1. Who this policy applies to
This policy applies to two groups: clients (property management companies and their staff who use the Sublex portal) and prospects (renters who interact with a Sublex-powered chat widget embedded on a property's website).
2. Data we collect
From clients (portal users):
- Name and work email address (account creation and invitations)
- Organization name and property details provided during onboarding
- Property configuration and knowledge base content (pricing, policies, amenities, office hours, etc.)
- Billing information — payment method details are processed directly by Stripe; we do not store full card numbers
- Portal usage and activity data (pages visited, features used) for product improvement
From prospects (widget visitors):
- Conversation messages sent to the AI assistant
- Name, email address, and phone number — only when voluntarily shared during a conversation
- Tour scheduling requests and associated contact information
- Timestamp, session context, and the property associated with the conversation
The widget is embedded on third-party property websites. Prospects should be aware that their interactions with the widget are processed by Sublex and the property management company operating it.
3. How we use your data
- To operate, maintain, and improve the Sublex platform
- To generate AI responses to prospect inquiries using the property's configured knowledge base
- To surface prospect leads and conversation history to the relevant property's leasing team
- To send transactional emails (account invites, onboarding notifications, billing receipts)
- To process subscription payments and manage billing
- To analyze usage patterns and improve AI response quality
We do not sell personal data to third parties. We do not use prospect data for advertising purposes. Prospect data is never distributed to unsolicited third parties outside of the service providers listed in Section 9.
4. Sublex as data processor
When Sublex is embedded on a property's website, Sublex acts as a data processor on behalf of the property management company, which acts as the data controller. This means:
- The property management company determines the purposes for which prospect data is collected and used.
- Sublex processes prospect data only as instructed by the property management company and as necessary to operate the platform.
- Sublex does not sell, rent, trade, or distribute prospect data to any unsolicited third parties. Data collected through the widget is accessible only to the property management company whose widget generated it and to the sub-processors listed in Section 9.
Property management companies are independently responsible for ensuring their use of Sublex and the data collected through it complies with applicable privacy laws in their jurisdiction.
5. Widget interaction & automated communication consent
The Sublex chat widget is an automated digital assistant. By initiating a conversation through the widget, you acknowledge and consent to the following:
- Automated processing: your messages are processed by automated systems, including third-party AI infrastructure, to generate responses. You are not speaking with a human leasing agent unless explicitly indicated.
- Data routing: your conversation, including any contact information you provide, is transmitted to and stored by Sublex and made available to the property management team responsible for that community.
- Purpose of processing: data collected through the widget is used for the specific purpose of responding to inquiries about floor plans, pricing, availability, amenities, pet policies, and other community-specific questions; facilitating tour scheduling; and connecting you with the leasing team.
- Automated follow-up: if you provide contact information, the property management team may use it to send automated or manual follow-up communications related to your inquiry, including tour confirmations, availability updates, and leasing information.
You may opt out of follow-up communications at any time by contacting the property management company directly or by emailing legal@sublex.ai and we will coordinate removal with the relevant client.
6. AI processing disclosure
When a prospect sends a message to the widget, that message — along with relevant property context — is sent to a third-party AI provider (OpenAI) to generate a response. This processing is necessary for the core function of the service.
We use the OpenAI API under terms that do not permit OpenAI to use your data to train or improve their general-purpose models. Data submitted via the API is used solely to generate the requested response and is subject to OpenAI's API data usage policy.
Sublex does not use prospect conversation data or client property data to train any AI models of our own.
7. Data storage and security
All data is encrypted at rest and in transit (TLS). Access to production data is restricted to authorized Sublex personnel and the property management organization whose data it is. We use industry-standard practices to protect data from unauthorized access, disclosure, or loss.
8. Data retention
- Active accounts: client account data, property settings, and prospect data are retained for the duration of the subscription.
- After cancellation or termination: account and prospect data are retained for up to 90 days before deletion, unless earlier deletion is requested.
- Billing records: transaction history and invoices may be retained for up to 7 years as required for legal, tax, and accounting purposes.
Clients may request deletion of their data at any time by emailing legal@sublex.ai. Deletion requests are subject to any legal retention obligations.
9. Third-party service providers
We use the following third-party services to operate the platform. Each receives only the data necessary for its function:
- Supabase — database, authentication, and data storage
- OpenAI — AI language model powering the chat assistant (see Section 6)
- Stripe — subscription billing and payment processing
- Resend — transactional email delivery
- Vercel — frontend hosting and edge infrastructure
- Railway — backend API hosting
We do not share personal data with third parties for advertising or marketing purposes.
10. Your rights
You have the right to:
- Access: request a copy of the personal data we hold about you
- Correction: request that inaccurate or incomplete data be corrected
- Deletion: request deletion of your personal data, subject to legal retention requirements
- Objection: object to certain data processing activities
To exercise any of these rights, email legal@sublex.ai. We will respond within 30 days.
11. Cookies
We use session cookies strictly for authentication (keeping you logged in to the portal). We do not use tracking or advertising cookies. The embedded widget does not set persistent cookies on prospect browsers.
12. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to active clients. Continued use of the platform after changes constitutes acceptance.