Privacy Policy

This Privacy Policy explains how Subnomic ("Subnomic", "we", "us") collects, uses, discloses and safeguards information when you visit our website, create an account, or use our products and services (the "Services").

1. Information we collect

Account information

When you sign up we collect your name, work email, organization name and authentication details. If you subscribe to a paid plan, billing information is processed by our payment provider; we do not store full card numbers.

Agent telemetry

The Subnomic agent collects operational metrics from hosts you connect — CPU, memory and swap, disk usage and I/O, top processes, and per-interface network throughput — along with connection and session metadata. The agent does not read application data or file contents unless you explicitly grant access through a policy.

Session recordings

When session recording is enabled, SSH and command sessions are captured and stored as replayable recordings, tied to the user, host and RBAC policy that authorized them.

Usage & device data

We collect standard log data such as IP address, browser type, pages visited and timestamps to operate and secure the Services.

Analytics cookies on subnomic.com

subnomic.com uses Google Analytics 4 only if you choose Allow analytics in the bar shown on your first visit. Until you do, no Google script is loaded and no analytics cookie is set. If you allow it, Google Analytics sets the cookies _ga and _ga_<ID>, which last up to two years, and receives the pages you view, the sign-up and documentation links you click, your browser and device type, and an approximate location that Google derives from your IP address and does not store. Google signals and advertising features are switched off. Google LLC processes this data for us and may transfer it to the United States. Event data is kept for two months.

Your choice is stored in your browser, not in a cookie: a yes for 12 months, a no for 6, after which you are asked again. You can change it at any time with Cookie settings at the foot of every page; withdrawing stops analytics and deletes its cookies. A browser that sends Global Privacy Control is treated as having declined. The console at app.subnomic.com sets no analytics cookies.

Where you came from

When you create a workspace from a link on subnomic.com, the link carries the campaign that brought you, if there was one (utm_source, utm_medium, utm_campaign or ref), and the subnomic.com page your visit started on. We store those values with the workspace to learn which pages and campaigns lead people to sign up. They identify a campaign, not a person, are never shared with advertisers, and are deleted with the workspace.

2. How we use information

• To provide, maintain and improve the Services;
• To authenticate users and enforce RBAC policies;
• To provide audit, session replay and observability features;
• To communicate with you about your account, security and product updates;
• To detect, prevent and respond to fraud, abuse and security incidents;
• To comply with legal obligations.

3. Legal bases for processing

Where the GDPR applies, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Services, your consent (where requested), and compliance with legal obligations.

4. Sharing & sub-processors

We do not sell personal data. We share data with vetted sub-processors that help us operate the Services (for example, cloud hosting and email delivery), each bound by data protection obligations. A current list is available on our Subprocessors page.

5. Data retention

We retain account data for as long as your account is active. Metrics, session recordings and audit logs are retained according to your configured retention settings, unless a longer period is required by law.

6. Security

We use encryption in transit (TLS), least-privilege access controls, and operational safeguards designed around Zero Trust principles. See our Security page for more detail.

7. Your rights

Depending on your location, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, and to withdraw consent. Under the CCPA, California residents may request access to and deletion of personal information and may opt out of any "sale" of personal information (we do not sell personal information). To exercise these rights, contact us at privacy@subnomic.com.

8. International transfers

Where data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Children's privacy

The Services are not directed to individuals under 16, and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Services or by email, and the "Last updated" date above will be revised.

11. Contact

Questions about this policy? Email privacy@subnomic.com or see our Imprint for our legal entity details.