Privacy Policy
Last updated: September 11, 2026
1. Introduction and Scope
Welcome to Subdano. We respect your privacy and are committed to protecting your personal data. This policy applies to all users of the Subdano platform, including event organizers, administrators, and subscribers interacting with forms and automated workflows. Under the General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and similar international data privacy laws, Subdano operates under two distinct legal definitions: • Data Controller: We act as a Data Controller for the account information you provide to us when registering and managing your Subdano workspace. • Data Processor: Subdano generally acts as a Data Processor for personal data submitted by organizers through the platform, where the organizer determines the purposes and means of processing. Subdano acts as an independent Data Controller for personal data it processes for its own business purposes, including account administration, security, fraud prevention, billing, service communications and other purposes described in this Privacy Policy.
2. Information We Collect
We collect data necessary to operate our SaaS platform, maintain security, and deliver automated event management services. A. Organizer Account Data (Data Controller Role) When you create an account via Google Authentication or email registration, we collect: • Full name and email address. • Profile picture and workspace preferences. • Timezone settings and localization preferences. • Reply-To email addresses used for broadcasting messages to your subscribers. • Billing details, subscription plan roles (e.g., Trial, Premium, Admin), and quota usage logs. B. End-User and Subscriber Data (Data Processor Role) When you use Subdano to host events or custom forms, we process data on your behalf, which may include: • Subscriber identities (email addresses, names, and custom identity fields). • Responses to custom form fields, dropdown selections, checkboxes, and date-pickers. • Engagement analytics, including email delivery statuses, open rates, and link clicks within automated journeys. C. Media and File Storage Data We store files uploaded to your workspace, including event logos, email template headers, downloadable attachments, and Excel sheets used for bulk data imports or list catalogs. D. AI Assistant and Usage Data To provide advanced automation tools, we collect and process: • Text prompts and queries submitted to the Subdano AI Assistant. • Audio recordings uploaded or recorded for AI audio transcription services. • System activity logs, error reports, and API integration timestamps. E. Security and Fraud Prevention Data To protect our service from abuse, automated bot attacks, and quota circumvention, we collect technical data such as IP addresses, session IDs, rate limit counters, and timestamps. This is processed under our legitimate interest (GDPR Art. 6(1)(f)) to maintain platform security and enforce our Terms of Service.
3. How We Use Your Information
We use the collected information strictly to deliver, maintain, and improve the Subdano ecosystem. Specifically, we use data to: • Authenticate users and secure workspaces against unauthorized access. • Process registration forms, manage attendee lists, and execute scheduled email journeys. • Track quota limits (such as monthly email sending limits, form counts, and AI request caps). • Generate visual chart reports and PDF summaries of event performance. • Provide technical customer support and system notifications regarding account expiration or maintenance.
4. Third-Party Providers and Sub-Processors
To operate our cloud infrastructure, we share specific encrypted data with vetted third-party sub-processors. We strictly ensure that all providers comply with GDPR and international security standards: • Cloud Infrastructure & Database: Hosting providers (e.g., AWS, Google Cloud) used to store MongoDB databases and file storage assets. • Email Delivery Gateways: Transactional email providers used to dispatch email templates and automated journey messages reliably. • AI Infrastructure: Artificial Intelligence providers (e.g., OpenAI, Anthropic) used to process chat queries and audio transcriptions. Note: Retention periods depend on the applicable AI provider, service configuration and contractual terms. Subdano uses commercially available AI services configured, where contractually and technically available, to minimize retention of customer data. Subdano does not authorize AI providers to use customer personal data for training their public or third-party models except where expressly disclosed and legally permitted.
5. Data Security and International Transfers
We implement industry-standard technical and organizational measures to safeguard your data against unauthorized access, alteration, or deletion. This includes data encryption in transit (HTTPS/TLS) and at rest, password-protected private event forms, and role-based access control. For transfers of personal data from the EEA to third countries, Subdano relies on an applicable adequacy decision or appropriate safeguards under Chapter V GDPR, such as the EU Standard Contractual Clauses. Where applicable, transfers to U.S. recipients may rely on the EU-U.S. Data Privacy Framework where the recipient is certified under the Framework.
5.1 Data Breach Notification
In our capacity as a Data Processor, if we become aware of any accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, the personal data of your end-users (a "Data Breach"), we will notify you (the Data Controller) without undue delay and, where reasonably practicable, no later than 48 hours after becoming aware of the incident. We will provide you with sufficient information to allow you to meet your regulatory obligations under GDPR Article 33, including reporting to relevant supervisory authorities. To the extent Subdano acts as a Data Processor in relation to the affected personal data, the responsibility to notify end-users and authorities remains with you as the Data Controller, subject to applicable law.
6. Your Rights Under the GDPR
If you are located in the EU/EEA, your rights are governed by the GDPR and applicable local data protection law. If you are located in the United Kingdom, your rights are governed by the UK GDPR and applicable UK data protection law. • Right of Access: You may request a complete copy of the personal data we hold about you. • Right to Rectification: You may update or correct inaccurate profile or workspace data at any time via your user settings. • Right to Erasure ("Right to be Forgotten"): You may request the complete deletion of your account, media files, and subscriber lists. • Right to Data Portability: You may export your subscriber lists, dictionary catalogs, and analytics reports in a structured, commonly used and machine-readable format, where technically applicable. • Right to Restriction of Processing: You may request to suspend the processing of your data while a dispute or correction is being resolved. • Right to Object: You may object to certain processing of your personal data where permitted by applicable law, including processing for direct marketing purposes. • Right to Lodge a Complaint: You may lodge a complaint with the competent data protection supervisory authority if you believe that your personal data has been processed unlawfully. To exercise any of these rights, please contact our privacy team at subdano.hq@gmail.com.
7. Data Retention
We retain organizer account data for as long as your workspace remains active. Inactive workspaces are deleted after 12 months of inactivity, subject to legal, security and billing retention requirements. We apply specific retention periods depending on the type of data: • Active Workspace Data: Retained as long as your account is active. • Web Sessions & Authentication: Session tokens are retained for up to 30 days unless revoked earlier. • Security & Rate Limit Logs: IP addresses and request counters used to prevent abuse are retained for a maximum of 2 hours to 30 days. Security incident logs may be kept for up to 3 years for legal protection. • Deleted Accounts / Expired Plans: Upon account deletion, all associated files, event cards, and subscriber databases are permanently and irrevocably deleted from our production servers within 30 days. • Analytics & Support Tickets: Retained for up to 24 months to improve the product, unless a ticket is required for an ongoing legal claim.
8. Children's Privacy
Subdano is a professional platform intended for users who are at least 18 years old. We do not knowingly collect personal data from children under the age of 18 as Data Controllers. If we become aware that a child has created an account and provided personal data, we will take immediate steps to delete that information.
Terms of Service
1. Acceptance of Terms and Account Responsibilities
By accessing or using Subdano, you agree to be bound by these Terms of Service and all applicable data protection laws. You must be at least 18 years old to use this platform. You are entirely responsible for maintaining the confidentiality of your login credentials (including Google Authentication access) and for all activities that occur under your workspace. You agree to provide a valid, functional Reply-To email address for all automated broadcasts to ensure that end-users can legitimately communicate with you as the event organizer.
2. Acceptable Use and Anti-Spam Policy (Zero Tolerance)
Subdano is a professional event marketing and automation platform. We enforce a strict Zero Tolerance Policy against spam, phishing, and system abuse to protect our email sender reputation and deliverability rates. By creating events, custom forms, and email journeys, you strictly agree to the following rules: • Explicit Opt-In Required: You may only send emails to subscribers who have explicitly opted in or registered for your events, forms, or catalogs. The use of purchased, scraped, or rented email lists is strictly prohibited. • Mandatory Unsubscribe Links: Every broadcast or automated email journey must include a clear, functional unsubscribe link. You are strictly forbidden from hiding, altering, or circumventing our built-in unsubscribe mechanism. • Prohibited Content: You may not use Subdano to host forms, distribute files, or send emails containing malware, phishing scams, adult content, hate speech, illegal gambling, or fraudulent financial schemes. Enforcement: Subdano reserves the right to immediately suspend or permanently terminate any account that violates our Anti-Spam Policy, generates high bounce rates, or triggers severe spam complaints, without notice and without refund.
3. Prohibited Data Collection (Sensitive Information & Payment Data)
You are strictly prohibited from using Subdano’s forms, events, or any other features to solicit, collect, store, or process any highly sensitive personal data. This includes, but is not limited to: • Protected Health Information (PHI): Any medical records or health information regulated by HIPAA or equivalent local health data laws. • Government-Issued Identifiers: Social Security Numbers (SSN), passport numbers, driver’s license numbers, national identity numbers (e.g., NIF, NIE), or similar identification data. • Financial & Payment Data: Full credit or debit card numbers, CVV/CVC codes, bank account credentials, or any data regulated by the Payment Card Industry Data Security Standard (PCI-DSS). • Security Credentials: Account passwords, security questions, or biometric data. Subdano operates exclusively as a general-purpose event and form management platform. Our infrastructure is not designed, nor certified, to be PCI-DSS or HIPAA compliant. You agree that you are solely responsible and liable for any data you choose to collect. Any violation of this provision will result in the immediate and permanent termination of your account, deletion of all associated data, and forfeiture of any fees paid, without prior notice or liability to Subdano.
4. Data Processing Terms (GDPR Compliance)
To the extent that Subdano processes personal data of your end-users (subscribers, attendees, and form respondents) on your behalf, the parties acknowledge and agree that: • Roles: You act as the Data Controller, and Subdano acts as a Data Processor. You are solely responsible for ensuring that you have a lawful basis for collecting and processing such data. • Instructions: Subdano shall process personal data only on your documented instructions (which include operating the platform, executing email journeys, and rendering automated features) and in compliance with applicable data privacy laws, including the GDPR. • Security & Sub-processors: Subdano implements appropriate technical and organizational measures to protect your data. You hereby general-authorize Subdano to engage vetted third-party sub-processors (such as cloud hosting and AI infrastructure providers) as outlined in our Privacy Policy. • Data Subject Rights & Deletion: Upon termination of your workspace, Subdano will permanently delete or anonymize your subscriber databases and form responses within the timeframes specified in our Privacy Policy, unless retention is required by applicable law.
5. Subscription Plans, Quotas, and Downgrades
Subdano provides various service tiers, including Trial, Premium, and Special roles. Each tier is governed by specific system quotas, including but not limited to: • Maximum active event forms and custom forms. • Monthly limits on emails sent to subscribers. • Limits on active journeys and automated jobs per journey. • Storage capacity for uploaded media files and dictionary catalogs. • Daily limits on AI Assistant requests and AI audio transcriptions. All payments, including subscription fees, are non-refundable unless otherwise required by mandatory consumer protection laws in your jurisdiction. We do not provide refunds or credits for any partial-month subscription periods or unused services. If your workspace exceeds these quotas, or if your access plan expires, Subdano reserves the right to throttle system performance, pause active email journeys, or restrict manual subscriber additions until the plan is upgraded or renewed.
6. Disclaimer of Warranties for AI Features
Subdano includes integrated Artificial Intelligence tools, such as the AI Assistant and automated voice-to-text audio transcriptions. These features are provided on an "as is" and "as available" basis. Subdano makes no warranties regarding the accuracy, completeness, or reliability of AI-generated text, suggestions, or audio transcriptions. You, the user, bear sole responsibility for reviewing, verifying, and validating all AI-generated content before publishing event details, configuring automated triggers, or dispatching email communications to your subscribers. All AI-generated evaluations, suggestions, or templates are generated automatically for informational purposes only. They do not constitute legal, medical, financial, or professional advice and have no legal binding effect. Subdano shall not be held liable for any decisions you make, or consequences you face, based on the outputs generated by our AI tools.
7. Intellectual Property and User Content
You retain full ownership and intellectual property rights to all text, logos, media files, and subscriber databases you upload to Subdano. By uploading content, you grant Subdano a limited, secure, and worldwide license solely to host, process, and display your data for the purpose of operating your events and executing your automated workflows. Subdano retains all title, ownership, and intellectual property rights to the platform's code, visual design, shortcode engines, chart builders, and UI components.
8. Limitation of Liability
To the maximum extent permitted by applicable law, Subdano and its affiliates, directors, and employees shall not be liable for any indirect, incidental, special, consequential, or punitive damages. This includes, without limitation, loss of profits, data loss, business interruption, or reputational damage arising from: • Your use or inability to use the platform. • Unauthorized access to or alteration of your transmissions or data. • Service disruptions caused by third-party cloud hosting or SMTP delivery failures. • Errors or omissions occurring within automated email journeys or AI-generated outputs. In no event shall Subdano's total cumulative liability exceed the amount you paid to Subdano for the subscription plan in the twelve (12) months immediately preceding the incident giving rise to the claim.
9. Indemnification
You agree to defend, indemnify, and hold harmless Subdano, its contractors, and its licensors from and against any and all claims, damages, obligations, losses, liabilities, costs, or debt, and expenses (including attorney's fees) arising from: • Your violation of any term of these Terms of Service, particularly our Anti-Spam Policy. • Your violation of any third-party right, including any copyright, property, or privacy right under the GDPR or local data protection laws. • Any claim that your events, custom forms, email journeys, or uploaded files caused damage to a third party or violated applicable international laws.
10. Modifications to Terms
We reserve the right to modify or replace these Terms of Service and our Privacy Policy at any time to reflect architectural updates, legal changes, or new platform features. If a revision is material, we will provide at least 14 days' notice via system notification or email prior to any new terms taking effect. Your continued use of Subdano after the effective date constitutes your binding acceptance of the updated terms.
11. Governing Law and Jurisdiction
These Terms of Service and any separate agreements whereby we provide you Services shall be governed by and construed in accordance with the laws of Spain, without regard to its conflict of law provisions. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded from these Terms. Any dispute, controversy, or claim arising out of, relating to, or in connection with these Terms, including any question regarding its existence, validity, or termination, shall be resolved by the competent courts of Valencia, Spain, except where applicable mandatory law provides otherwise. Nothing in these Terms limits any mandatory consumer protection or jurisdictional rights that cannot be waived under applicable law.
12. Contact Information
For any legal inquiries, report of ToS violations, or GDPR privacy requests, please contact our support and legal team: • Email: subdano.hq@gmail.com • Platform Support: Available via the in-app Help Center and Live Chat.
If you have any questions about these policies, please contact us