Privacy Policy

SubVerse

Last updated: 17 September 2026

1. Who We Are

SubVerse ("SubVerse", "we", "us", "our") is a SaaS subscription management service operated from Vadodara, India. We run the SubVerse platform at subverse.blear.in (the "Service"), which helps businesses track, understand and reduce their SaaS subscription spend.

Address: Vadodara, IN

Contact: shreyash@blear.in

2. What Data We Collect

2.1 Account Data

• Name, work email address, company name, team size and role
• Sign-in is handled by our authentication provider, Clerk (Google, Microsoft or email sign-in)
• We never receive or store your password

2.2 Subscription Data

• SaaS tool names, costs, currencies, billing cycles, renewal dates, owners and notes
• Data entered manually, imported from a CSV file, or created by our email detection feature

2.3 Email Data (Gmail or Outlook, only if you connect a mailbox)

• We request read-only access: gmail.readonly for Gmail and Mail.Read for Microsoft Outlook
• We scan only for emails that look like SaaS receipts, invoices or renewal notices
• We extract only: vendor name, amount, currency, date and billing cycle
• We do not read, store or process any other email content, attachments or contacts
• OAuth access and refresh tokens are encrypted with AES-256-GCM before storage
• You can disconnect a mailbox at any time from Settings, which stops all further scanning

2.4 Usage and Technical Data

• Pages visited, features used, actions taken and session timestamps
• Browser type, device type, IP address and server logs used for security, rate limiting and debugging
• We do not use advertising cookies, cross-site tracking pixels or sell behavioural data

2.5 Status Update Subscriptions

• If you subscribe to incident updates on our status page (subverse.blear.in/status), we store your email address, a confirmation token and the related timestamps
• Subscription is double opt-in: we send nothing until you click the confirmation link in the email you receive
• Every status email includes a one-click unsubscribe link, and unsubscribing stops all further status emails

2.6 AI-Assisted Features

• When you use the Spend Optimizer, duplicate-tool detection or tool comparison features, the relevant subscription metadata (for example vendor names, categories and amounts) is processed by our AI providers (Google Gemini and Groq) to generate suggestions
• We do not send email bodies or mailbox content to AI providers
• AI output is advisory. Generated data should be verified before you act on it

2.7 Payment Data

• When paid plans are activated, billing is handled entirely by Razorpay
• We do not store card numbers, CVV, UPI credentials or net-banking details
• We receive only: payment status, amount, currency and transaction ID

3. How We Use Your Data

We do not use your data for advertising. We do not sell your data to any third party. Ever.

4. Legal Basis for Processing

We process your data under the following grounds:

• Consent: Email mailbox access (OAuth). You can withdraw it at any time
• Contract: To provide the Service you signed up for
• Legitimate interest: Security, usage analytics and product improvement
• Legal obligation: GST invoicing and statutory compliance

5. Data Sharing

We share data only with the processors required to run the Service:

All third-party processors are bound by data processing agreements. We do not share data with any other party without your explicit consent, and we never share mailbox contents with AI providers.

6. Data Retention

7. Your Rights (DPDP Act 2023)

Under India's Digital Personal Data Protection Act 2023, you have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your account and all associated data
• Withdraw consent: Disconnect a mailbox, unsubscribe from status updates, or delete your account, at any time
• Grievance redressal: Lodge a complaint with our Data Protection Officer

To exercise any of these rights, email: shreyash@blear.in

We will respond within 30 days.

8. Data Protection Officer

As required under the DPDP Act 2023:

Name: Shreyash Tailor

Email: shreyash@blear.in

Address: Vadodara, IN

9. Data Security

• All data encrypted at rest (AES-256)
• All data encrypted in transit (TLS 1.2+)
• OAuth access and refresh tokens encrypted with AES-256-GCM before storage
• Access to the production database restricted to authorised personnel only
• Security incidents reported to affected users within 72 hours

10. Cookies

We use a minimal set of cookies required for authentication and payment security. The full list is published in our Cookie Policy. We do not use advertising or cross-site tracking cookies.

11. Children's Privacy

Our Service is intended for business users only. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at shreyash@blear.in and we will delete it immediately.

12. Changes to This Policy

We will notify you by email at least 14 days before any material change to this Privacy Policy. Continued use of the Service after the effective date constitutes acceptance.

If we add new data sources later, for example bank statement uploads or Account Aggregator-based detection, we will update this policy and ask for separate, explicit consent before collecting any such data.

13. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the jurisdiction of courts in Vadodara, India.

14. Contact

SubVerse

Email: shreyash@blear.in

Address: Vadodara, IN