Privacy Policy

WHAT INFORMATION DO WE COLLECT?

Account Information

When you sign up, we collect the personal information you provide to create and secure your account: your name,email address, and, if you tell us, how you heard about WhoSubscribed. If you sign in using Google orApple, we receive your name, email address, and profile picture from that provider — see 'HOW DO WE HANDLE THIRD-PARTY LOGINS?' below. We do not collect or store passwords ourselves; authentication is handled by our identity provider, Supabase.

Organisation & Subscription Data

WhoSubscribed helps you track the software subscriptions your organisation pays for. To provide this, we store the information you and your teammates enter directly into the product, including:

• Organisation profile. Name, website, industry, country, timezone, size, currency, and logo.
• Subscription records. Vendor name, cost, currency, billing frequency, trial details, billing email, notes, and which department or payment method a subscription is linked to.
• Payment method labels. A nickname, bank name, and last 4 digits you enter to identify which card or account pays for a subscription. This is descriptive metadata only — we never collect or store full card or bank account numbers.
• People you track. If you assign a subscription to a colleague, we store that person's name and email address as provided by you. These individuals do not log in or have an account with us.
• Teammate invitations. The email address and role of anyone you invite to join your organisation on WhoSubscribed.

You are responsible for ensuring you have the right to share information about your colleagues (such as their name and email) with us for the purpose of using the Services.

Payment Data

If you upgrade to a paid plan, we use Stripe to process your payment. We share your email address and account identifier with Stripe to set up billing; your card details are entered directly into Stripe's secure checkout and never touch our servers. You can review Stripe's privacy notice here: https://stripe.com/privacy.

Information You Send Us

If you contact us for support or otherwise, we collect the information you choose to include in that communication, such as your email address and the content of your message.

Information Automatically Collected

Like most web services, our infrastructure and hosting providers automatically log limited technical information when you use the Services, such as your IP address, browser type, device and operating system information, and timestamps of requests. This is used to keep the Services secure, diagnose issues, and maintain normal operation. We do not use this information to build advertising profiles, and we do not currently use any analytics or advertising tracking tools on the Services.

HOW DO WE PROCESS YOUR INFORMATION?

We process your information for the following purposes:

• To create and secure your account, including authenticating you and keeping your account in working order.
• To provide the Services, including storing your organisation's subscriptions, generating dashboards and spend summaries, and showing who owns each tool.
• To send renewal, trial, and spend alerts via email, an in-app notification, or a Slack webhook you connect.
• To process payments and manage your subscription plan via Stripe.
• To power our AI assistant, "Ask the Owl," when you choose to use it — see 'DO WE OFFER AI FEATURES?' below.
• To respond to your support requests and communicate with you about your account.
• To keep the Services secure, including detecting and preventing fraud or abuse.
• To improve the Services, by understanding, in aggregate, how the product is used.

DO WE OFFER AI FEATURES?

WhoSubscribed includes an optional AI assistant, "Ask the Owl," that answers questions about your organisation's own subscription and spend data (for example, upcoming renewals, monthly forecasts, or spend by department). When you use it, we send your message and the relevant subscription data needed to answer it — such as renewal dates, costs, or the names of people subscriptions are assigned to — to our AI provider, OpenAI, to generate a response. Ask the Owl only answers questions about data already in your account; it does not take actions on your behalf.

Under OpenAI's API terms, data submitted through its API is not used to train OpenAI's models. You can read more in OpenAI's Privacy Policy.

WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

We do not sell your personal information. We share information only with the following service providers, and only as needed to operate the Services:

• Supabase — authentication and account sign-in.
• Stripe — payment processing and subscription billing.
• OpenAI — powering the "Ask the Owl" AI assistant, when used.
• Amazon Web Services (SES, S3) — sending transactional emails and storing uploaded files such as logos and profile pictures.
• Cloudflare — hosting our website and content delivery.
• Slack — if you choose to connect a Slack webhook for alerts, we send only the notification content (such as a renewal reminder) to the webhook URL you provide, which posts to your own Slack workspace.

We may also share information:

• In a business transfer. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• When required by law, to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

HOW DO WE HANDLE THIRD-PARTY LOGINS?

Our Services let you register and sign in using a third-party account, such as Google or Apple. Where you choose to do this, we receive basic profile information from that provider — typically your name, email address, and profile picture. We use this information only to create and authenticate your account. We do not control, and are not responsible for, the privacy practices of these third-party providers; we recommend reviewing their privacy notices directly.

DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?

We use only the storage technologies necessary to run the Services — for example, keeping you signed in and remembering which organisation you have selected. This information is stored in your browser's local storage rather than third-party tracking cookies. We do not use advertising or analytics cookies, and we do not permit third parties to track you across our Services for advertising purposes.

HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your account, organisation, and subscription data for as long as your account is active, or as needed to provide the Services to you. In-app notifications and notification delivery logs are automatically deleted after 90 days.

To request deletion of your account and associated data, contact us at support@whosubscribed.com. Deleting an account removes the associated organisation data, subscriptions, payment method labels, tracked people, and invitations, except where we are required to retain limited records to comply with legal, tax, or accounting obligations.

HOW DO WE KEEP YOUR INFORMATION SAFE?

We use appropriate technical and organisational measures to protect your information, including encrypting data in transit and at rest. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Transmission of information to and from our Services is at your own risk.

INTERNATIONAL DATA TRANSFERS

Our service providers, including Supabase, Stripe, OpenAI, and Amazon Web Services, may process and store information in countries other than your own, including the United States. Where we transfer information internationally, we rely on appropriate safeguards required by applicable data protection laws.

DO WE COLLECT INFORMATION FROM MINORS?

WhoSubscribed is a business tool intended for founders, operators, and finance teams, and is not directed at or intended for use by individuals under 18. By using the Services, you represent that you are at least 18 years old. If you believe we have collected information from someone under 18, please contact us atsupport@whosubscribed.comand we will take steps to delete it.

WHAT ARE YOUR PRIVACY RIGHTS?

Depending on where you live, you may have rights under applicable data protection laws, such as the GDPR in the European Economic Area or the CCPA in California, including the right to:

• Access the personal information we hold about you.
• Correct inaccurate information, which you can also do directly from your account settings.
• Request deletion of your personal information.
• Request a copy of your personal information in a portable format.
• Object to or restrict certain processing of your information.

We do not sell personal information. To exercise any of these rights, contact us atsupport@whosubscribed.com. We may need to verify your identity before fulfilling your request.

Marketing communications. You can unsubscribe from marketing emails at any time using the unsubscribe link included in those emails. We will still send you service-related emails, such as renewal alerts or billing notices, that are necessary for operating your account.

DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised 'Last updated' date at the top of this notice. If we make material changes, we will notify you by posting a notice on our Services or by emailing you directly.

HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, email us atsupport@whosubscribed.com.