Subscriply Privacy Policy (India)

This Privacy Policy explains how SUBSCRIPLY PLATFORMS LLP (“Subscriply”, “we”, “us”, “our”) collects, uses, shares and protects personal data. Subscriply is a limited liability partnership incorporated in India on January 9, 2026 under the Limited Liability Partnership Act, 2008 (LLPIN: ACU-1833, registered with RoC-Bangalore), with its registered office at C 003, Orchid Piccadilly, Thanisandra Main Road, Bangalore North, Bengaluru, Karnataka 560064, India.

This policy applies to:

• our website subscriply.com and its subdomains (the “Website”);
• the Subscriply dashboard, APIs, SDKs, hosted checkout and customer portal pages, and related services (the “Services”);
• people who sign up for, buy or use the Services on behalf of a business (“Merchants” or “Users”);
• prospects, partners, vendors and anyone who contacts us for sales, support or marketing.

This policy is written for India. It is prepared under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and the Information Technology Act, 2000 and the rules under it.

This policy does not cover third-party websites or apps linked from our Website, or how a Merchant handles its own customers’ data outside our Services.

We play two different roles depending on whose data it is.

• Part A — data we control: information about you as a Subscriply customer, user, website visitor or prospect.
• Part B — data we process for you (“Service Data”): everything a Merchant puts into Subscriply about its own customers, plans, invoices and usage.

If you are an End Customer of a business that uses Subscriply, that business is the Data Fiduciary for your data. Please send requests about your data (access, correction, deletion, consent) to that business. If you contact us, we will forward your request to the Merchant without undue delay and help them respond.

If you are a Merchant, you are responsible for having a lawful basis, giving notice and obtaining any consent needed before you share End Customer data with us. We do not use End Customer data for our own purposes, do not sell it, and do not use it to train AI models that serve other Merchants.

You own your Service Data. You can access it, export it, share it through integrations you enable, and ask us to delete it. Our staff access Service Data only when needed to fix an issue, provide support you request or meet a legal obligation; such access is limited to named people and is logged. We will sign a Data Processing Addendum with you on request at tech@subscriply.com.

We collect only what we need for the purposes in Section 4. You can choose not to share some data, but then we may not be able to provide certain Services.

Data you give us

• Account and contact data: name, work email, mobile number, job title, company name, password (stored hashed).
• Business details: legal entity name, GSTIN and billing address, used to issue GST-compliant invoices for your Subscriply plan.
• Billing data for your Subscriply plan: billing contact, address, GSTIN, invoices and payment history.
• Communications: support tickets, emails, chats, call recordings (with notice), demo requests, survey and feedback responses.
• Event and marketing data: details you give when you attend a webinar, event or sign up for our newsletter. Testimonials or case studies are published only after you review and approve them.

Data we collect automatically

• Device and log data: IP address, browser type, operating system, device identifiers, timestamps, referring URLs, pages viewed.
• Product usage data: features used, clicks, API calls and errors, used to run, secure and improve the Services.
• Cookies and similar technologies: see Section 7.

Data from third parties

• Payment partners (any payment gateway integrated with Subscriply): payment status, transaction references, last four digits of a card, UPI handle, mandate status.
• Integrations you connect (for example, accounting, CRM or tax tools): only the data you authorise us to sync.
• Verification and anti-abuse providers: validation of the GSTIN you enter, and signals that help us spot spam or fake sign-ups.
• Public and business sources: business details from public registries or professional networks, for sales outreach.
• Sign-in providers: if you sign in with Google, Microsoft or LinkedIn, they share your name and email with us.
• Referrals and partners: if someone refers you, or you contact one of our partners, they may share your name, email and company with us. Ask us to remove it at any time.
• Social media and review sites: if you mention or engage with Subscriply publicly, we may see that interaction and your public profile.

Data we do not want

Please do not send us sensitive data such as health information, biometric data, Aadhaar numbers or full card numbers through support channels or free-text fields. If we receive it by mistake, we will delete it.

Under the DPDP Act, we process personal data either with your consent or for a legitimate use listed in Section 7 of the Act (for example, data you voluntarily share for a stated purpose, or to comply with law). We tell you the purpose at the time we collect it, and we ask for fresh consent before using it for a new purpose.

AI features. Where the Services offer AI-assisted features (for example, insights or assistants), we process only the data needed to answer your request. These features run on the AI model provider the Merchant selects and connects (for example, Anthropic’s Claude or OpenAI). Data sent to that provider is governed by the Merchant’s agreement with it and the provider’s own privacy policy, and we send it only the data needed for the request. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Withdrawing consent. You can withdraw consent as easily as you gave it — through the unsubscribe link, Cookie Settings, or by writing to tech@subscriply.com. Withdrawal does not affect processing done before it. If you withdraw consent needed to run the Services, we may have to close your account.

Subscriply is billing software. We are not a bank, payment aggregator or payment gateway, and we do not hold, move or settle funds.

• Paying for Subscriply: your payment is handled by Subscriply’s payment gateway provider. We receive only the payment status, a transaction reference and, for cards, the network and last four digits.
• Payments your customers make to you: these are processed by whichever integrated payment gateway you connect. Money moves directly between your customer, the gateway and you. Subscriply sends billing instructions and receives payment status through the gateway’s API.
• What we never store: full card numbers, CVVs, UPI PINs, net-banking passwords or bank login credentials. These are entered on the gateway’s secure pages and tokenised by them.

The gateway’s own privacy policy applies to data you give it directly.

We do not sell or rent personal data. We share it only as follows:

• Service providers (Data Processors / sub-processors) who help us run the Services, under written contracts that limit their use to our instructions and require reasonable security safeguards. Categories: cloud hosting (Amazon Web Services, India), email and SMS delivery, customer support and CRM tools, product analytics, error monitoring and payment gateways. AI model providers are chosen and connected by each Merchant and work under that Merchant’s own agreement with them.
• Payment gateways you connect to send billing instructions and receive payment status.
• Integrations you enable, such as accounting, CRM or tax tools. Their privacy policies apply once data reaches them.
• Professional advisers — auditors, chartered accountants and lawyers — under confidentiality duties.
• Government, regulators and law enforcement, when required by law, court order or a lawful request (for example, under the IT Act, GST law or RBI directions), or to protect the rights, safety or property of Subscriply, our users or the public.
• A successor business in a merger, acquisition, restructuring or sale of assets. The successor must protect your data as this policy does, and we will notify you of the change.

We may share aggregated or de-identified data that does not identify you, for example usage trends.

We use cookies, pixels and local storage on the Website and in the dashboard.

You can change your choices any time through the Cookie Settings link in the footer, or by blocking cookies in your browser. Blocking essential cookies may break parts of the Services.

Storage. We store personal data primarily on Amazon Web Services (AWS) servers in India.

Transfers outside India. Some service providers (for example, email delivery, analytics or AI model providers) may process data outside India. We transfer data only to countries not restricted by the Central Government under the DPDP Act, and under contracts that require equivalent protection. Card and payment-instrument data stays with the payment gateways, not with us.

Retention. We keep personal data only as long as the purpose needs it or the law requires, then delete or anonymise it.

Where we erase data because an account has been inactive, we will notify you at least 48 hours before erasure, so you can log in or ask us to keep it.

We take reasonable security safeguards to protect personal data, including:

• encryption in transit (TLS 1.2+) and at rest;
• role-based access, least-privilege permissions and multi-factor authentication for staff;
• logging and monitoring of access to personal data;
• regular vulnerability testing and security reviews (industry security certification is in progress);
• confidentiality obligations for employees, contractors and processors.

No system is completely secure. Please keep your password safe and tell us at tech@subscriply.com if you suspect unauthorised access.

If a breach happens, we will inform affected individuals without delay, in plain language, explaining what happened, the likely impact, what we are doing and what you can do. We will report it to the Data Protection Board of India (an initial intimation without delay and a detailed report within 72 hours) and to CERT-In within 6 hours of noticing a reportable incident. Where we act as a Data Processor, we will notify the affected Merchant promptly so they can meet their own obligations.

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you, what we do with it, and who we have shared it with.
• Correct, complete or update inaccurate or incomplete data. Many details can be edited directly in Account Settings.
• Erase data that is no longer needed, unless the law requires us to keep it (for example, tax records).
• Withdraw consent at any time, as described in Section 4.
• Nominate another person to exercise your rights if you die or become unable to do so.
• Grievance redressal — raise a complaint with us, and escalate to the Data Protection Board of India if you are not satisfied.

How to make a request: email tech@subscriply.com. We may ask you to verify your identity before acting. We will respond as soon as possible and in any case within 90 days. We do not charge for reasonable requests.

When using these rights, please give accurate information and do not file false or frivolous complaints, as required of Data Principals under Section 15 of the DPDP Act.

End Customers of a Merchant should send requests to that Merchant (see Section 2).

The Services are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data of children, and we do not track, profile or target advertising at children. If you believe a child has given us personal data, write to tech@subscriply.com and we will delete it.

Merchants whose End Customers may include children are responsible for obtaining verifiable parental consent as required by the DPDP Act before sharing such data with us.

If you have a question, request or complaint about your personal data or this policy, contact our Grievance Officer, appointed under the IT Act, 2000 and its rules, who also handles questions under the DPDP Act:

Designation

Grievance Officer, Subscriply Platforms LLP

Email

tech@subscriply.com

Address

C 003, Orchid Piccadilly, Thanisandra Main Road, Bangalore North, Bengaluru, Karnataka 560064, India

Hours

Monday to Friday, 10:00 AM to 6:00 PM IST, excluding public holidays

We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days, and in any case within 90 days. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

• Integrations and marketplace apps. When you enable an integration, the third party may access your Service Data. Review their privacy policy before you connect.
• Links and social widgets. Our Website may link to other sites or include social media buttons. Those are governed by their own privacy policies.
• Community and public posts. Anything you post in public forums, reviews or comments may be seen by others. Ask us to remove your posts at tech@subscriply.com.
• Do Not Track. There is no common standard for browser Do Not Track signals yet, so we do not respond to them. Use our cookie settings instead.
• Business transfers. If Subscriply is merged or acquired, the new owner must honour this policy, and we will tell you by email or a notice in the dashboard.

We may update this policy to reflect changes in our practices, Services or the law. The “Last updated” date at the top shows the latest version. For material changes, we will notify you by email or a prominent notice in the dashboard at least 30 days before they take effect, and ask for fresh consent where the law requires.

This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka.