Privacy Policy

1. Commitment to Data Protection

SubprocessorWatch treats data protection as a fundamental technical constraint. We operate under strict GDPR (EU 2016/679) and SOC 2 CC9.2 principles. We do not sell, rent, or trade your personal or organizational data.

2. Information We Collect

• Authentication Data: Email address and authentication tokens via Supabase Auth (Magic Link or Google OAuth).
• Configuration Data: List of monitored third-party vendors and customer Slack webhook URLs designated for compliance alert routing.
• Billing Data: Transaction metadata handled exclusively by our Merchant of Record, Lemon Squeezy. We do not store raw credit card numbers.

3. How We Use Data

We use your data solely to execute scheduled cryptographic integrity checks, deliver subprocessor drift alerts to your designated channels, and authenticate access to your organization dashboard.

4. Subprocessor Disclosure for SubprocessorWatch

In accordance with GDPR Article 28, SubprocessorWatch discloses its own downstream infrastructure processors:

5. Your Rights (GDPR / CCPA)

You have the right to access, rectify, export, or delete your personal data at any time. To request complete deletion of your organization records, email support@subprocessorwatch.com.