Last updated 13 October 2026
Privacy policy
Who we are
[Controller name or company], [Postal address, Portugal], is the controller of your personal data. For any privacy question or request, write to privacy@[your-domain].
What we collect and why
- Account: name, email and a hashed password. Needed to give you an account (contract, Art. 6(1)(b) RGPD).
- Your subscriptions: the names, prices, categories and renewal dates you type in, and your reminder settings. This is the service itself (contract).
- Sign-in sessions: IP address and browser user agent for each active session. Used to keep your account secure and to limit abuse (legitimate interest, Art. 6(1)(f)).
- Payments (Premium only): Stripe handles your card; we never see it. We keep the amount, status and date of each payment (contract and legal obligation, Art. 6(1)(c)).
- Statistics: anonymous page views through Plausible, without cookies or personal identifiers (legitimate interest).
We don't sell your data, don't use it for advertising and don't make automated decisions about you. Only the people running SubTrack can see account data, and only to operate the service.
Cookies
One cookie keeps you signed in. It is strictly necessary, so it doesn't need consent. There are no tracking or advertising cookies.
How long we keep it
- Account, subscriptions and settings: until you delete your account.
- Expired sessions: removed within a day of expiring.
- Invoices: kept by Stripe for as long as Portuguese tax law requires (up to 10 years), even after you delete your account.
Who processes it for us
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting and server logs | EU (Frankfurt), US company | EU-US Data Privacy Framework / SCCs |
| Neon (Databricks Inc.) | Database | EU (AWS Frankfurt), US company | EU-US Data Privacy Framework / SCCs |
| Stripe Payments Europe Ltd. | Payments (Premium only) | Ireland, with transfers to the USA | SCCs |
| Twilio SendGrid | Reminder emails | USA | EU-US Data Privacy Framework / SCCs |
| Plausible Insights OÜ | Cookieless page-view statistics | EU (Germany) | Not applicable |
Your rights
You can access, correct, export or delete your data, restrict or object to its processing. Two of these are one click away in Settings: “Download my data” and “Delete account”. For anything else, email us and we'll answer within one month.
You can also complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).