Privacy policy · Subcheck

1. Who we are

The controller for the data in this policy is:

Josef Moucachen, trading as Synthropy
Overhoeksplein 3
1031 KS Amsterdam
Netherlands
Chamber of Commerce (KvK): 94099660
Email: support@getsubcheck.com

We have not appointed a data protection officer. We are not required to, because we do not process special categories of data on a large scale. Write to the email address above with any privacy question.

2. What Subcheck is and is not

Subcheck reads two sets of public files:

the license master file of the California Contractors State License Board (CSLB), with its workers’ compensation and personnel files; and
the licensee files of the Florida Department of Business and Professional Regulation (DBPR).

We are not a state licensing board. We do not license or approve contractors. We are not an insurance agency or a surety, and we do not sell bonds or insurance.

3. People named in the public license files

This section is for you if your name, business or contact details appear in the CSLB or DBPR files, even if you have never visited Subcheck. The GDPR asks us to tell you this when we did not get the data from you (Article 14 GDPR). Writing to each of the hundreds of thousands of people in the files would take a disproportionate effort, so we publish this information here instead (Article 14(5)(b)).

What we publish

From the California files, for each license:

the license number, status, classifications, issue and expiration dates;
the business name, address and phone number on the license (for a sole owner, this can be a personal name, home address or personal phone);
the bond company and amount, and the workers’ compensation carrier, policy number and dates (we also store the bond number from the file, but do not show it);
the people currently listed on the license: their name, title (for example owner, officer or qualifier) and the classification they qualify for.

We drop people whose link to a license has ended (people with a disassociation date in the file).

From the Florida files, for each license: the licensee’s name, the business they qualify, address, license type, status and dates. The Florida files have no phone, bond or workers’ compensation data.

Where it comes from

Only from the public files the two state agencies publish for download. CSLB publishes its files on its data portal. DBPR publishes its files on its public records pages. We load California files about once a day and Florida files about once a week.

Why we use it, and our legal basis

We publish the records so that general contractors, homeowners and others can check a contractor’s license, bond and insurance before they hire, and get told when that changes. Our legal basis is legitimate interest (Article 6(1)(f) GDPR): our interest and the public’s interest in checking who is licensed, which is the reason the states publish these records.

We weighed that interest against your interests. These points made us conclude that publishing is fair:

We show only what the state already publishes for the same purpose.
We show only current people on a license, not former ones.
We do not add data from other sources. We have no pages about a person; every page is about a license.
Of the about 245,000 California license pages, only a selected set of 5,000 is open to search engines. Every other California license page, and every Florida license page, asks search engines not to index it.
You can object, and we will remove your name from our pages (see below).

Who sees it

Anyone who visits our pages, because the pages are public.
Anyone who searches Subcheck by license number, business name or a person’s name.
Search engines such as Google and Bing, for the 5,000 pages open to indexing.
Users who watch a license. Their change emails can name people added to or removed from that license.
Our hosting provider, Cloudflare (section 6).

How long we keep it

We mirror the latest state file. When a license or a person leaves the file, the next import removes it from our pages and database. For licenses that users watch, we also keep a short history of changes, so we can tell them what changed. We keep that history for 12 months after each change, and delete it when nobody watches the license any more.

How to get a record corrected

We copy the state file as it is. We cannot change what CSLB or DBPR publish. If a record is wrong, ask the agency to correct it:

California: Contractors State License Board, cslb.ca.gov.
Florida: Department of Business and Professional Regulation, myfloridalicense.com.

Once the agency corrects its file, our pages show the correction after the next import. If our page shows something different from the current state record, write to us and we will check it.

Your right to object and to have your name removed

You can object to our use of your data at any time (Article 21 GDPR). Write to support@getsubcheck.com with the license number and the name you want removed. We will remove your name from our pages and from search results on Subcheck within 30 days, unless we have compelling reasons to keep it that outweigh your interests, or we need it for a legal claim. If we decide not to remove it, we will tell you why.

We keep a short record of the request (your name and the license number) so the next import does not publish your name again. Removing your name from Subcheck does not remove it from the state’s own records or from other websites.

You also have the other rights in section 9.

4. People who use Subcheck

The table lists each thing we do with users’ data. Retention for each is in section 8.

Purpose	Data	Legal basis	Who receives it
Account and sign-in. We email a sign-in link that works for 15 minutes. The first link creates your account; there is no separate sign-up.	Email address; a name field (left empty, because we do not ask for a name); sign-in link token; session records with IP address and browser user agent.	Contract (Article 6(1)(b)). IP address and user agent: legitimate interest in keeping accounts secure (Article 6(1)(f)).	Cloudflare (hosting and email sending).
Watchlist and change emails. You add license numbers, by hand or by uploading a list. Each day we compare the new state file and email you what changed.	Your email address; the license numbers you watch; copies of the change emails we sent (recipient, subject, text).	Contract (Article 6(1)(b)).	Cloudflare (hosting and email sending).
Pro subscription. Pro costs $29 a month. Payment runs through Polar, our merchant of record.	We send Polar your email address, our user ID and, if your browser kept one, the attribution record described in section 5. Polar sends us your customer ID, subscription ID, subscription status and the end of the current billing period. We never see your card details.	Contract (Article 6(1)(b)).	Polar Software, Inc. (see section 6).
Quote requests. On some California license pages, a license holder can ask a licensed agent for bond, workers’ compensation or liability insurance quotes.	Your name, email address and optional phone number; the license number; the kind of quote; the reason from the state file (for example a bond suspension); the time of the request.	Your consent, given by ticking the box on the form (Article 6(1)(a)). You can withdraw it at any time; this does not affect what was done before.	Cloudflare (hosting and email sending), our own mailbox, then a licensed insurance agent we work with, who will contact you.
Support. When you email us.	Your email address and what you write.	Contract (Article 6(1)(b)), or legitimate interest in answering people who are not users (Article 6(1)(f)).	Our email provider.
Running and protecting the site.	IP address, browser user agent and request details that every web request carries.	Legitimate interest in a working, secure site (Article 6(1)(f)).	Cloudflare.
Website analytics. We measure which pages and features are used, so we can improve Subcheck. Details in section 5.	Page addresses with license numbers and search words removed; the referring website; campaign parameters and click identifiers; the type of page and what you did on it; device class, browser and operating system; country and city worked out from a shortened IP address; a random trace identifier; our user ID for your account if you are signed in.	Legitimate interest in knowing how the site is used (Article 6(1)(f)).	OpenPanel AB (Sweden).

You do not have to give us any data to search Subcheck. You need an email address for an account, and a name and email address for a quote request. Without them, we cannot provide those features.

We do not send marketing emails. Every email we send is a sign-in link, a change email you asked for, or a reply to you. Every change email has an unsubscribe link, and you can remove licenses from your watchlist at any time.

We do not use your data for automated decisions that have legal or similarly large effects on you.

About quote requests: we pass your request to a licensed insurance agent we work with only after you tick the consent box. We do not check that the person asking is the license holder. Nothing you enter is shown on the license page.

5. Cookies and tracking

We set one cookie: a sign-in cookie that keeps you signed in for up to 7 days. It is strictly necessary for the account, so we do not ask for consent for it. If you do not sign in, we set no cookie.

If you pick Light or Dark at the bottom of a page, your browser’s storage keeps that choice so the next page opens the same way. It is not a cookie and is never sent to us. Auto, the default, follows your device setting and stores nothing.

Website analytics

We measure how Subcheck is used with OpenPanel, an analytics tool that sets no cookies. It shows us which pages people visit, whether searches find a license, and how many visitors watch a license, sign in or start Pro. We use it to improve the site.

An analytics event can contain:

the page address, with license numbers replaced and search words removed (only campaign parameters such as utm_source stay);
the referring website (for other sites, only the site’s address);
campaign parameters and Google click identifiers from the link you followed;
the type of page (for example a license page or the lookup), the kind of search (license number, business name or person’s name) and whether it found a match, but never what you typed;
what you did, for example pressing Watch, asking for a sign-in link, uploading a list, copying a badge or seeing the quote form;
device class (phone, tablet or computer), browser and operating system;
your country and city, which OpenPanel works out from a shortened IP address;
if you are signed in, our random user ID for your account.

Our server also records some events itself: when a sign-in finishes, a license is added to a watchlist, a change email is sent, a subscription starts or ends, a quote or name request is sent, someone unsubscribes, or an account is deleted. These events carry the same kinds of data and the user ID.

We never send OpenPanel your email address, the names of people from the license files, the license numbers you look at or watch, what you write in a form, or your full IP address. Our server removes the last part of your IP address before the event reaches OpenPanel. OpenPanel uses the shortened address to work out a country and city and to tell visitors apart, and does not store it.

To see which page brought you to Subcheck, the site keeps a small attribution record in your browser’s storage: the first page you landed on, the referring website, campaign parameters and click identifiers from the link you followed, and a random trace identifier. It is not a cookie. It is sent with analytics events and, when you start Pro, with your checkout to Polar. You can remove it by clearing this site’s data in your browser.

Our legal basis is legitimate interest (Article 6(1)(f) GDPR): our interest in knowing which pages and features work, so we can improve Subcheck. We collect no names, email addresses or full IP addresses and set no cookie for it, so we think the effect on you is small. You can object at any time by writing to us. You can also block analytics in your browser, for example with a content blocker, and clear the attribution record.

OpenPanel AB (Stockholm, Sweden) processes the events for us under its data processing agreement and stores them in the EU. Provider policy: OpenPanel.

We use no advertising tools and no tracking pixels. Fonts and images load from our own domain.

6. Who receives data

We share data only with the parties below, and only for the purposes in this policy.

Cloudflare, Inc. (United States) hosts the site and the database (Cloudflare Workers and D1) and sends our emails (Cloudflare Email Service). It processes data for us under its data processing terms. Cloudflare’s privacy policy.
OpenPanel AB (Sweden) runs our website analytics (section 5) and stores the events in the EU. It processes data for us under its data processing agreement. OpenPanel’s privacy policy.
Polar Software, Inc. (United States) sells the Pro subscription as merchant of record. It handles checkout, payment, tax and invoices, and is its own controller for that data. Its buyer terms and privacy policy apply to the purchase.
A licensed insurance agent we work with receives quote requests you send. It is its own controller for the data it receives.
Search engines and the public see the public license pages described in section 3. They never see account, watchlist or quote data.
Authorities, where the law requires us to share data.

We do not sell personal data.

7. Transfers outside the EU

We are based in the Netherlands. Cloudflare, Polar and a licensed insurance agent we work with may process data in the United States. For Cloudflare, the transfer relies on the EU-US Data Privacy Framework where the company is certified, and on the European Commission’s standard contractual clauses in its data processing terms. Polar and a licensed insurance agent we work with receive your data because you ask for their service (a purchase or a quote), which is needed to perform that request (Article 49(1)(b) GDPR). OpenPanel stores analytics events in the EU, so no transfer applies to them. Write to us for a copy of the safeguards.

8. How long we keep data

Data	How long
Account (email address, name field)	Until you delete your account. If you have not signed in for 24 months, we email you, and delete the account 30 days later unless you sign in.
Sign-in links	Valid for 15 minutes. Deleted when used, or within 1 day after they expire.
Sessions (with IP address and user agent)	Valid for 7 days. Deleted 30 days after they expire, and when you delete your account.
Watchlist	Until you remove a license or delete your account.
Copies of change emails	90 days, or until you delete your account, whichever comes first.
History of changes to watched licenses	12 months after each change, and deleted when nobody watches the license any more.
Subscription status	Until you delete your account. Polar keeps its own payment and tax records for as long as the law requires it to.
Quote requests	12 months after the request, so we can answer questions about it. A licensed insurance agent we work with keeps its copy under its own policy.
Support emails	24 months after the last message.
Request data (IP address, user agent)	We keep no request logs of our own. Cloudflare processes request data under its own retention rules.
Analytics events	24 months in OpenPanel, then deleted.
Attribution record in your browser	Until you clear this site’s data in your browser.
Light or dark choice in your browser	Until you pick Auto or clear this site’s data in your browser.
Public license records	Until they leave the state file (section 3).
Removal requests from people in the files	As long as we publish the state file, so the name stays off our pages.

When you delete your account, we delete your account, sessions, watchlist, subscription status and copies of your change emails. Deleting your Subcheck account does not cancel a Pro subscription at Polar by itself; cancel it first under Manage billing.

9. Your rights and how to use them

Under the GDPR you have the right to:

access the data we hold about you and get a copy;
correct data that is wrong (for public license data, see how to get a record corrected);
delete your data. Users can delete their account on the Account page at any time;
restrict our use of your data while we check a complaint;
receive the data you gave us in a common format (data portability);
object to any use based on legitimate interest, including publishing your name from a license file;
withdraw consent for a quote request at any time.

To use a right, email support@getsubcheck.com. Tell us which right you want to use, and give the license number if your request is about a license record. We may ask you to confirm your identity, usually by replying from the email address on your account. We answer within one month. If a request is complex, we may take two more months and will tell you why.

If you think we handle your data wrongly, please write to us first. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work in the EU.

10. California privacy rights

This section is for California residents. It follows the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). We give these rights to every California resident, whether or not the CCPA’s size thresholds apply to us.

License records are not covered by the CCPA. The CCPA does not treat information lawfully made available from government records as personal information. The CSLB and DBPR data we publish is such information. You can still ask us to remove your name under section 3.

What we collected in the last 12 months, from you or from Polar:

Identifiers: email address, a name if you gave one, IP address, account ID, a random trace identifier.
Commercial information: your plan and subscription status.
Internet activity: sign-in sessions with browser user agent, and the pages you view and the actions you take on Subcheck (see section 5). We do not track you on other websites.
Professional information: the license numbers you watch, and for a quote request your name, phone number and license number.

We collect no sensitive personal information as the CCPA defines it.

Why we use it, and who receives it: see section 4 and section 6. Cloudflare and OpenPanel receive data as our service providers. Polar receives data to process the purchase you start. A licensed insurance agent we work with receives a quote request only when you tick the box that tells us to send it.

No sale or sharing. We do not sell personal information. We do not share it for cross-context behavioral advertising. When you tick the box on a quote request, you direct us to send your details to a licensed insurance agent we work with; the CCPA does not count a disclosure the consumer directs as a sale. We have no knowledge of selling or sharing data of anyone under 16.

How long we keep it: see section 8.

Your rights. You can ask us to:

tell you what personal information we collected, used and disclosed about you, and give you a copy;
delete it;
correct it.

We will not treat you differently, charge you more or give you a lower service because you used a right.

How to make a request. Email support@getsubcheck.com with the subject “California privacy request”. We confirm receipt within 10 business days and answer within 45 days. We verify your request by checking that it comes from the email address on your account, or by asking for details that match our records. An authorized agent can make a request for you with your signed permission; we may ask you to confirm the request with us directly.

11. Security

All connections to Subcheck use HTTPS. Sign-in uses one-time links instead of passwords, so we store no passwords. Access to the database and the hosting account is limited to the operator. Payment card data never reaches us; Polar handles it.

12. Children

Subcheck is a tool for contractors and the people who hire them. It is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

13. Changes to this policy

We will update this policy when Subcheck’s data handling changes. The effective date at the top shows the current version. If a change affects how we use account holders’ data, we will email them before it takes effect.

Questions: support@getsubcheck.com