Privacy Policy

This Privacy Policy explains how Subnomic ("Subnomic", "we", "us") collects, uses, discloses and safeguards information when you visit our website, create an account, or use our products and services (the "Services").

Subnomic, based in Türkiye, is the data controller for the personal data described in this policy: data about the people who visit subnomic.com and who hold accounts. For personal data that a customer puts into its own workspace, such as site files, stored objects, container images or recordings of its own systems, the customer is the controller and Subnomic processes that data on its behalf, as set out in the Data Processing Agreement.

1. Information we collect

Account information

When you sign up we collect your name, work email, organization name and authentication details. If you subscribe to a paid plan, billing information is processed by our payment provider; we do not store full card numbers.

Agent telemetry

The Subnomic agent collects operational metrics from hosts you connect — CPU, memory and swap, disk usage and I/O, top processes, and per-interface network throughput — along with connection and session metadata. The agent does not read application data or file contents unless you explicitly grant access through a policy.

Session recordings

When session recording is enabled, SSH and command sessions are captured and stored as replayable recordings, tied to the user, host and RBAC policy that authorized them.

Usage & device data

We collect standard log data such as IP address, browser type, pages visited and timestamps to operate and secure the Services.

Analytics cookies on subnomic.com

subnomic.com uses Google Analytics 4 only if you choose Allow analytics in the bar shown on your first visit. Until you do, no Google script is loaded and no analytics cookie is set. If you allow it, Google Analytics sets the cookies _ga and _ga_<ID>, which last up to two years, and receives the pages you view, the sign-up and documentation links you click, your browser and device type, and an approximate location that Google derives from your IP address and does not store. Google signals and advertising features are switched off. Google LLC processes this data for us and may transfer it to the United States. Event data is kept for two months.

Your choice is stored in your browser, not in a cookie: a yes for 12 months, a no for 6, after which you are asked again. You can change it at any time with Cookie settings at the foot of every page; withdrawing stops analytics and deletes its cookies. A browser that sends Global Privacy Control is treated as having declined. The console at app.subnomic.com sets no analytics cookies. Its traffic is counted by Cloudflare Web Analytics, which uses no cookie and does not identify you.

Runa and AI providers

When you ask Runa something, the AI provider receives your question and the conversation so far, facts about anything you mentioned, files you attached, and the results of the tools Runa called during that turn. With the platform’s own models that provider is Anthropic or OpenAI; a workspace that sets its own key sends to its own provider instead. If Runa’s web search is switched on, search queries go through our own relay to public search engines. AI features are used only when you use them.

Where you came from

When you create a workspace from a link on subnomic.com, the link carries the campaign that brought you, if there was one (utm_source, utm_medium, utm_campaign or ref), and the subnomic.com page your visit started on. We store those values with the workspace to learn which pages and campaigns lead people to sign up. They identify a campaign, not a person, are never shared with advertisers, and are deleted with the workspace.

2. How we use information

• To provide, maintain and improve the Services;
• To authenticate users and enforce RBAC policies;
• To provide audit, session replay and observability features;
• To communicate with you about your account, security and product updates;
• To detect, prevent and respond to fraud, abuse and security incidents;
• To comply with legal obligations.

3. Legal bases for processing

Where the GDPR or Türkiye’s Personal Data Protection Law No. 6698 (KVKK) applies, we process personal data because it is necessary to perform our contract with you, for our legitimate interest in operating and securing the Services, with your consent where we ask for it (analytics cookies on subnomic.com), and to comply with legal obligations.

4. Sharing & sub-processors

We do not sell personal data. We share it only with the sub-processors that help us run the Services: DigitalOcean (servers), Cloudflare (network, subnomic.com, cookieless console analytics), Resend (email), Anthropic and OpenAI (Runa, on the platform’s models), Google (analytics on subnomic.com after consent, and mobile notifications), Apple (iOS notifications) and, once paid plans open, Tapsilat (card payments). What each one receives, and where, is on the Subprocessors page. We may also disclose data where the law requires it.

5. Data retention

Account data is kept while your account exists. Deleting your account removes your name, email address and username and destroys your credentials; the anonymised record stays so that the workspace’s audit trail keeps making sense. A workspace’s activity log, metrics and session records are kept for the life of the workspace. Recorded session content is kept until the workspace’s own recording-retention setting removes it, which by default it does not. Deleting a workspace closes it and queues its stored objects for deletion; to have everything that remains erased, write to hello@subnomic.com. Analytics event data on subnomic.com is kept for two months.

6. Security

We use encryption in transit (TLS), least-privilege access controls, and operational safeguards designed around Zero Trust principles. See our Security page for more detail.

7. Your rights

Depending on your location, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, and to withdraw consent. Under the CCPA, California residents may request access to and deletion of personal information and may opt out of any "sale" of personal information (we do not sell personal information). To exercise these rights, contact us at hello@subnomic.com.

Under Article 11 of the KVKK you may also ask whether your personal data is processed and for what purpose, learn the third parties it is transferred to in Türkiye or abroad, ask for it to be corrected or erased and for those third parties to be told, object to a result reached solely by automated analysis that is to your detriment, and claim compensation for damage caused by unlawful processing. Write to hello@subnomic.com; we answer within 30 days.

8. International transfers

Several of our sub-processors are United States companies (DigitalOcean, Cloudflare, Resend, Anthropic, OpenAI, Google and Apple), so personal data may be processed outside Türkiye and the European Economic Area. Where the GDPR or the KVKK requires a transfer mechanism for this, we rely on the one the law provides, such as standard contractual clauses.

9. Children's privacy

The Services are not directed to individuals under 16, and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Services or by email, and the "Last updated" date above will be revised.

11. Contact

Questions about this policy? Email hello@subnomic.com or see our Imprint for how to reach us.