Subnano

Privacy Policy

Effective Date: October 27, 2026

1. Controller and Scope

madsb.com, registration number DK26607094, Denmark, is the controller for personal data processed by Subnano. Contact hello@subnano.me. This policy covers the website, API and Subnano MCP services.

2. Data We Process

  • Account and seller data: username, optional email and profile details, private operator contact, declared private or business status, public contact email and business name, address, phone and registration details where provided.
  • Payments and purchases: wallet addresses, authentication and payment signatures, network identifiers, transactions, purchase agreements, delivery consent, confirmations, tips, payouts and related support correspondence.
  • Content and search: published Posts, including paid article text, attachments, search terms and filters submitted by you or your assistant.
  • Technical and usage data: IP addresses, browser and device details, request and error logs, sessions, views, clicks, referrers and analytics identifiers.
  • Requests launch signup: email, notification consent and optional feature-interest answers. These answers are private and do not publish a Request.
  • We receive data from you, your browser or client, participating sellers and buyers, and the payment, wallet and blockchain services used for your transactions. Account and payment details needed to authenticate or complete an action are necessary to provide that service.

Do not submit wallet seeds, private keys or passwords in Posts, search requests or conversations. Creators are responsible for having a lawful basis to publish personal data about others, including any additional condition required for sensitive data.

3. Purposes and Legal Bases

  • Contract performance (GDPR Article 6(1)(b)): provide accounts, publication, payments, purchased access, seller disclosures and related support.
  • Legal obligations (Article 6(1)(c)): keep required accounting and transaction records, document consumer disclosures and delivery consent, and respond to binding legal requests.
  • Legitimate interests (Article 6(1)(f)): secure and operate the service, prevent fraud and abuse, handle legal claims, measure performance and help readers discover published Posts. We balance these interests against the rights of the people concerned. Search processing is described below.
  • Consent (Article 6(1)(a)): send the requested Requests launch email and process optional feature-interest answers. Consent is also required for non-essential storage or access on your device; accepting this policy is not that consent.

4. Recipients and Security

  • Public profile and published content are available according to their visibility and purchase settings. Seller disclosures are public in checkout and payment offers, including those returned to agents, and are recorded in purchase documents. Private login emails and operator contacts are not substituted for public seller contact details. Seller declarations are not independently verified.
  • Service providers process data for hosting and storage (including Vercel and Supabase), email delivery (Postmark), analytics (Plausible), error and performance monitoring (Sentry), search (OpenAI), and payment verification (blockchain RPC providers and Coinbase/CDP). They receive the data needed for their respective services. Wallet providers and your chosen AI provider also process data under their own policies.
  • Transaction addresses, amounts and hashes may appear on public blockchains. We may disclose relevant data to authorities, professional advisers or other parties where necessary to comply with law, prevent fraud or establish, exercise or defend legal claims. We do not sell personal data or share it with advertisers.
  • Providers may process data outside the EU/EEA. Such transfers require an applicable adequacy decision or other lawful safeguards, such as standard contractual clauses. Contact us for information about the safeguards applicable to your data and how to obtain a copy.
  • We use appropriate technical and organisational measures to protect personal data.

5. Retention and Account Deletion

  • We retain account data while providing the account and other personal data for the period needed for the stated purpose, taking account of active transactions, security investigations, applicable limitation periods and legal retention duties.
  • You can edit your profile and seller disclosures in Settings. Changes apply to future purchases; original agreements and confirmations retain the information recorded at purchase.
  • Account owners can request account deletion in Settings after signing in again. Unpaid payouts or payouts under reconciliation must be resolved before that process completes. Deletion ends account and purchase access, clears the active profile, seller declaration, private operator contact and preferences, revokes sessions and publication keys, and unpublishes Posts. You may still exercise your data protection rights by contacting us.
  • Uploaded files, including purchased files, are removed and buyers lose access to them. Removal may continue after account closure; uploads in progress, unfinished checks or safety holds can delay it. Previously purchased article text and the Post context needed to deliver it may remain available to existing buyers.
  • A confirmed email may be retained for up to seven days to send a deletion confirmation. A non-login account identifier and deletion status remain to prevent reuse of the closed account.
  • Original agreements, confirmations and purchase, payment, tip and payout records survive account deletion. They may contain seller details and wallet addresses and are not anonymous. Accounting records subject to Danish bookkeeping law are retained for five years after the end of the relevant financial year, or longer where a continuing legal requirement or claim justifies it. Other purchase records remain as needed to fulfil existing purchases, resolve claims or meet legal obligations; account deletion does not trigger an automatic purge of financial records.
  • Requests launch signups are removed after the launch email is delivered, or after 180 days if launch is delayed. Analytics and search retention are described below. Technical logs and backups follow the retention settings of the relevant service and may be retained longer for a specific security incident or legal requirement. Account or Post deletion does not immediately erase those copies.
  • Subnano cannot erase public blockchain records or copies already downloaded by others.

6. Your Rights

Subject to the conditions in data protection law, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Contact hello@subnano.me; Requests launch consent can also be withdrawn with Undo on the signup page. Where a request is limited by law, we explain why. You may complain to the Danish Data Protection Agency (Datatilsynet).

7. Cookies, Local Storage and Analytics

  • We use cookies and browser storage for authentication, checkout and payment recovery, and separate identifiers for analytics. Analytics covers views, clicks, device and referrer information, including creator-facing Post statistics. Plausible provides site analytics; Sentry processes error and performance diagnostics.
  • The analytics client cookie expires after 365 days. A local viewer identifier remains until browser storage is cleared; a session identifier lasts for the browser session. Pseudonymous identifiers in server-side Post analytics are retained for up to 90 days.
  • You can clear or block cookies and browser storage through your browser settings. This may interrupt sign-in or checkout recovery. Clearing browser storage does not erase server records or saved purchases.

8. MCP and AI Assistants

  • The local Subnano MCP server stores credentials and operation state on your computer and sends the data needed for your requested actions to Subnano. Wallet seeds and private keys remain local. Your AI provider receives tool results and content added to the conversation and handles them under its own policy and your settings.
  • Subnano Browse receives search terms, filters and Post identifiers sent by your assistant and returns public listing data and free Post content. It does not request conversation history, account credentials or wallet information. Vercel hosts Browse and the API; Supabase provides the catalog.
  • Browse does not persist search terms, tool results, user identities or MCP sessions in its application, and its application analytics is disabled. Vercel technical request logs may remain for up to 30 days. The Subnano API separately processes searches and caches derived query embeddings as described below.
  • Removing an MCP connection stops future use of that connection; it does not delete your Subnano account, local credentials or saved conversations. Manage conversations through your AI provider and contact us about data held by Subnano.

9. Semantic Search

  • When enabled, semantic search sends published article text, including full paid text, titles, descriptions and introductions, to the OpenAI API to create embeddings. Search terms are also sent when a query embedding is needed. Unpublished drafts, attachments, conversation history, wallet credentials and purchase history are not inputs to this indexing.
  • Supabase holds the derived embeddings in a private search index. Paid text can affect public matches and ranking, but public results contain only listing information and creator-provided previews, not the paid text or embeddings. Embeddings are protected data, not treated as anonymous.
  • This processing relies on our legitimate interests in relevant and efficient search, subject to the rights described above. Special categories of personal data additionally require a condition under GDPR Article 9.
  • OpenAI processes inputs under its business terms and Data Processing Addendum. We do not enable optional sharing for model improvement. API inputs are not used for model training by default. OpenAI abuse-monitoring logs may contain input text and normally remain for up to 30 days, with longer retention for applicable legal or security reasons. Processing may occur outside the EU/EEA under the applicable transfer safeguards, including adequacy decisions or standard contractual clauses.
  • Unpublishing or deleting a Post removes it from search and deletes its active embeddings. Embeddings superseded by edits stop participating in search immediately and are removed by scheduled cleanup after up to 24 hours of private reuse. Query embeddings expire for reuse after 24 hours and are removed by scheduled cleanup. Provider logs and backups follow their separate retention schedules.

10. Policy Changes

We publish updates here and provide additional notice where required by law.

If you have any questions about this Privacy Policy, please contact us at hello@subnano.me