Privacy Policy

ClearSwell LLC ("Company," "we," "us"), located at 1155 N Cedar St, Glendale CA 91207, United States, operates Subo the Survey Bot and associated websites and services ("Service"). This Privacy Policy explains what personal data we collect, how we use it, and what rights you have. It applies to Discord server owners and authorized creators who manage surveys, and to participants who respond to them.

The data relationship differs by role:

• Creators (server owners and admins): access Subo via Discord commands and the web admin. For survey results and response data collected on their behalf, Subo acts as a data processor and creators are the data controllers. Creators are responsible for the lawful collection of their community members' survey responses.
• Participants (survey respondents): respond to surveys invited by creators. For profile data, XP, and participation history, Subo acts as the data controller. For response content collected on behalf of a creator, Subo acts as a data processor.

If you are a participant and have questions about how a specific survey handles your data, please contact the server admin who ran the survey.

We are the controller and responsible for your data. Here is the Personal Data we collect:

• Profile Data: by accessing and using the Service, we will receive from Discord your Discord ID, username, and the name and identifier of the Discord server you come from. This information will be associated with a unique identifier that we generate for you. You may also be asked to provide Personal Data such as your email address, age, gender, language or location.
• Survey data: when you create a questionnaire on our platform, we collect the content of the questionnaire and its attributes. We also collect metadata such as the date and time of creation.
• Respondent Data: when you participate and answer questions from our surveys, we will also collect your answers such as personal opinions on the topic of the research (products and services, brands and companies), declared behaviors, demographic information (including marital status, family details, occupation, education, media usage, income bracket, home ownership). In some cases, you may be asked to voluntarily provide Personal Data which may be considered "sensitive", including racial and ethnic origin, political and religious beliefs, sexual orientation and health or disability status. You may refuse to answer these or any other questions or discontinue participation at any time.
• Web Survey Data: if you respond to a survey through the web interface rather than Discord, we may collect additional technical data including your IP address, browser type, device type, and session identifiers for access control, fraud prevention, and service operation.

The anonymity mode for each survey is set by the creator. There are three modes:

• Transparent: individual votes and responses are shared with the survey creator and made visible to the community (other server members). Both the creator and other participants can see who answered what.
• Semi-private: individual votes and responses are shared with the survey creator only, and are not made public to the community.
• Anonymous (Full Anonymous): no identity link is created or retained at any point: Subo cannot attribute the response to any specific user. Because no identity link exists, anonymous responses cannot be deleted via /profile or by individual request. Anonymous responses may still be sent to OpenAI for text summarization; no identity information is included in those requests.

Participants should contact the server admin if uncertain about how a specific survey handles their data, as the anonymity mode is determined by the creator.

We use the data you share with us to give you a good experience and to provide information and insights to our research clients.

We use Personal Data to:

• Provide anonymized data to our clients: we will generally provide data sets in an aggregated form, such as reports showing the total number and percentage of respondents having given a certain answer to a question. In some cases, we may share topline results with the press or on our own website and social media.
• Provide our clients with entire or partial non-aggregated data sets which do not reveal your identity. For example, text answers to open-ended questions will generally be anonymized, then transferred in full.
• Verify your identity and prevent fraudulent activity: we may use a combination of questions, location data, IP address and digital fingerprinting techniques to identify participants we do not want to access certain surveys.
• Manage your account (if you contact us, we can associate your user identifier to your account details to better support you).
• Communicate with you regarding your participation in the program.
• Establish a leaderboard ranking different users for the servers you belong to. XP tracking requires persistent participation history; monthly leaderboard scores reset but the underlying history is retained. Role reward eligibility requires storing qualifying actions permanently.
• Recurring and scheduled surveys: automated delivery on creator-configured schedules. Participation remains voluntary. Response data is handled identically to single-instance surveys.
• Creator Network: as part of our own market research, we may contact Subo survey creators (server owners) to invite them to participate in surveys conducted by Subo/ClearSwell. This uses contact information (Discord username, server association) already held as part of your creator account. You may opt out at any time by contacting hello@subo.ai.
• Service providers: we may work with trusted service providers to help us run our business, for example cloud data storage, survey/data collection technology, validation and anti-fraud services.
• OpenAI API: we use the OpenAI API to (1) analyze and summarize open-ended text responses, (2) generate survey drafts via the /draft command, and (3) process Full Anonymous survey responses where no identity data is included. The OpenAI API will not use the data to train or improve its models, but will retain the data for abuse and misuse monitoring purposes for a maximum of 30 days. You can learn more about how the OpenAI API uses your data in its privacy policy.
• Payment processing (Stripe): subscription payments are processed by Stripe, Inc. Subo does not store full payment card details. We receive subscription status (tier, renewal date, server association) from Stripe. Stripe's privacy policy applies to payment data.
• We may also provide links to third-party bots, websites and apps, which are independent from Subo and have their own separate privacy policies. We are not responsible for the privacy practices or content of such third-party websites or apps. We recommend that you carefully read the privacy policies of each site or app.
• In rare instances, we may be required by law to share Personal Data with public authorities, or we may share data to defend our rights, including with legal advisors.
• If our business gets acquired, merges, or in case of bankruptcy, your data will be considered an asset and may be transferred to the acquirer. In this case, we will require the other party to agree in writing to respect this Privacy Policy.

You have the right to request access to Personal Data, the correction or deletion of any Personal Data we hold about you.

We give you access and the ability to correct or delete your data directly through our service on Discord by using the /profile command. Please note that Full Anonymous responses are unattributable: because no identity link was created, these responses cannot be individually deleted. If you are unable to perform these actions yourself, please contact us to assist you at hello@subo.ai.

In addition, you can also simply exercise your rights by contacting us at hello@subo.ai. To protect your privacy and security, we take reasonable measures to verify your identity before granting you such access.

You also have the right to be free from discrimination for exercising your rights.

If you are a resident of the European Economic Area (EEA) or United Kingdom, you may have certain data protection rights granted by the GDPR and UK GDPR.

Your GDPR rights include:

• The right to access, rectify or delete the information we have on you.
• The right to data portability: the right to receive a copy of your data in a structured, machine-readable format.
• The right to appeal automated decision-making: the right to request human intervention into any automatically-made decision relating to your Personal Data.
• The right to object to our processing of your Personal Data.
• The right of restriction: the right to request that we restrict the processing of your Personal Data.
• The right to withdraw consent at any time where we relied on your consent to process your personal information.
• The right to complain to a supervisory authority if you consider our processing unlawful.

Legal basis for processing:

International data transfers: Data is stored in the United States. Transfers from the EEA/UK rely on Standard Contractual Clauses (SCCs) with our sub-processors (OpenAI, Stripe, Google), and/or the EU-US Data Privacy Framework where applicable. Contact hello@subo.ai for details.

Our service lets you directly access, rectify, delete your Personal Data or export it in a commonly used format. Please use the /help command for more information about the different data control commands available through our service. If you are unable to perform these actions yourself, or for other requests related to exercising your rights, please contact us at hello@subo.ai.

The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA, effective January 1, 2023) give California consumers certain rights over their personal information. If you are a California resident, you have the right to:

• Request disclosure of the categories and specific pieces of Personal Data we collected about you, and the categories of sources, business purposes, and third parties involved.
• Delete Personal Data we collected from you (subject to certain exceptions).
• Correct inaccurate personal information we hold about you (CPRA right).
• Limit the use of sensitive personal information (e.g., racial or ethnic origin, health information, sexual orientation) that you may have voluntarily provided in survey responses (CPRA right).
• Know about automated decision-making: survey targeting in Subo is role- and rules-based, not based on machine-learning profiling (CPRA right).
• Opt out of the sale of your personal information. As stated in this Privacy Policy, we will never disclose Personal Data to third parties in exchange for monetary consideration without your consent. However, under the CCPA's broad definition of "sale," certain transfers in connection with services provided to our clients could arguably qualify.

If you reside in California and would like to exercise any of these rights, please send us an email at hello@subo.ai. You have the right to designate an authorized agent to make a request on your behalf; we will require a signed, written authorization from you to verify the authorization.

If you are a resident of Brazil, the Lei Geral de Proteção de Dados (LGPD) grants you the following rights regarding your personal data:

• The right to confirmation of the existence of processing.
• The right to access your personal data.
• The right to correction of incomplete, inaccurate, or outdated data.
• The right to anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD.
• The right to data portability.
• The right to information about third parties with whom we have shared your data.
• The right to withdraw consent at any time.
• The right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

The legal bases we rely on for processing your personal data under the LGPD include: consent, contract performance, and legitimate interests.

To exercise any of these rights, please contact us at hello@subo.ai.

We are committed to protecting the privacy of children. We do not knowingly collect data from users under the age of 13 (16 in the European Union) and take reasonable measures to verify a user's age. If we become aware that we have collected or stored Personal Data from a user under 13 (16 in the EU), we will delete the data. If you are a parent or a guardian of a child and believe that we may have collected your child's Personal Data, please contact us at hello@subo.ai.

We use reasonable security measures to protect your Personal Data from unauthorized access or loss, misuse and alteration of data. Only the employees whose function requires it have access to your data, and we are doing a thorough due diligence to only work with trustworthy service providers.

Subo data storage is located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. See the EEA and UK Residents section above for information on international transfer mechanisms.

If you have any questions about this Privacy Policy, contact us via email at: hello@subo.ai.

This Privacy Policy was last updated on the date that appears at the beginning of the document. It may change from time to time. If we make any changes to this Privacy Policy, we will post any changes on this page. Where we make any material changes, we will make a more prominent notice in compliance with applicable laws. Your continued use of our Sites or Services following such posts or notices will signal that you have read and understand such changes.