.svg){kind=logo}
Legal
This policy explains how Subflare OÜ handles personal data when you visit subflare.ai, talk to us, or use our platform. We have tried to write it in plain language and to describe what our systems actually do.
Subflare OÜ ("Subflare", "we", "us") is an Estonian company that provides behavioral analytics and AI-based intent scoring for B2B sales teams.
Subflare OÜ, registry code 17370853
Sepapaja 6, Lasnamäe, 15551 Tallinn, Harju County, Estonia
Privacy contact: privacy@subflare.ai
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy rules as applied in Estonia, and Estonian data protection law. Our data protection lead handles all privacy questions and requests sent to privacy@subflare.ai.
Depending on the situation, we act in one of two roles:
We use our own Subflare tracker on subflare.ai, and Google Analytics 4 once you have given consent.
Before you make a cookie choice, or if you decline, the Subflare tracker collects:
This information is stored against the random session ID. It does not include your IP address and is not linked to a name or email unless you submit a form.
After you accept analytics cookies, the tracker also:
tracker_user_id) in your browser's local storage so it can recognise return visitsIf you decline consent and then submit a form, only the form submission events from that session are sent for scoring.
Like any website or online service, our servers receive technical data with each request. Our load balancer and server logs may include your IP address, the time of the request and the address requested. We keep these logs for 90 days for security, abuse prevention and troubleshooting, and do not use them for analytics or profiling.
Until November 2026 we use Apollo.io, a business contact database, to find and enrich business contact information (name, business email, job title, employer and professional profile) for our own sales outreach. We do not upload our own contact lists to Apollo. We will stop using Apollo in November 2026.
We do not intentionally collect special categories of personal data, such as health data, political opinions or biometric data.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the platform and managing customer accounts | Contract, Art. 6(1)(b) |
| Billing and accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Answering demo requests, enquiries and support questions | Steps before a contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Scoring enquiries submitted through forms on subflare.ai so our team can prioritise follow-up | Legitimate interest, Art. 6(1)(f) |
| Pseudonymous session analytics on subflare.ai before a cookie choice (described in Section 3) | Legitimate interest, Art. 6(1)(f) |
| Recognising return visits and Google Analytics 4 | Consent, Art. 6(1)(a) |
| B2B sales outreach to business contacts | Legitimate interest, Art. 6(1)(f), plus the ePrivacy rules on direct marketing |
| Newsletters and marketing you have opted into | Consent, Art. 6(1)(a) |
| Product updates to existing customers | Contract or legitimate interest, Art. 6(1)(b)/(f) |
| Security, abuse prevention and server logs | Legitimate interest, Art. 6(1)(f) |
| Meeting legal and regulatory obligations | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interest, we have weighed our interest against your rights and expectations. You can ask us for details of that assessment and you can object at any time (see Section 12).
When a business uses Subflare, it adds our tracker to its own website. In that case the business is the controller and Subflare is its processor. We only process the data on the business's documented instructions and under a DPA.
The tracker works the same way as on subflare.ai (see Section 3): limited, pseudonymous session data before a consent choice, a persistent visitor ID and device details only after consent, and form submissions with sensitive fields masked. The customer is responsible for showing a consent banner, collecting consent and telling its visitors about Subflare in its own privacy policy.
If you visited a website that uses Subflare and want to access or delete your data, please contact that business first. If you contact us directly, we will pass your request to the right customer and help them answer it.
Subflare analyses how visitors interact with a website to estimate how likely they are to buy. This is profiling under the GDPR, because it can relate to identifiable people, for example once someone submits a form.
You can object to profiling based on legitimate interest at any time (see Section 12).
We do not sell, rent or trade personal data. We share it only with service providers that help us run Subflare, and only for the purposes in this policy. Each one is bound by a data processing agreement.
Our current providers are Amazon Web Services (hosting), OpenAI (AI scoring), Stripe (payments), Close (CRM), Apollo.io (contact enrichment and email sequences, until November 2026), Zapier (connecting our dashboard to our CRM), Slack (internal team notifications), Webflow (website hosting) and Google Analytics 4 (website analytics, after consent).
The full list, with each provider's purpose, location and transfer safeguard, is kept up to date at subflare.ai/legal/sub-processors. That page is the authoritative source.
We may also share data with professional advisers (legal, accounting, audit) where needed, and with authorities where the law requires it.
We store our platform data in the EU, in the Amazon Web Services Frankfurt region (eu-central-1), including backups and logs. Our tracker script is delivered through AWS's global content delivery network, which does not store your data.
Some providers process data in the United States, including OpenAI for AI scoring and our sales, CRM and analytics tools. For transfers outside the EEA we rely on:
The safeguard used for each provider is shown on the sub-processors page. You can request a copy by emailing privacy@subflare.ai.
| Data | How long |
|---|---|
| Raw behavioral events (page views, clicks, engagement) | 12 months from collection, then deleted automatically |
| Leads, form submissions and AI scores in the platform | Until the customer deletes them, or until the end of the customer's contract (see Terms of Service, Section 5.6) |
| Server and security logs (may include IP address) | 90 days |
| Backups | Database backups 7 days, event store backups 35 days. Deleted data disappears from backups within 35 days |
| Data sent to OpenAI for scoring | Under OpenAI's standard API terms, requests may be kept for up to 30 days for abuse monitoring |
| Customer account data | For the length of the contract, plus a limited period afterwards for legal, accounting and legitimate business purposes |
| Billing and accounting records | As required by Estonian accounting law (currently 7 years) |
| Sales prospects and enquiries | As long as relevant to a possible business relationship. Inactive records are periodically reviewed for deletion |
| Marketing consent records | Until you withdraw consent, plus the time needed to prove it was given |
| Google Analytics 4 data | Up to 14 months |
When we no longer need data, we delete it or make it irreversibly anonymous.
We protect personal data with technical and organisational measures that fit the risk, including:
No system is completely secure. If a breach affects your data, we will handle it as the GDPR requires, including notifying the supervisory authority and you where needed.
We use cookies and browser storage on subflare.ai, managed through our consent banner (CookieYes). Analytics cookies and the Subflare visitor ID are only set after you consent. Our Cookie Policy lists each one with its purpose and duration. You can change your choice at any time through the cookie banner.
Under the GDPR you have the right to:
Email privacy@subflare.ai to use any of these rights. We reply within one month, which can be extended in some cases. We may ask you to confirm your identity.
If we have never linked your visits to a name or email, we may not be able to find your data. If you accepted cookies, the visitor ID in your browser can help us find it, and clearing your browser storage removes it from your device.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority where you live or work.
Subflare is a business service and is not aimed at anyone under 16. We do not knowingly collect children's data. If we learn that we have, we will delete it.
We update this policy when our practices, providers or the law change. We change the "Last updated" date each time, and we tell customers about material changes by email or in the product.
This policy should be read together with our Cookie Policy, Terms of Service and sub-processors list.
Legal
This policy explains how Subflare OÜ handles personal data when you visit subflare.ai, talk to us, or use our platform. We have tried to write it in plain language and to describe what our systems actually do.
Subflare OÜ ("Subflare", "we", "us") is an Estonian company that provides behavioral analytics and AI-based intent scoring for B2B sales teams.
Subflare OÜ, registry code 17370853
Sepapaja 6, Lasnamäe, 15551 Tallinn, Harju County, Estonia
Privacy contact: privacy@subflare.ai
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy rules as applied in Estonia, and Estonian data protection law. Our data protection lead handles all privacy questions and requests sent to privacy@subflare.ai.
Depending on the situation, we act in one of two roles:
We use our own Subflare tracker on subflare.ai, and Google Analytics 4 once you have given consent.
Before you make a cookie choice, or if you decline, the Subflare tracker collects:
This information is stored against the random session ID. It does not include your IP address and is not linked to a name or email unless you submit a form.
After you accept analytics cookies, the tracker also:
tracker_user_id) in your browser's local storage so it can recognise return visitsIf you decline consent and then submit a form, only the form submission events from that session are sent for scoring.
Like any website or online service, our servers receive technical data with each request. Our load balancer and server logs may include your IP address, the time of the request and the address requested. We keep these logs for 90 days for security, abuse prevention and troubleshooting, and do not use them for analytics or profiling.
Until November 2026 we use Apollo.io, a business contact database, to find and enrich business contact information (name, business email, job title, employer and professional profile) for our own sales outreach. We do not upload our own contact lists to Apollo. We will stop using Apollo in November 2026.
We do not intentionally collect special categories of personal data, such as health data, political opinions or biometric data.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the platform and managing customer accounts | Contract, Art. 6(1)(b) |
| Billing and accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Answering demo requests, enquiries and support questions | Steps before a contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Scoring enquiries submitted through forms on subflare.ai so our team can prioritise follow-up | Legitimate interest, Art. 6(1)(f) |
| Pseudonymous session analytics on subflare.ai before a cookie choice (described in Section 3) | Legitimate interest, Art. 6(1)(f) |
| Recognising return visits and Google Analytics 4 | Consent, Art. 6(1)(a) |
| B2B sales outreach to business contacts | Legitimate interest, Art. 6(1)(f), plus the ePrivacy rules on direct marketing |
| Newsletters and marketing you have opted into | Consent, Art. 6(1)(a) |
| Product updates to existing customers | Contract or legitimate interest, Art. 6(1)(b)/(f) |
| Security, abuse prevention and server logs | Legitimate interest, Art. 6(1)(f) |
| Meeting legal and regulatory obligations | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interest, we have weighed our interest against your rights and expectations. You can ask us for details of that assessment and you can object at any time (see Section 12).
When a business uses Subflare, it adds our tracker to its own website. In that case the business is the controller and Subflare is its processor. We only process the data on the business's documented instructions and under a DPA.
The tracker works the same way as on subflare.ai (see Section 3): limited, pseudonymous session data before a consent choice, a persistent visitor ID and device details only after consent, and form submissions with sensitive fields masked. The customer is responsible for showing a consent banner, collecting consent and telling its visitors about Subflare in its own privacy policy.
If you visited a website that uses Subflare and want to access or delete your data, please contact that business first. If you contact us directly, we will pass your request to the right customer and help them answer it.
Subflare analyses how visitors interact with a website to estimate how likely they are to buy. This is profiling under the GDPR, because it can relate to identifiable people, for example once someone submits a form.
You can object to profiling based on legitimate interest at any time (see Section 12).
We do not sell, rent or trade personal data. We share it only with service providers that help us run Subflare, and only for the purposes in this policy. Each one is bound by a data processing agreement.
Our current providers are Amazon Web Services (hosting), OpenAI (AI scoring), Stripe (payments), Close (CRM), Apollo.io (contact enrichment and email sequences, until November 2026), Zapier (connecting our dashboard to our CRM), Slack (internal team notifications), Webflow (website hosting) and Google Analytics 4 (website analytics, after consent).
The full list, with each provider's purpose, location and transfer safeguard, is kept up to date at subflare.ai/legal/sub-processors. That page is the authoritative source.
We may also share data with professional advisers (legal, accounting, audit) where needed, and with authorities where the law requires it.
We store our platform data in the EU, in the Amazon Web Services Frankfurt region (eu-central-1), including backups and logs. Our tracker script is delivered through AWS's global content delivery network, which does not store your data.
Some providers process data in the United States, including OpenAI for AI scoring and our sales, CRM and analytics tools. For transfers outside the EEA we rely on:
The safeguard used for each provider is shown on the sub-processors page. You can request a copy by emailing privacy@subflare.ai.
| Data | How long |
|---|---|
| Raw behavioral events (page views, clicks, engagement) | 12 months from collection, then deleted automatically |
| Leads, form submissions and AI scores in the platform | Until the customer deletes them, or until the end of the customer's contract (see Terms of Service, Section 5.6) |
| Server and security logs (may include IP address) | 90 days |
| Backups | Database backups 7 days, event store backups 35 days. Deleted data disappears from backups within 35 days |
| Data sent to OpenAI for scoring | Under OpenAI's standard API terms, requests may be kept for up to 30 days for abuse monitoring |
| Customer account data | For the length of the contract, plus a limited period afterwards for legal, accounting and legitimate business purposes |
| Billing and accounting records | As required by Estonian accounting law (currently 7 years) |
| Sales prospects and enquiries | As long as relevant to a possible business relationship. Inactive records are periodically reviewed for deletion |
| Marketing consent records | Until you withdraw consent, plus the time needed to prove it was given |
| Google Analytics 4 data | Up to 14 months |
When we no longer need data, we delete it or make it irreversibly anonymous.
We protect personal data with technical and organisational measures that fit the risk, including:
No system is completely secure. If a breach affects your data, we will handle it as the GDPR requires, including notifying the supervisory authority and you where needed.
We use cookies and browser storage on subflare.ai, managed through our consent banner (CookieYes). Analytics cookies and the Subflare visitor ID are only set after you consent. Our Cookie Policy lists each one with its purpose and duration. You can change your choice at any time through the cookie banner.
Under the GDPR you have the right to:
Email privacy@subflare.ai to use any of these rights. We reply within one month, which can be extended in some cases. We may ask you to confirm your identity.
If we have never linked your visits to a name or email, we may not be able to find your data. If you accepted cookies, the visitor ID in your browser can help us find it, and clearing your browser storage removes it from your device.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority where you live or work.
Subflare is a business service and is not aimed at anyone under 16. We do not knowingly collect children's data. If we learn that we have, we will delete it.
We update this policy when our practices, providers or the law change. We change the "Last updated" date each time, and we tell customers about material changes by email or in the product.
This policy should be read together with our Cookie Policy, Terms of Service and sub-processors list.
