Privacy Policy

Who We Are and What This Privacy Policy Covers

We refer to Envigo Innovations, LLC as "Subscriby" or "we" throughout this Privacy Policy.

Subscriby is a subscription platform for paid communities. A creator connects the places where their members gather (Telegram and Discord today, with more connectors on the way), sets up plans, and Subscriby takes care of access: members who are paid up get in, and the door closes when they are not.

This policy explains what personal data we handle when you use:

• Our website (https://www.subscriby.net, https://app.subscriby.net, https://my.subscriby.net);
• Our own bots and accounts on connected platforms (such as our Telegram bot);
• Other users' projects, including the bots and connected accounts they run through our Services.

In this policy, "Services" means all of the above together: the website, the dashboard, the portals, and the bots and connected accounts we run.

A product of ours that carries its own privacy policy is covered by that policy, not this one.

For your Subscriby account and your use of our website and dashboard, Subscriby is the controller. For the personal data of the members of a creator's community, the creator is the controller and Subscriby processes it on their instructions; the Terms for Members and the Data Processing Agreement on the Compliance page describe that relationship.

Information We Collect

We collect personal data only where we have a reason to: to run the Services, to talk to you, or to make the Services better. Here is what that means in practice.

Information You Provide to Us

What you give us depends on what you use. Typically it is:

• Account details: Your name, your email address, your password (stored hashed, so nobody at Subscriby can read it), your country and time zone, and the two-factor and passkey credentials you choose to set up.
• Projects and content: The name, description, image and settings of each project you create, the plans you sell, and anything you publish through your projects. Whatever you put on a public portal is visible to anyone who opens it.
• Connector credentials: The credentials a connector needs to run your project, such as a bot API token for Telegram, and the settings of each connector you install. They are stored encrypted.
• Payment account links: When you connect a payment provider, the keys or account identifiers that provider gives us so your members can pay you. They are stored encrypted.
• Messages to us: What you write to our support team through the live chat on our website, by email, in a survey or in a feedback request.
• Partner Program details: If you apply to the Partner Program, your application (who you are, where your audience lives and how large it is, what you commit to), how you want to be paid (a PayPal email, a wallet address or a bank account, stored encrypted), the legal name a payment is made out to, your country of tax residence and your tax declaration, the proof you submit of your promotion, and the referrals your link and code bring.
• Cancellation feedback: If you cancel a membership on a creator's portal or in their bot, the reason you pick from the list and anything you write with it are stored with that membership and shown to the creator, together with the offer you were shown and whether you took it. The question is the creator's to ask, and you may skip it.
• Follow-up messages: If you talk to a creator's bot or sign in to their portal without buying, start a checkout, or hold a trial without a card, the creator's project may send you a short series of follow-up messages where you already talk to it, and by email about a checkout you started or a trial about to end when no account can be reached. Every message carries a way to stop them, and your portal account has a switch. A checkout you start is recorded with the plan, the payment method and when it started, stalled and completed, and shown to the creator.

Information We Collect Automatically

Some data arrives on its own whenever you use the Services:

• Log data: What browsers and servers routinely pass along: your IP address, browser type and version, operating system, language, the page that referred you, the date and time of each request, and identifiers of the device you use.
• Usage data: What you and your members do in the Services: the projects you open, the plans you edit, the members you manage, the purchases a member makes, the messages a bot exchanges with a member, and the errors that happen along the way. This is what the dashboards, the activity timeline and the support inbox are built from.
• Cookies and similar technologies: Small files our site stores in your browser so you stay signed in, so your language and consent choices are remembered, and, only if you accept them, so analytics and advertising measurement can tell one visit from another. The Cookies Policy lists each cookie, its purpose and its lifetime.

Information We Collect from Other Sources

Some data comes from the services you connect or sign in with:

• Connected accounts: When you open one of our bots, link an account on a connected platform, or sign in through one (such as the Telegram login widget), the platform tells us your user ID there and may add your name, username and language.
• Payment providers: When you connect a payment provider, we receive what its authorization flow sends: an account identifier, API keys, and later the reference and outcome of each payment it processes for you.
• Social sign-in: A creator who signs in to the dashboard with Google, Facebook, Apple, Microsoft, LinkedIn, X or Reddit, or a member who signs in to a creator's portal with Google, gives us the identifier, name and email address the provider shares, and on the portal the profile picture, so we can recognize them on their next visit.

Information We Do Not Collect

• Payment card data: Subscriby never sees or stores card numbers. Payments go to the payment providers you or a creator chose, and they keep the card data under their own policies; we hold a reference to each payment and its outcome.
• Special categories: We do not ask for, and do not knowingly process, data about your health, religion, politics, trade-union membership, sexual life, ethnic origin, genetics or biometrics. If a legal order ever required it, we would process only what the order covers.

How And Why We Use Information

We use the data above for these purposes:

• to run the Services: create and secure your account, host your projects, back them up, grant and revoke your members' access, and bill you for paid plans;
• to improve them: understand which features are used and where people get stuck, and build what helps creators run their communities;
• to keep them safe: detect fraud, abuse and spam, protect accounts, and defend our rights and those of others;
• to measure our advertising: learn which campaigns bring creators who stay, only from visitors who accepted the measurement cookies;
• to talk to you: service messages about your account, your billing, your connectors and your members, and marketing email only if you asked for it;
• to run Subscriby Copilot: answer a creator's questions about their own projects, carry out the work they ask for within their own permissions, suggest replies in their support inbox and, where a creator switches it on, answer their members from what the creator wrote down for it;
• to help you: answer your support requests and the questions from your members that reach us.

The legal bases we rely on

Where the GDPR or the UK GDPR applies, each use of your information rests on one of these bases:

• Performing our contract with you: creating and securing your account, running your projects and memberships, taking and recording payments, and answering your support requests;
• Our legitimate interests: keeping the Services secure, preventing fraud and abuse, monitoring errors, understanding how the Services are used so we can improve them, and establishing or defending legal claims;
• Your consent: analytics and targeting cookies, and marketing email, each of which you can withdraw at any time;
• Our legal obligations: keeping the tax and accounting records the law requires and answering lawful requests from authorities.

Sharing Information

We do not sell personal data. We pass it on only in these cases, each with safeguards:

• People who work for us: Contractors who help us build or run the Services see data only when their work needs it, and are bound by this policy.
• Service providers: Companies that host, deliver or protect the Services on our behalf, each under a data processing agreement; the Third Parties section below names them.
• Payment providers chosen by creators: When you buy from a creator, the payment provider they chose (Stripe, PayPal, Polar, Mollie, Kelviq, Skrill, CoinPayments, Paystack, Razorpay, CeyPay or a connected platform's own currency) receives your payment details under its own terms; we receive a reference to the payment and its outcome, never a full card number.
• Connected platforms: Connected platforms such as Telegram are independent services. What they collect when you use them is governed by their own policies, not by this one.
• The partner who referred you: If you created your creator account through a partner's link or code, that partner sees your display name, the day you signed up, whether your referral converted and the commission it earns them; never your email address, your payment details or what you sell.
• The model provider behind Subscriby Copilot: When a creator or a member uses Subscriby Copilot, the question, the data needed to answer it and the answer pass to Anthropic, which runs the model, under a data processing agreement with zero data retention: nothing is kept after the answer and nothing is used to train a model. Threads are kept on Subscriby for ninety days and then deleted.
• Voice in Subscriby Copilot: When a creator taps the microphone in the Copilot's composer or has an answer read aloud, the recording or the answer's words pass to Cloudflare, whose Workers AI turns one into text and the other into a voice and keeps neither; an answer in a language that voice does not speak is read by the creator's own browser and leaves their device for nothing.
• Legal requirements: Authorities, when a subpoena, court order or other lawful demand requires it, and only to the extent it requires.
• Protecting rights and safety: Where we believe in good faith that disclosure is necessary to protect the rights, property or safety of Subscriby, our users or the public.
• A change of ownership: If Subscriby is sold, merges or goes out of business, user data would pass to the new owner, who could use it only as this policy allows.
• At your request: Whenever you ask us to share something, or authorize a third party to receive it.
• Aggregated figures: Statistics that cannot identify anyone, such as how many communities run on Subscriby.

How Long We Keep Information

We keep your account data for as long as you have an account. When you ask us to delete it, we schedule the deletion seven days out and email you an export of everything it holds; on that day your projects, your members' memberships and their payment history are deleted, and we keep only what tax, accounting or law-enforcement obligations require, for as long as they require it.

Some records expire on their own:

• webhook delivery logs after 90 days;
• inbound connector event keys after 7 days;
• database backups within 14 days;
• browser sessions after two hours of inactivity, and portal sign-in links within minutes;
• error reports and session replays at Sentry after 90 days.

Security

No online service can promise perfect security, but we take it seriously: traffic is encrypted in transit, secrets and connector credentials are encrypted at rest, passwords are hashed, access to production is limited and logged, and we watch for vulnerabilities and attacks. Turn on two-factor authentication or a passkey for your account, and keep the accounts you link to it secure as well.

Choices

You decide much of what we hold:

• What you give us: Optional fields stay optional. Some features need certain data to work (a payment provider cannot be connected without its keys), and those features stay off until you provide it.
• Marketing Email: We send marketing email only if you asked for it, at sign-up or in Settings → Notifications, and every such message carries an unsubscribe link. Service messages about your account, your billing and your connectors continue for as long as you have an account.
• Cookies: The consent notice on our site lets you accept or refuse analytics and targeting cookies, and change your mind later through the cookie preferences link in the footer. Your browser can also block or delete cookies, at the cost of some features. We honour your browser's Global Privacy Control signal: when it is on, analytics and targeting cookies stay off and nothing about your visit is reported to Meta or Google, whatever you chose earlier.
• Close Your Account: You can delete your account from Settings → Profile. The deletion runs seven days after you confirm; in the meantime we email you an export of everything your account holds, and signing in before the day lets you keep the account. On the day, your projects, your members' memberships and their payment history are deleted, and we keep only what the law requires us to keep, for as long as it requires it.

Your Rights

Depending on where you live, and in every case where the GDPR or the UK GDPR applies, you can:

• see the personal data we hold about you, learn what we do with it and why, and get a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, which also closes your account;
• have us pause processing while a dispute about accuracy or lawfulness is settled;
• object to processing that rests on our legitimate interests, which we then stop unless a compelling ground outweighs your objection;
• receive the data you gave us in a machine-readable format, or have it sent to another provider where that is technically possible;
• not be subject to a decision based solely on automated processing that affects you significantly; we make none today;
• complain to the data protection authority of your country.

Before we process any request, we may ask you for certain information in order to verify your identity. Where permitted by local law, we may reject requests that are unreasonable or impractical. We answer within one month, extended where the law allows for complex requests, and within 45 days for requests made under California law.

Write to support@subscriby.net to exercise any of these rights. If you are a member of a creator's community, send requests about the data the creator controls to the creator; we help them answer.

Transferring Information

Our servers are in the United States (Amazon Web Services, N. Virginia). When we move personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where it applies, and on each vendor's data processing agreement.

Questions about this policy or about your data go to support@subscriby.net.

Advertising Measurement and Analytics

When you accept targeting cookies on our marketing site, Meta Platforms, Inc. sets the _fbp and _fbc cookies there so we can measure which of our advertisements on Facebook and Instagram brought you to Subscriby. If you then register, start the trial of a paid plan or pay for one, our servers tell Meta that this happened, carrying your email address as a one-way hash, the two cookie values, your IP address and your browser's user agent, and nothing else about your account. When you accept analytics cookies, the same three moments are reported to Google Analytics, quoting the client and session identifiers its cookies gave your browser and your account's internal identifier, so the visit and the account it became are counted together. Nothing is sent to either company about a visitor who did not accept the matching cookies, and you can withdraw a choice at any time through the cookie preferences link in our footer or, for Meta, in your Meta advertising settings.

Third Parties

We rely on these services. Each has a privacy policy of its own that governs what it does with data:

• Subscriby uses Amazon Web Services (AWS): Please refer to AWS Privacy Policy.
• Subscriby uses Stripe: Please refer to Stripe Privacy Policy.
• Subscriby uses Google (Analytics, and sign-in for members): Please refer to Google Privacy Policy.
• Subscriby uses Meta Pixel and the Meta Conversions API: Please refer to Meta Privacy Policy.
• Subscriby uses Sentry: Please refer to Sentry Privacy Policy. Errors on the dashboard are reported with your IP address and your account identity, and a sample of dashboard sessions (one in ten, and every session in which an error happened) is recorded as a replay with text masked and media blocked, so we can see what went wrong.
• Subscriby uses Cloudflare: Please refer to Cloudflare Privacy Policy.
• Subscriby uses Anthropic (the model behind Subscriby Copilot): Please refer to Anthropic Privacy Policy. Requests are sent under a zero-data-retention agreement and are never used to train a model.
• Subscriby uses Telegram: Please refer to Telegram Privacy Policy. It is an independent platform under its own terms, not our sub-processor.
• Subscriby uses Featurebase: Please refer to Featurebase Privacy Policy.

Anything else you connect to your project, such as a tool reached through our API or a Zapier or n8n workflow, receives data under its own terms; check them before you connect it.

Members of Creators' Communities

We also process information about the members, visitors and customers of our users' projects on behalf of our users: the creator is the controller of that data and Subscriby is their processor, acting on their instructions through the product under the Data Processing Agreement described on the Compliance page. The Terms for Members explain what Subscriby holds about a member and how a member exercises their rights. We encourage every creator to publish a privacy policy that accurately describes their own practices.

Children

The Services are for people aged 16 and over. We do not knowingly collect personal data from anyone younger, and if we learn that we have, we delete it. A creator who sells to a younger audience is responsible for the consents the law requires of them.