conclude a contract at your request;
- to understand how the site is used and improve it (aggregate statistics);
- to protect the site from abuse: spam, automated requests, intrusion attempts.
We do not sell personal data and do not use it for mailings you did not subscribe to.
4. Legal basis
We process data on the basis of your consent (sending a request, continuing to use the site with cookies enabled), to take steps towards a contract at your request, and in our legitimate interest in keeping the site secure. You may withdraw consent at any time (section 8).
5. Cookies and analytics
5.1. The site uses cookies and web analytics services:
- Yandex Metrica (Yandex LLC), including Session Replay (Webvisor) and click maps. The assistant chat and the request form are marked so that Session Replay does not record what you type in them.
- Google Analytics (Google LLC).
5.2. These services receive pseudonymous visit data: IP address, browser and device details, pages and actions on them. The data is processed under these companies’ own terms and may be stored on their servers, including outside your country. See the Yandex and Google privacy policies.
5.3. You can opt out: block cookies in your browser, use private browsing, install a content blocker or the official opt-out add-ons for Yandex Metrica and Google Analytics. The site will keep working.
6. Who receives data
To run the site, data is shared with processors, and only to the extent each task requires:
- hosting: Hetzner Online GmbH — a server in the European Union (Finland) where requests are stored;
- AI assistant: your name (so the assistant can address you), role, stage, budget and the conversation are sent to the language model provider Anthropic PBC to generate replies and the estimate. Your contact details are not sent to the model;
- team notifications: Telegram — if notifications are enabled, the request is forwarded to the team’s private work chat;
- analytics: Yandex and Google (section 5).
By sending a request you consent to the cross-border transfer of data to these processors. Data may also be disclosed upon a lawful request from public authorities.
7. How long we keep data
- requests and assistant conversations — up to three years from submission, or until you withdraw consent, whichever is earlier; if we sign a contract with you — for its term and the periods required by law;
- server technical logs — up to 30 days;
- analytics data — under Yandex’s and Google’s rules.
8. Your rights
You may:
- find out what data of yours we process;
- ask us to correct or delete it;
- withdraw your consent;
- object to processing for analytics.
Write to hello@subxcat.com from the address or account given in your request, so we can verify it is you. We will reply within 30 days. Withdrawing consent does not affect the lawfulness of processing carried out before it.
9. How we protect data
The site runs over HTTPS only. Requests are stored on a server accessible by key only, and only team members who need them for their work have access. We apply reasonable organisational and technical measures, but no method of transmission or storage over the internet is absolutely secure; we are not liable for the actions of third parties who gain access to data by circumventing these measures.
10. Children
The site is intended for people over 18 and for company representatives. We do not knowingly collect data from minors. If you believe a child has sent us their data, contact us and we will delete it.
11. Links to other sites
The site may link to third-party resources. We do not control them and are not responsible for how they process data.
12. Changes
We may update this policy. A new version applies from its publication on this page; the version date is shown at the top. By continuing to use the site after changes, you accept the new version.
13. Contact
Controller: SUBXCAT. Site: subxcat.com. Email: hello@subxcat.com.