Privacy Policy

Last updated: October 2026

Submeto is operated by AlphaBlue Thailand, located at 187/50 Moo 5, Choeng Noen Subdistrict, Mueang Rayong District, Rayong Province 21000, Thailand. AlphaBlue Thailand is the controller for account and service-operation personal data; our role for customer form submissions is described below.

1. Information We Collect

When you create an account, we collect your name, email address, and payment information (for paid plans). We also collect form submission data that your end users submit through your forms hosted on Submeto.

This includes submissions received through our submission endpoints and Hosted Forms, attachments, and results from Workflows you configure. We process request metadata such as IP addresses and user agents for operation and security. When you use our mobile app, we process installation identifiers, platform information, push tokens, and registration activity to manage notifications. Mobile sign-in also uses Firebase App Check to verify app requests.

2. How We Use Your Information

We use your information to:

  • Provide and maintain the Submeto service
  • Process form submissions and deliver them to you
  • Send service-related notifications and updates
  • Process payments for paid plans
  • Improve our service and develop new features

3. Data Storage and Security

Our backend is hosted on OVH VPS infrastructure in Singapore. Cloudflare provides frontend hosting and email sending services. This is not an EU-only hosting service; other processing locations depend on the services and integrations involved.

We use HTTPS for public connections, account access controls, encrypted integration credentials, and encrypted backup copies. Access to account data and exports is restricted to authorized users. These measures reduce the risk of unauthorized access, alteration, disclosure, or loss.

4. Form Submission Data

Submeto acts as a data processor for form submissions. You (the form owner) are the data controller. We store submission data only for the purpose of providing our service to you. You can delete submissions at any time from your dashboard.

5. Third-Party Services

We may use third-party services for payment processing, email delivery, infrastructure, authentication, and connected integrations. These services have their own privacy policies and handle data in accordance with their terms.

If you configure an AI step, the selected input is sent through OpenRouter to an upstream model provider. Requests require zero-data-retention routing and disallow provider data collection; this does not mean processing occurs only in your country. If you enable app push notifications, Expo and the device push service receive a notification containing the Form name and identifiers, but not submission field values. Configured delivery integrations receive the content needed to perform the delivery. Copies delivered to your own services or downloaded by you are managed by you.

6. Google User Data

When you sign in with Google, Submeto receives your name, email address, and a stable Google account identifier for authentication. If you separately connect Google Sheets, Submeto uses the Google Drive file scope to access only spreadsheets that you explicitly select through Google Picker. We use that access to list worksheets and append form submissions to the worksheet you configure, including asynchronous delivery while you are offline.

We store encrypted Google OAuth credentials, the selected spreadsheet ID, and the worksheet name for as long as the connection is active. We do not browse or access Drive files you have not selected, sell Google user data, use it for advertising or AI model training, or transfer it to unrelated third parties. You can disconnect Google in the Submeto Dashboard or revoke access from your Google Account. Disconnecting removes the connection credentials and saved connection metadata from Submeto. An accepted account-deletion request immediately revokes the connection and targets its online credentials and metadata for removal within 30 days.

Submeto's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

7. Analytics

Google Analytics collection is disabled on our marketing website and dashboard. Operational and security records are still used to provide and protect the service.

Enabling optional analytics in the future will require an appropriate notice and consent mechanism where required.

8. Cookies

We use essential cookies and local storage for authentication, security, session management, and preferences. This version does not load Google Analytics or set new Google Analytics cookies.

9. Your Rights

You have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Export your data in a portable format
  • Object to data processing
  • Request restriction of processing where applicable
  • Withdraw consent where processing relies on consent
  • Lodge a complaint with a competent data protection authority

You can contact [email protected] to exercise applicable rights. We may need to verify your identity and clarify the request to protect other people's data. For data submitted to a customer's Form, contact that Form's owner as the controller; we assist with requests under their instructions. Account submission exports are a product feature, not a complete response to every personal-data access request. Their frequency limits do not replace your applicable data protection rights.

10. Data Retention

Each Form has a fixed submission-retention period. Available periods are 7, 30, 90, 365, and 730 days; accounts with active Paid access may also choose 1,095 or 1,825 days. New Forms default to 730 days. Automatic expiry cleanup is not active yet; we will announce its activation before it begins. When enabled, eligible submissions, attached files, and associated production AI output will be removed by the next successful daily cleanup run after the selected period expires.

You can create a private account-level export from Dashboard Settings before data expires. Account exports are limited to one per rolling 7 days and four per rolling 30 days, and generated files expire after 24 hours. Per-Form CSV export remains available for routine use.

When you confirm account deletion using an email verification code, access, Forms, API Keys, exports, Paid access, and remaining compute points are disabled immediately. We target removal of online account and product data within 30 days. Pseudonymized records needed for refunds, tax, accounting, fraud prevention, or legal obligations may be retained for at least five years. Encrypted backup copies expire through their normal protected rotation and are subject to deletion replay before restored data can be made available.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

For privacy questions or personal-data requests, contact AlphaBlue Thailand at[email protected], handled by designated internal company staff, or write to the address above.