EU Data Protection

This page describes how Subview approaches data protection requirements for customers and users in the European Economic Area, the United Kingdom, Switzerland, and other jurisdictions with similar privacy rules.

It is intended to supplement the Privacy Policy and Terms of Service. If your organization has a signed data processing agreement with Subview, that agreement controls where it conflicts with this page.

Subview is designed for product operations and review monitoring, not for processing highly sensitive categories of personal data unless expressly agreed in writing.

For customer workspace data, Subview generally acts as a processor or service provider, and the customer acts as controller. For account administration, site analytics, security logs, billing, and business operations, Subview may act as controller.

Customers are responsible for determining the lawful basis for the data they add to Subview and for responding to requests from their own end users where they act as controller.

Subview will process customer data according to documented instructions, the product configuration, applicable law, and the agreements that govern the workspace.

Customer data may include app identifiers, app titles, country availability records, ratings, reviews, reviewer display names, review timestamps, source metadata, user account email addresses, workspace configuration, and user activity logs.

Account and operational data may include names, email addresses, authentication records, billing contacts, support messages, device information, IP addresses, and audit events.

The exact categories depend on how a customer configures Subview and which app store sources, notifications, and workflows are enabled.

Subview processes data to provide review monitoring, availability tracking, ratings analysis, digests, alerts, dashboard views, support, security, troubleshooting, billing, and product improvement.

We do not process customer data for unrelated advertising or sell customer personal data.

We may process aggregated or de-identified information to understand service reliability, improve features, and report product performance.

Subview processes customer data to provide the service, maintain security, troubleshoot issues, deliver requested communications, and comply with documented customer instructions.

Product settings, app selections, digest recipients, alert configuration, and admin actions are treated as customer instructions for routine processing.

If we believe an instruction violates applicable data protection law, we may pause processing related to that instruction and ask for clarification.

Subview may use subprocessors for hosting, storage, monitoring, analytics, email delivery, billing, support, security, and related operational needs.

We evaluate subprocessors based on the nature of the service, data processed, security posture, contractual commitments, and operational reliability.

Subview remains responsible for subprocessors as required by applicable data protection law and our agreements with customers.

Depending on location and applicable law, individuals may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data.

Where Subview processes data on behalf of a customer, we will direct requests to the relevant customer or assist the customer in responding where appropriate.

Requests may require identity verification and may be limited by legal obligations, security needs, backup retention, or the rights and freedoms of others.

Subview and its service providers may process information in countries other than where the information was collected. Where required, we use safeguards intended to support lawful transfers, such as contractual commitments and vendor due diligence.

Transfer safeguards may include standard contractual clauses, data processing agreements, technical and organizational measures, and review of relevant subprocessor practices.

Customers with specific transfer requirements should contact us before adding regulated data to Subview.

We maintain security measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures include access controls, logging, backup practices, and operational monitoring.

Access to customer data is limited to personnel and service providers who need it to operate, support, secure, or improve Subview.

Security measures are reviewed and updated over time based on product changes, risk, provider capabilities, and operational experience.

If we become aware of a security incident affecting customer personal data, we will investigate, take appropriate containment steps, and notify affected customers as required by applicable law and contractual commitments.

Customer notifications may include available details about the nature of the incident, affected data, mitigation steps, and recommended customer actions.

Customers are responsible for determining whether they must notify regulators, end users, or other parties when they act as controller.

When a customer closes a workspace or requests deletion, we will delete or return customer data according to the product functionality, contractual commitments, and legal retention requirements that apply.

Backup copies may remain for a limited period before being overwritten according to normal backup cycles.

Some information may be retained where needed for security, fraud prevention, legal compliance, financial records, dispute resolution, or enforcement of agreements.

Customers are responsible for configuring Subview in a way that matches their legal obligations, including user access, app selections, digest recipients, retention expectations, and data subject request workflows.

Customers should avoid adding unnecessary personal data to names, buckets, notes, or other configurable fields.

Customers should maintain appropriate internal policies for who can access review data, exports, alerts, and administrative settings.