1. Introduction

Sublien LLC ("SubLien," "we," "us") operates the SubLien platform at sublien.com. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our lien waiver, certificate of insurance, W-9, and vendor-document compliance services ("Service").

2. Information We Collect

2.1 Account Information

When you register, we collect your name, email address, password (stored only as a salted hash), and company name. Organization roles are assigned within the Service after registration. You always sign in to SubLien with your SubLien email and password — Procore and QuickBooks Online are optional integrations, not sign-in methods. If an owner or administrator connects Procore, we receive OAuth authorization tokens from Procore and the list of Procore companies that user can access, and we store the tokens and the company selected. If you connect QuickBooks Online, we receive your QuickBooks company identifier and OAuth authorization tokens from Intuit.

If you turn on two-step sign-in, or your organization requires it, we store what each method needs: an encrypted authenticator-app secret, the public key and identifier of each passkey you register (never the private key), one-way hashes of your single-use recovery codes, and short-lived hashed sign-in codes we email you through our email provider. We also record when each method was turned on and last used.

Before using the workspace, every account user must personally accept the current Terms of Service and Privacy Policy. Separately, before the organization uses the SubLien lien-waiver library, one ordinary organization owner or administrator must record that the organization chooses to use the complete current SubLien-provided template publication and is responsible for choosing and using each template; a member, the SubLien support account, or a temporary support-access administrator cannot record that approval. Every user must accept the current Terms before using the workspace; the organization's template approval is required only before the SubLien library is used. For each recorded act we collect the exact statement accepted; the applicable policy or template-publication versions, manifest, and cryptographic content hashes; an immutable downloadable copy of the exact Terms-and-Privacy publication accepted or complete template-set PDF approved; snapshots of the acting user identifier, email address, organization identifier and name, and role; the date and time, IP address, and browser string; and, when a prior hardened event exists in the same sequence, that event's evidence hash. For a renewed organization template approval, we also store the exact change summary shown to the approving owner or administrator.

2.2 Transaction Data

To generate lien waiver workflow records and track COI and W-9 status, the Service processes: project names; names, email addresses, phone numbers, and business addresses of vendors/subcontractors and their contacts; contract, purchase order, invoice and payment-application references, contract amounts, payment periods, state and jurisdiction information, insurance certificate details, W-9 status, and W-9 file metadata.

This information may be entered by users, submitted by a vendor through a link we email them, extracted from an insurance document they upload (section 2.5), or imported from connected systems (Procore, Intuit QuickBooks Online). W-9 contents are not extracted. Most of this information reaches us from our customers — the general contractors who use SubLien to manage their own compliance records — rather than from the individual it describes. Section 7 explains what that means for a subcontractor or vendor who wants to see, correct, or delete a record.

2.3 Signature Data

When a document is electronically signed, we collect: the signer's name and title, email address, IP address, approximate geolocation derived from the IP address (city, region, country, and approximate latitude/longitude), user agent string, timestamp of signature, consent to electronic signature, the drawn or typed signature image, and a cryptographic hash of the signed document for integrity verification.

When a lien waiver is signed, the signer's browser also saves a copy of the signing page as it was displayed at that moment, including images of the document pages, up to about 2 megabytes, so that what the signer saw can be shown later. It contains the document and the details on the page at that moment. The SHA-256 hash of that copy, and the SHA-256 hash of any signature image the signer chose, are recorded with the signature. The copy is stored with the rest of the signature evidence, is retained on the same schedule (section 6), and is included in the evidence archive a customer can export. Capturing it is best-effort: if the page images do not fit within that limit the copy is saved without them, and if the copy still does not fit or cannot be made, signing proceeds without it.

2.4 Usage Data

We automatically collect: IP addresses, browser type, device information, pages visited, and interaction timestamps. This data is used for security, rate limiting, and service improvement.

We do not run our own page-view database. Public-site measurement is provided by Vercel Analytics and Speed Insights (section 8). Until September 2026 we operated our own cookieless page-view measurement, which stored a daily-changing hash instead of an IP address; we have stopped recording it, and the records already collected are handled as described in section 6.

If a public landing URL contains standard campaign tags, we also keep those tags and the first and most recent public page paths in session storage in your browser. This session-scoped record contains no visitor identifier and is used only to connect a demo or resource request submitted during that browser session with the campaign and public pages that led to it. If you submit a request, those campaign tags and page paths are stored with the request; otherwise they are not added to a sales-enquiry record.

IP addresses are also used transiently to enforce rate limits on sensitive endpoints. Beyond those short-lived security counters, we store an IP address durably where it is part of a record's evidentiary value or origin. Those records include: electronic signature evidence and the other events in a lien waiver's audit trail (section 2.3); files a vendor or signer returns for a lien waiver or vendor document request, including notarized executions; the events on a vendor document request, such as email verification, messages, and suggestions of a different recipient; W-9 uploads through a request link and the other events in a W-9's history; every user's personal acceptance of our Terms and Privacy Policy and every organization approval of a lien-waiver template publication; demo requests (section 2.7); recording a review of a certificate of insurance; an owner's or administrator's decision on a staff support-access request; and our own administrative actions on an account. The IP address belongs to whoever took the action — someone on your team, a vendor or signer, or SubLien staff. Some of these records, such as signature evidence and vendor document request events, also keep the browser string and an approximate location derived from the IP address. Each IP address is kept with the record of what that person did and is retained for as long as that record is (section 6).

SubLien also keeps a workspace audit log of recorded actions by your users, vendors, SubLien support, and the Service. Entries may include the actor's name or email, action and category, related vendor, project or record, limited event details, and time. The log records actions, not page or inline-file views; it does not include IP addresses or browser user-agent strings. Recording happens after an action succeeds and is best-effort, so an entry can be missing and the log is not a complete record of every action; the deletion of a lien waiver, W-9 record, or vendor document is the exception, and is recorded in the same step as the deletion (section 6). Organization owners and administrators can view, filter, and export the log. It is included in nightly backups and is removed when the organization is erased (section 6).

2.5 Uploaded Documents

Users and the vendors they invite may upload insurance certificates (ACORD 25 forms) and policy endorsements, signed or notarized lien waivers, contracts, purchase orders, change-order documents, logos, W-9s, and other documents. These files are stored securely and processed only to provide the Service. Insurance certificates and related insurance documents are transmitted through Vercel AI Gateway to our AI model providers so their key fields can be extracted; the extracted values are advisory and are shown in the customer's account for review. Searches you run and questions you ask about an insurance document are also processed by our AI model providers, together with the document's text and the facts recorded for it. Questions and their answers are stored with the certificate, are visible to your organization's team, and are deleted with the certificate or the account. If you import a vendor spreadsheet without a usable header row, its contents are sent to our AI model providers to extract vendor records. W-9s are not transmitted to any AI provider.

Users may upload W-9 files. The uploaded source file, which can contain a full taxpayer identification number, is stored encrypted with access-controlled delivery. SubLien does not send W-9s to an AI provider or read, extract, validate, or verify their contents. A W-9 stays in a received state until someone on the customer's own team records Reviewed or Returned; nothing advances that status automatically. The workflow does not provide IRS validation or taxpayer identification verification.

2.6 Error Reporting and Diagnostics

When the application encounters an error, SubLien may capture the visible page text and the most recent browser console warnings and errors leading up to the failure (both truncated, with obvious personal-data patterns such as email addresses, tax identification numbers, masked account digits, and dollar amounts redacted), along with technical details such as the page URL, your account email, your organization identifier, and browser information. Screenshots are not collected. If the error occurs when you are not signed in, the page text and console output are discarded entirely and only the technical details are kept. This diagnostic data is processed through Vercel AI Gateway by our AI model providers for automated triage and emailed to SubLien staff via Resend so we can diagnose and fix the problem.

2.7 Demo Requests and Sales Enquiries

If you submit our demo request form, we store the information you provide (name, work email, company, role, approximate number of vendors, your questions, and your stated availability) together with the IP address, browser string, country, standard campaign tags, and first and most recent public landing-page paths associated with that browser session. It is stored in our own database and is not sent to any customer-relationship or sales platform. We use this only to contact you about your enquiry and to understand where enquiries come from. You can ask us to delete a demo request at any time at hello@sublien.com.

3. How We Use Your Information

We use collected information to:

Provide, maintain, and improve the Service
Generate lien waiver workflow documents using state-aware templates and customer-approved workflows
Facilitate electronic signature workflows
Track W-9 request, receipt, source-file storage, and customer-recorded reviewed or returned status
Track COI fields, recorded review status, and comparisons with customer-configured minimums
Send transactional emails (signature requests, verification codes, signed copies, and customer-configured record alerts)
Maintain workflow evidence and audit records
Record and preserve each user's Terms and Privacy Policy acceptance evidence and each organization's template-publication approval evidence
Detect and prevent fraud, abuse, and unauthorized access
Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We share data only in the following circumstances:

Between parties to a transaction: When a general contractor sends a lien waiver, the subcontractor receives the waiver details. When signed, the general contractor receives the signed document and audit trail.
SubLien personnel: The SubLien support account (support@sublien.com) is an administrator of every organization, added when the organization is created, so we can set things up or help when you ask. It can do what an administrator of your organization can do, including changing settings, managing team members, deleting documents, and exporting files that contain tax identification numbers, and through it we can produce a complete export of your organization's records. It cannot record your organization's SubLien library approval, sign documents for your company, or become the owner; it does not receive your organization's notification emails; and we remove it if you ask us at hello@sublien.com. Workspace actions the support account takes are recorded under its own name in the workspace audit log. When it deletes a lien waiver, W-9 record, or vendor document, the deletion is recorded in the same step as the deletion (section 6). Its other actions are recorded on a best-effort basis: the record is written after the action succeeds, recording can fail without undoing the action, and views are not recorded, so the log is not a complete record of every action or view. Any other SubLien staff account joins your organization only if an owner or administrator allows it: a request names the person asking and states in their own words why, and reaches you as a banner in your dashboard and an email to every owner and administrator. You choose the window, or refuse; unanswered requests stop working after three days, and the account leaves automatically when the window closes.
Service providers: We use Vercel (hosting, file storage, and its cookieless Analytics and Speed Insights performance measurement), Neon (database), Supabase (disaster-recovery standby, United States — it holds a mirror of our database records, refreshed once a day; encrypted archives containing copies of uploaded document files were also stored there until we moved that copy to the offsite object store below, and those earlier archives have since been removed, so it now holds no copies of uploaded documents), Cloudflare R2 (offsite object storage — it receives the encrypted archive containing copies of uploaded document files, which is stored there and nowhere else, a second copy of the encrypted database backup, and, since August 2026, a second copy of the deletion-request record that authorized an erasure; all three are described in section 5), Resend (email delivery, including automated error alerts to our staff), Vercel AI Gateway (routes AI requests, with zero data retention requested, to Anthropic and OpenAI, for COI parsing, document search and questions, header-less vendor-spreadsheet import, and automated triage of application errors; depending on the feature, either one is the main model provider, and the other may be used as a fallback when the first is unavailable or, when reading a certificate, returns an unusable reply; the Gateway may run a model on its developer's own service or on a cloud platform that hosts that developer's models, such as Amazon Bedrock or Google Vertex AI), Stripe (payment and billing processing), and Cloudflare Turnstile (bot protection on public forms; processes IP address and browser signals). These providers process data on our behalf under data processing agreements. Uploaded COI documents and vendor data may be processed by our AI model providers for automated data extraction. W-9 documents are not sent to any AI provider.
Public verification page: Anyone who has a signed lien waiver's fingerprint (one of its SHA-256 hashes), or the signed PDF file itself, can look it up on our public verification page at sublien.com/verify. A chosen PDF is hashed in that person's browser and is never uploaded; only the hash is looked up. When the hash matches a signed record, the page shows the record's identifier, its waiver type (or, for an organization's own form, the form's name) and state, the vendor and project names, the name of the general contractor's organization, the signer's name and the date and time of signing, the countersigner's name and time where there is one, the record's stored hashes and which one matched, whether its audit trail is internally consistent, and the names and times of its audit events. It does not show email addresses, IP addresses, browser details, or location. After a signed lien waiver is removed from SubLien — because an owner or administrator deleted it or because its organization was erased — a lookup shows only that a SubLien record with that fingerprint existed, when it was signed, and when it was removed from SubLien; the page no longer shows the document, the names on it, or its audit trail (section 6).
RFC 3161 timestamp evidence: We send a cryptographic hash of the signed document to an independent timestamp authority (Sectigo, with DigiCert as a fallback) and store the signed token only after its cryptographic and certificate-path checks pass. For newly admitted tokens, we also authenticate current issuer-signed full CRLs for every non-anchor path certificate and retain those CRLs with the exact path. The recorded result is good at anchor time under that retained evidence, not a perpetual or current non-revocation claim; legacy tokens may lack retained CRL evidence. Only the hash is sent to the timestamp authority — it does not receive the document, its contents, or personal information from the document.
Procore integration: When connected, SubLien reads the selected project, vendor, purchase-order, subcontract and payment-application information you authorize. If your organization turns them on, SubLien also sends to Procore: (a) each signed or accepted lien-waiver document, including the signer's name, the signature details and the signature-record page it contains, filed in that project's Documents tool; and (b) for certificates of insurance your reviewer has reviewed, each coverage line's type, policy number, limit, effective and expiration dates and recorded status, with a note naming the reviewer, the review date and the insurance carrier, written to the vendor's insurance records in the Procore company Directory. Once in Procore, that information is held under your organization's agreement with Procore. SubLien does not otherwise modify Procore project, vendor, financial, insurance or document records. Connecting, receiving updates and disconnecting may create, update or remove technical OAuth grants and webhook registrations used to operate the connection.
QuickBooks Online integration: When connected, SubLien reads authorized vendor, purchase-order, bill, customer, subcustomer and QuickBooks Project information from Intuit QuickBooks Online. Parent customers remain client references; you choose which native QuickBooks Projects and job-tracking sub-customers become SubLien projects. SubLien does not import QuickBooks file attachments, including W-9s. W-9 files are collected directly through SubLien as described in section 2.5. SubLien does not import QuickBooks tax-identifier fields or 1099-status fields, and it does not modify QuickBooks vendors, customers, purchase orders, bills, memos, attachments or other accounting records. Connecting sends OAuth authorization requests and read queries to Intuit.
Email delivery events: Our email provider reports back what happened to each message we send on a customer's behalf — delivered, opened, bounced, or reported as spam. For signature requests and reminders we record those events against the document's audit trail, keyed to the recipient's email address, so the general contractor can see whether their subcontractor received and opened the request. When a message we send to a vendor or agent on a customer's behalf hard-bounces, is reported as spam, or is suppressed, we record that on the related lien waiver, certificate, W-9, or document record and notify the customer's sender (or its owners and administrators) by email and in the app. That audit trail is part of what the customer can export.
Suppression list: When a message to an address hard-bounces, is reported as spam, or is suppressed by our email provider, or when the recipient uses the unsubscribe link in a reminder, we add that address to a list and stop sending it automated reminders. That list is held once for the whole Service rather than per customer, so a suppression created by one customer's message also stops another customer's automated reminders to the same address, and each of them can see that the address is suppressed. Transactional messages such as signature requests and verification codes are still attempted. Write to hello@sublien.com to have an address removed from the list.
Legal requirements: We may disclose information if required by law, subpoena, court order, or to protect our rights and safety.

5. Data Storage and Security

Data is stored on servers in the United States using Neon (PostgreSQL database) and Vercel Blob (file storage). Data is encrypted at rest, and in transit (TLS 1.2+) between your browser and the Service. Email is different: messages we send, including emailed copies of signed documents, are encrypted on the way to the recipient's mail server only when that server supports it. For disaster recovery we also keep an encrypted backup of the database and an archive containing copies of uploaded document files; both are encrypted under a key held by us rather than by any storage provider before they are sent anywhere. The encrypted database backup is written as a private object in Vercel Blob and, offsite, to a Cloudflare R2 bucket. The encrypted archive of uploaded document files is written to that Cloudflare R2 bucket and to nowhere else — deliberately not alongside the documents themselves in Vercel Blob, so that no single provider holds both the originals and their archive. We no longer send either copy to Supabase, and the archives stored there under our earlier arrangement have since been removed, so Supabase holds no copies of uploaded document files. A third kind of encrypted object is kept in that same offsite bucket: where a customer has asked us to erase an organization, the record of that request — described in section 6 — is stored there as well as in our primary file storage, so the document that shows an erasure was authorized cannot be lost with the account it authorized. Separately, we keep a mirror of the database itself at Supabase, refreshed once a day, so the Service can be brought back on a second provider. Signed documents and audit trails cannot be edited through the application; an owner or administrator can delete a record, and the deletion is recorded (section 6).

SubLien is built for United States construction businesses and their vendors, and is not directed to individuals in the European Economic Area, the United Kingdom, or Switzerland. Our own application servers, databases, and document storage are in the United States. Some service providers listed in section 4, such as our AI model, payment, email, and bot-protection providers, may process data in other locations under their own safeguards. The encrypted offsite disaster-recovery copies described above are stored in whichever region the offsite bucket is configured for, and they are encrypted under a key held by us before they are sent there. If you contact us from outside the United States we will handle your request under this policy.

We implement industry-standard security measures including: rate limiting on sensitive API endpoints (authentication, signature verification, and payment processing), cryptographic hashing (SHA-256) for document integrity, OTP-based email verification for signers, XSS sanitization on rendered content, and parameterized SQL queries to prevent injection.

On our side, administrative access to the Service is limited to Sublien LLC personnel — today, its sole member. Our operator console is protected by its own administrative credential, distinct from any customer account, and an authenticator-app second factor. The SubLien support account is an administrator of every organization, as described in section 4, and is required to use two-step sign-in. The actions that can move customer data or reach into a customer account are recorded with the reason given for them. Any other staff support session opens only when a named owner or administrator allows it. Separately, when a signer makes a claim or dispute about a particular lien waiver, Sublien LLC may retrieve a single-waiver claims packet containing that waiver and its signing evidence; that route excludes unrelated COIs, W-9s, insurance requirements, and other account records. The reason and waiver ID are recorded in our administrative log. We do not claim a SOC 2 or ISO certification of our own; our hosting and database providers hold their own, which we describe on our security page.

Retained identifiers and hashes are not necessarily anonymous: they may be linked to retained acceptance or deletion records.

6. Data Retention

We set retention periods with applicable state lien waiver, insurance, tax, accounting, contractual, and evidence-preservation requirements in mind. Contact us at hello@sublien.com for data export or deletion requests. Account data is not deleted on a timer and does not expire when a subscription does: when a subscription ends we pause the account and email a link for downloading its records, and although that link stops working after 30 days the records behind it stay as they are, so a customer who returns later finds them intact. Records leave the Service when an owner or administrator of the customer's organization deletes them in the Service, when the customer asks us to delete them, or when the organization is erased, which is the process described further down this section. The short-lived counters used to enforce rate limits, including the IP addresses in them, are discarded within days.

The periods below are minimums rather than a deletion schedule: records are not erased automatically when a period ends, and they are not erased because a subscription ended. They stay in the customer's account until an owner or administrator deletes them or the customer asks us to delete them, so that the customer keeps a complete compliance history; the minimums apply only to records that have not been deleted in one of those ways. Signed lien waiver documents and associated signature evidence are retained for a minimum of 10 years. SubLien stores a downloadable executed copy and attempts to email it after signing; delivery can fail or be retried, so signers should retain the downloadable copy. COI documents are retained for a minimum of 10 years after expiry, and longer where a contract or law requires it. W-9 records and vendor documents remain available for as long as the account exists — including after a subscription ends, so that export, deletion, and the customer's own legal or accounting retention obligations are still possible — and are removed when an owner or administrator deletes them or the customer asks us to delete them.

Deleting individual records. An owner or administrator of a customer's organization, including the SubLien support account, can delete an individual lien waiver in any status, certificate of insurance, W-9 record, or vendor document in the Service. A lien waiver, W-9, or vendor-document deletion is recorded in the workspace audit log with the person who made it, in the same step as the deletion; a certificate deletion is recorded there after it completes, on a best-effort basis. Each deleted evidence entry leaves an evidence-integrity record, and a deleted lien waiver that had been sent or signed leaves the fingerprint record described below. The deleted record and its stored files are otherwise removed from the live Service, and copies can remain in backups until they age out. No copy or export is taken before such a deletion, so a customer that may need the record should download it, or the vendor packet, first. An evidence archive is made automatically only before a whole organization is erased, as described below.

Backups. For disaster recovery we keep two kinds of encrypted copy, in the places described in section 5: copies of the database, and archives containing copies of the uploaded document files themselves. Both run on a rolling schedule and older copies are deleted as newer ones replace them. For each series we keep five archives: the most recent one, the copies that ended each of the last two weeks, and the copies that ended each of the last two months. The weekly copies are the closing snapshots for the last two completed Friday periods, and the monthly copies are the closing snapshots for the last two completed calendar months. The newer Friday or month-end copy remains while it ages into the older restore-point slot. Both now keep the same five generations, and one stored copy that qualifies for more than one tier is counted only once. The oldest copy in either series is therefore roughly two months old. These are counts of successful backup generations rather than fixed calendar cutoffs, so a long interruption can make the oldest retained generation older; after a deletion request, any such older copy is handled under the 90-day deletion commitment in our Terms rather than retained merely to fill a generation slot. Deleting data removes it from the live Service, but a copy can remain in these backups until the copies containing it age out or must be removed to complete that deletion request; we do not restore deleted content into the live Service except to recover from an incident.

What we keep after an erasure is a description, not a copy. Immediately before we erase an organization we build an encrypted archive of that organization's records and of the files behind them as they stand at that moment, and we read it back and verify it, because that is what lets us state afterwards exactly what the erasure covered. We then delete that archive too, in the same run as the account: out of our file storage, out of the offsite object store, and off the disaster-recovery standby. What we keep in its place is a record of what it contained, held with our administrative records described below — how many certificates of insurance, W-9s, contracts, projects, vendors, lien waivers and signature records the erasure covered, the SHA-256 checksums of the archive and of its manifest, the archive's size, the name the organization carried at the time, when the erasure ran and who ran it, and the deletion request it answered. That record contains no document, no file, and no tax identification number, and it cannot be used to reconstruct any of them. Apart from the rolling backups described above, which age out on their own schedule, we keep no copy of an erased organization's documents. We kept one such archive under our earlier practice, before 8 August 2026; this change does not reach back and delete archives already retained, and if we hold one for your organization we will tell you when you ask.

Records kept after deletion. Five categories deliberately survive an account or user deletion, because they are evidence of an agreement, approval, or action taken rather than account content: every record that a specific user accepted a specific version of our Terms and Privacy Policy; every record that an authorized owner or administrator approved a specific SubLien lien-waiver template publication for a specific organization; our own administrative, security, and billing records; where an organization is erased, the record of the request that authorized it — in whichever of the two forms described below it took; and, after such an erasure, an emptied marker record of the organization itself. The two acceptance ledgers retain the exact statement, applicable policy or template manifest and change summary, versions and cryptographic hashes, actor and organization snapshots, timestamp, IP address, browser record, and any prior hardened-event hash described in section 2.1. A separate content-addressed archive retains one immutable downloadable copy of every accepted Terms-and-Privacy publication and approved complete template-set PDF, shared across evidence records for that version. The ledgers and publication archive are permanent and immutable: neither a user nor an administrator can edit or delete one through the Service, and erasing the named user or organization does not alter the snapshot or archived file. They contain no project, vendor, waiver document, or signature evidence. The last two categories are described in the paragraphs that follow. Records made only of identifiers and hashes, so that evidence can still be checked later, also survive; they are described in the next paragraph and under the verification heading below. Page-view records collected before September 2026, when we stopped that measurement (section 2.4), are not linked to an account and are retained in pseudonymous form.

Evidence-integrity records. Whenever signature or audit evidence is deleted through our authorized deletion process — when an owner or administrator deletes an individual record, or when an organization is erased — we keep a permanent record of each deleted evidence entry: when it was deleted, which kind of record it was and its identifier, the related waiver and organization identifiers, its hashes, the reason recorded for the deletion if any (for a deleted lien waiver, W-9, or vendor document, the account identifier of the user who made it), and technical identifiers of the database transaction. It holds no names, email addresses, IP addresses, or document content, and it cannot be edited or deleted through the Service.

Asking us to erase an account. There are two ways, and what we record differs between them. You can ask us at hello@sublien.com, and a SubLien operator records the request and carries out the erasure. Or the owner of the account can start it in Settings without contacting us: that requires the owner role, re-entering the account password, and typing the organization's exact name, and it starts a seven-day countdown rather than deleting anything immediately. Everyone with owner or administrator access is emailed when the countdown starts, any of them can cancel it during those seven days, and nothing is deleted until it ends. If the person who started it is no longer an owner when the countdown ends, it does not run.

The record of a deletion request. Either way, we record the request that authorized the erasure, and that record is deliberately not erased along with the account. It holds the name and email address of the person who asked, what the request covered, the date it was made and the date we recorded it, the name the organization carried at that time, and who approved it. When you ask us to erase an account, it also holds the identity of the SubLien operator who approved and performed the erasure together with the IP address the approval came from and the time that administrative session was signed in, and a copy of the message, letter, or screenshot in which the request was made (exported as a PDF or an image, stored together with a checksum of the file so the copy can later be shown to be the one we accepted); that copy is stored outside the account's own file storage, so the erasure cannot reach it. When an owner deletes the account themselves, there is no message for us to store and no SubLien operator involved, so the record holds neither of those things. The record is deliberately linked to the organization it refers to: it carries that organization's internal identifier, and the organization's own marker record described below refers back to it. It cannot be edited or removed through the Service, and it outlives the organization's data and the user accounts that existed only in that organization. It contains nothing else from the account — no documents, vendors, projects, waivers, or signature evidence.

What we keep when you delete the account yourself. The request in that case is the act you performed in the product, and it is written to a separate record of its own the moment the countdown starts — the record the one above points at. That entry holds the name, email address, role and account identifier of the owner who started it, the date and time, the IP address and browser it came from, the moment they re-entered their password, the exact confirmation wording they were shown (kept word for word, together with its version, so a later change to that wording cannot alter what was agreed to), the organization name they typed to confirm, and the email addresses of everyone with owner or administrator access at that moment — the people entitled to be told and to cancel, recorded as who was to be notified rather than as proof that each message arrived. Cancelling is recorded the same way, as a further entry naming who cancelled, when, and from what address, and so is the outcome when the countdown finally runs, is refused, or fails. These entries can only be added to — the Service cannot edit or remove one — and they are retained after the erasure, for the same reason and for the same period as the request record above. They contain nothing else from the account.

Deleted lien waivers and erased accounts: only a fingerprint remains for verification. Our public verification page finds a signed document by looking its cryptographic hash up in the signature records, and those records are deleted when an owner or administrator deletes a lien waiver and when an organization is erased. Immediately before they are deleted, we keep a fingerprint-only record of each lien waiver that had been sent or signed: the waiver's identifier, its signature hash, document hash and countersignature hash where there is one, the SHA-256 of the signed PDF and of its timestamp token, the date and time it was signed, its status when it was removed, and the date it was removed. It holds no names, email addresses, amounts, project, vendor or organization details, or IP addresses, and it is kept permanently and cannot be edited or deleted through the Service. A lookup that matches a signed waiver's fingerprint therefore shows only that a SubLien record with that fingerprint existed, when it was signed, and when it was removed from SubLien; the page no longer shows the document, the names on it, or its audit trail.

What is left of the erased organization. Erasing an organization removes its content — every document, certificate, waiver, signature record, vendor, project, contract, activity record, and setting, along with the stored files behind them — and leaves the organization's own record behind as an emptied marker. That marker keeps no company name (the name is replaced with a non-identifying label), no settings, and no payment-provider identifiers; it records when the erasure happened, who carried it out — the SubLien operator, or the account owner where the customer deleted the account themselves — and a reference to the deletion-request record that authorized it, alongside the closed-out billing state and the plan name and creation date the account had, none of which identify a person. It exists so that the request record and our administrative log still point at something rather than at a missing row, and it too cannot be deleted through the Service.

We keep these records for one purpose: an erasure cannot be undone, so if one is later questioned we need to be able to show that it was asked for, by whom, with what scope, who could have stopped it, and who carried it out under that request. We keep them for as long as a claim about that erasure could be brought, which is why they carry no expiry date. The Texas Data Privacy and Security Act and the CCPA/CPRA each address records retained to establish, exercise, or defend legal claims and to show that a consumer request was acted on; that is the purpose these records serve. If you made such a request and want to know what the record holds about you, contact hello@sublien.com.

The people who worked in the erased account. Erasing an organization deletes that organization's ordinary workflow records of who did what inside it — such as entries naming the person who reviewed a certificate or recorded a customer decision — because those entries belong to the organization being erased. The two permanent acceptance ledgers are the exception described above: they retain their user and organization snapshots without requiring either underlying account record to remain. The accounts of people whose only organization was the erased one are deleted unless the person also belongs to another customer's organization on SubLien or an entry inside another customer's account names the person as having taken an action there. In other words, deleting one customer's account does not reach into a different customer's records to remove a name from them. None of this is copied into the erased organization's marker record; which accounts were kept, and why, is recorded in our administrative log, and — where the customer deleted the account themselves — on the in-product record described above as well.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access: Request a copy of personal data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your data, subject to legal retention requirements
Export: Receive your data in a portable format
Withdraw consent: Before signing, close the signing page. To withdraw consent for future electronic-signature transactions, contact hello@sublien.com; doing so does not affect signatures already executed.
Opt out: Opt out of non-essential communications

To exercise these rights, contact us at hello@sublien.com. We aim to respond within 30 days (or sooner when required by applicable law). Where a general contractor uses SubLien to manage its own compliance records, that contractor controls the vendor, project, and document data in its account; if you are a subcontractor or vendor and ask us to change or delete records held in a customer's account, we will refer your request to that customer and assist them in responding.

Deletion is subject to the exceptions described in section 6: content can remain in encrypted backups until it ages out; the record of what an erasure covered — counts, checksums and dates, holding none of the documents themselves — is kept afterwards; permanent personal records of Terms and Privacy Policy acceptance, organization template-publication approval records, and our administrative and billing activity are retained; and the identifier-and-hash records described there — fingerprints of sent and signed lien waivers and records of deleted evidence entries — are kept permanently. If an organization is erased at your request, the record of that request — your name, your email address, what you asked for, and either the message you sent us or the in-product record of the deletion you started yourself — is also retained after the erasure, as section 6 describes.

8. Cookies and Tracking

SubLien uses essential cookies required for authentication and session management. Our website uses no advertising cookies and no third-party tracking pixels. Emails we send may contain our email provider's open-tracking image, which reports when a message is opened (see "Email delivery events" in section 4); mail scanners that load images can also trigger it.

We use Vercel Analytics (vercel.com/analytics) to collect aggregated, anonymized usage statistics such as page views, referrers, and country-level location, and Vercel Speed Insights to measure page performance. Neither uses cookies, and neither tracks individual users across websites.

Standard campaign tags and first/most-recent public page paths may be held in browser session storage so a form submitted in that session retains its source; that record contains no visitor identifier.

Because we do not sell or share personal information and do not use it for cross-context behavioral advertising, there is nothing for a browser-based opt-out preference signal such as Global Privacy Control to opt you out of. We honor such signals to the extent they apply to us.

9. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended (CCPA/CPRA): the right to know what personal information is collected and how it is used, the right to access and to receive a portable copy of it, the right to correct inaccurate personal information, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right not to receive discriminatory treatment for exercising any of these rights.

In the preceding twelve months we have collected the categories of personal information described in section 2: identifiers (name, email address, postal and business address, telephone number, IP address); commercial information (contract, purchase order, and payment-period details); internet and network activity (pages viewed on our public website, browser and device information, and application error diagnostics); approximate geolocation derived from IP address; professional information (employer, job title, and trade); and, where a customer uploads a W-9, a taxpayer identification number, which is treated as sensitive personal information. We collect these from you, from our customers who invite you into their compliance workflow, and from connected systems you authorize (Procore, Intuit QuickBooks Online). We use them only for the purposes listed in section 3 and disclose them only as described in section 4.

We do not sell or share personal information, as those terms are defined by the CCPA, and we do not use or disclose sensitive personal information for any purpose beyond providing the Service. We have not sold or shared personal information in the preceding twelve months, and we do not knowingly sell or share the personal information of anyone under 16. To exercise any of these rights, contact hello@sublien.com; we will verify your request against the information we already hold and will not treat you differently for making one. If we erase an organization's account at your request, section 6 describes the record of that request which we retain afterward. You may use an authorized agent to submit a request on your behalf.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 18, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision, and each revision is published under its own version identifier shared with our Terms of Service. When we make a material change, the next time a user of your account opens their dashboard the Service asks that user to review and accept the revised documents before continuing, and records that acceptance with the version, time, IP address, and browser used; we may also send notice by email. If you do not want to accept a revision, you can export your data and close your account instead — see sections 6 and 7.

Template-publication approval is a separate organization act. Whenever SubLien publishes a new template-set revision because its wording, source or citation record, metadata, membership, version, hash, or publication identity changed, the Service shows an owner or administrator a summary of what changed and requires one new organization approval before the SubLien library can be used again; other work is not blocked. The approval evidence records what the approving person was shown and accepted; it does not establish legal validity or enforceability, prevent a claim or lawsuit, or guarantee protection from liability.

12. Contact

For privacy-related questions or to exercise your rights:

Sublien LLC
5900 Balcones Drive STE 100
Austin, TX 78731
USA
Email: hello@sublien.com
Phone: (737) 758-4417

Privacy Policy