SUBLIMIT
Your data, and where it stays.
SubLimit, a product of Profitpin LLC (Colorado). Effective September 15, 2026. Questions: support@getsublimit.com
Summary
This policy explains what Profitpin LLC collects when you visit getsublimit.com, subscribe to SubLimit, run the App, or contact support, and what we do with it.
What the App does — and doesn't — send
SubLimit runs on your Windows computer and processes your files there. It does not upload your payroll, subcontractor, receipt, or contract files, worker or vendor names, amounts, reports, drafts, or history to us or to anyone else. Those stay in the workspace on your computer and wherever you save exports and backups. The App contains no analytics, telemetry, or crash reporting.
The App talks to our license service only for activation. When you sign in it sends your email address and the one-time sign-in code you received; when it enrolls the computer it sends a random installation identifier; and about every twelve hours while open, it presents the device credential it was issued to refresh your signed access. Each request carries your computer's IP address, as every internet request does. Nothing about your workforce or contracts is included. Computers without internet access can instead import an activation file we issue by email.
What our license service keeps
Our license service, hosted on Render in the United States, keeps a small database so it can recognize your subscription: your email address; a hashed (not readable) form of sign-in codes and device credentials; sign-in session records; your Stripe customer and subscription identifiers; the random installation identifiers of your two enrolled computers; and copies of the signed activation files it issued and when. It also keeps ordinary server logs — request time, path, and IP address — for a short period for security and troubleshooting.
Sign-in codes are emailed from support@getsublimit.com. A code expires after ten minutes and can be used once.
Subscribing and payment
Checkout and billing are handled by Stripe. Stripe collects your name, email address, billing address, and card details directly; we never see your full card number. From Stripe we receive and keep: your email address, your Stripe customer and subscription identifiers, the subscription's status (trialing, active, past due, cancelled), billing dates, and invoice and payment references used to confirm a paid period. We use this to run your subscription, issue your activation, answer support requests, and send the emails described below.
Emails we send
Transactional only: sign-in codes, your receipt and invoices (from Stripe), a reminder before your free month ends, failed-payment notices, notices about changes to price or terms, and replies to your support requests. We don't send marketing newsletters. You can't opt out of transactional emails while subscribed, because they're how you sign in and how we tell you about charges.
The website
getsublimit.com is a static site hosted on GitHub Pages. GitHub keeps standard access logs (IP address, browser, pages requested) under GitHub's privacy statement. We don't set analytics cookies or use advertising trackers. The Windows installer is downloaded from our license service on Render, which logs the request like any web server. The website does not accept workforce files or payments.
Data on your computer
The workspace retains configuration, identity mappings, imported source evidence, historical reports, and saved staffing drafts needed to reproduce and explain calculations. Report packages, Word drafts, original input spreadsheets, and backups may also exist wherever you saved them. Uninstalling SubLimit preserves your data.
Protected workspaces encrypt the managed archive with a password you choose; explicit report and Word exports are ordinary unencrypted files. A protected workspace does not protect an unlocked computer, memory, or files opened in other applications. SubLimit cannot recover a forgotten password — keep workspace and backup passphrases in your organization's approved password storage and test restores before relying on a backup.
There is no automatic retention timer or purge. Your organization chooses retention and deletion for its contract records. When authorized to retire a workspace, close SubLimit, verify any backup you must retain, and remove the folder using your organization's device-management process; separately account for exports, drafts, backups, synchronized copies, and the Recycle Bin. Ordinary file deletion is not secure erasure, and SubLimit does not implement secure erasure or a record-by-record purge.
Support
If you email support@getsublimit.com, we keep the conversation so we can help you and follow up. Please don't send worker records, unredacted screenshots, workspace archives, passwords, sign-in codes, or card numbers — describe the issue with fictional examples and the software version. Our mailbox is hosted by our email provider under its own privacy terms.
Retention and deletion
Subscription records stay with your Stripe customer record and our license database for as long as you're a customer and afterwards as long as tax and accounting rules require (generally seven years for payment records). Sign-in sessions expire within a day. Server logs are kept for weeks, not years. Support email is kept while relevant.
To delete your account data, cancel your subscription and email support@getsublimit.com from your subscription address; we'll delete what we're not legally required to keep and confirm. Data on your own computer is yours to delete — uninstalling the App does not remove your workspace.
Your rights
You can ask us what personal information we hold about you, ask us to correct or delete it, and ask for a copy. Email support@getsublimit.com. Residents of California and other states with privacy laws have additional rights under those laws; we honor them for everyone. We don't discriminate against you for exercising them.
SubLimit is a business product and isn't directed at children under 16; we don't knowingly collect their information.
How we protect it
All traffic between the App, the website, the license service, and Stripe is encrypted (HTTPS). Sign-in codes and device credentials are stored hashed; on your computer the device credential is protected with Windows data protection. The license service reads Stripe using a restricted API key limited to the operations it needs and verifies every webhook signature. Card data is entered on Stripe's pages and handled under Stripe's PCI DSS certification. No system is perfectly secure, and the data on your own computer is protected by you.
California and other state notices
In the past 12 months we have collected these categories of personal information: identifiers (name, email, Stripe customer ID, installation identifiers, IP address) and commercial information (subscription status and billing history). We collect them directly from you and from Stripe, use them only for the purposes above, and share them only with the service providers listed. We do not sell or "share" personal information for cross-context behavioral advertising, and we don't use sensitive personal information. You may exercise the rights above by email; we'll verify a request by replying to the address on your subscription. You may authorize an agent to act for you. Our website doesn't respond to browser "Do Not Track" signals because it doesn't track visitors.
Where data is kept
Our service providers store data in the United States. If you use SubLimit from outside the US, you're sending your subscription information to the US.
Changes to this policy
We'll post updates here and, for material changes, email the address on your subscription. The effective date at the top tells you which version you're reading.
Contact
Profitpin LLC · support@getsublimit.com