Privacy Policy

WHAT INFORMATION DO WE COLLECT?

Account Information

When you sign up, we collect the personal information you provide to create and secure your account: your name and email address. If you arrived through a referral or partner link, we also save the referral code from that link with your account (see 'DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?' below). We also record when your account was created and last updated.

You can sign in with a one-time code sent to your email, or with Google or Apple. Sign-in is handled by our identity provider, Supabase. There are no passwords, so we never see or store one. If you use Google or Apple, we receive only your name and email address - see 'HOW DO WE HANDLE THIRD-PARTY LOGINS?' below.

When you sign in for the first time, a sign-in record containing your email address is created with Supabase. Your WhoSubscribed account is created on the next step, when you complete your profile and click Continue - this is where you agree to our Terms of Service and this Privacy Notice. If you decide not to continue, you can delete that sign-in record yourself from the same screen using Delete Account.

Organisation & Subscription Data

WhoSubscribed helps you track the software subscriptions your organisation pays for. To provide this, we store the information you and your teammates enter directly into the product, including:

• Organisation profile. Name, website, industry, country, timezone, company size, and currency.
• Subscription records. Vendor or tool name, nickname, what it is used for, cost, currency, billing frequency, start date, trial status and trial end date, billing email, notes, and which department or payment method a subscription is linked to.
• Payment records. The amount, date, status, and notes for payments you log against a subscription.
• Payment method labels. A nickname, bank name, type, and the last 4 digits you enter to identify which card or account pays for a subscription. This is descriptive information only - we never collect or store full card numbers, CVV codes, expiry dates, or full bank account numbers.
• Departments. The names of the departments you set up.
• People you track. If you assign a subscription to a colleague, we store that person's name and email address as provided by you, and which subscriptions they are assigned to. These individuals do not need a WhoSubscribed account.
• Teammates and invitations. The email address and role of anyone you invite to join your organisation, who sent the invitation, its status, and when it expires.

Information About People You Track

When you add information about colleagues or other people to WhoSubscribed, your organisation decides what is entered and why. For that information, your organisation is the controller and we act as a processor, handling it only on your organisation's behalf and to provide the Services. You are responsible for having a lawful basis to share that information with us and for letting those people know, where required. If you are one of those people and want to access or remove your information, please contact the organisation that added you; we will help them respond to your request.

Payment Data

If you upgrade to a paid plan, we use Stripe to process your payment through Stripe Checkout and the Stripe Customer Portal. This includes starting a free trial of a paid plan, which requires a card. We share your email address, account identifier, and any referral code saved with your account with Stripe to set up billing; your card details are entered directly into Stripe's secure pages and never touch our servers. We store only your billing status: your plan, subscription status, any trial end date, when the current billing period ends, and whether a cancellation is scheduled.

Free trials are limited to one per person. When you start a paid plan, we store a one-way, keyed hash of your email address - a scrambled value that cannot be turned back into your email address — so we can tell whether that email has already used a trial. You can review Stripe's privacy notice here: https://stripe.com/privacy.

Information You Send Us

If you contact us for support or otherwise, we collect the information you choose to include in that communication, such as your email address and the content of your message.

Information Automatically Collected

Like most web services, our servers and hosting providers automatically log limited technical information when you use the Services, such as your IP address, browser type, device and operating system information, and timestamps of requests. This is used to keep the Services secure, diagnose issues, and maintain normal operation. We do not use this information to build advertising profiles, and we do not use any analytics or advertising tracking tools on the Services.

HOW DO WE PROCESS YOUR INFORMATION?

We process your information for the following purposes:

• To create and secure your account, including authenticating you and keeping your account in working order.
• To provide the Services, including storing your organisation's subscriptions, generating dashboards and spend summaries, and showing who owns each tool.
• To send service emails, such as sign-in codes, invitations to join an organisation, notices that you were added to an organisation, and confirmation that your account was deleted.
• To process payments and manage your subscription plan via Stripe.
• To power AI subscription capture, when you choose to use it - see 'DO WE OFFER AI FEATURES?' below.
• To respond to your support requests and communicate with you about your account.
• To keep the Services secure, including detecting and preventing fraud or abuse.
• To comply with the law, including tax, accounting, and other legal obligations.

DO WE OFFER AI FEATURES?

WhoSubscribed offers an optional AI subscription capture feature, both when you add a subscription and during onboarding. You paste in text - for example, a bank SMS, an invoice email, or a receipt - and AI reads it to pre-fill a subscription form with details such as the vendor name, cost, date, and payment method.

To do this, we send the text you paste to our AI provider, OpenRouter, which passes it to the AI model provider we have selected. To match the text to your existing records, the AI may also receive the names of your organisation's existing subscriptions and your payment method labels (nickname, bank name, and last 4 digits), along with an internal identifier for your organisation. The text you paste may contain personal information, such as names, email addresses, partial card numbers, or amounts.

• You stay in control. You review and confirm the extracted details before anything is saved.
• We don't keep the pasted text. It is processed to produce the result and then discarded. We do not store it or write it to our logs.
• No retention or training by AI providers. We have configured OpenRouter so that your requests are only sent to model providers that do not retain the data and do not use it to train their models.
• Only paste what you need. Please do not paste full card numbers, passwords, or other sensitive details that are not needed to identify the subscription.

You can read more in OpenRouter's Privacy Policy.

WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

We do not sell your personal information. We share information only with the following service providers, and only as needed to operate the Services:

• Amazon Web Services (AWS) - hosting our servers and database, and sending emails (Amazon SES).
• Supabase - authentication and account sign-in.
• Stripe - payment processing and subscription billing.
• OpenRouter and the AI model provider it routes to - powering AI subscription capture, when used.
• Cloudflare - hosting our website and web application, content delivery, and storing public files such as images and exchange rates.
• Google and Apple - if you choose to sign in with them.

We may also share information:

• In a business transfer. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• When required by law, to comply with a legal obligation, protect our rights, or protect the safety of our users or the public.

HOW DO WE HANDLE THIRD-PARTY LOGINS?

Our Services let you register and sign in using a third-party account, such as Google or Apple. Where you choose to do this, we receive only your name and email address from that provider. If you sign in with Apple and choose Hide My Email, we receive an Apple private relay address instead of your real email address. We use this information only to create and authenticate your account. We do not control, and are not responsible for, the privacy practices of these third-party providers; we recommend reviewing their privacy notices directly.

DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?

We do not use advertising or analytics cookies, and we do not allow third parties to track you on our Services.

Referral Cookie

If you visit our website through a link that contains a referral code or campaign tags (for example, ?ref= orutm_ parameters), we set a single first-party cookie called ws_attribution. It records the referral code, campaign tags, any ad click identifier in the link, the page that referred you, the page you landed on, and when you first visited. It is not set if you visit without such a link.

The cookie is only read by WhoSubscribed and is never shared with advertising networks. When you create an account, we save only the referral code with your account and then delete the cookie. Otherwise, it expires after 30 days. You can also delete it at any time from your browser settings.

Local Storage

The web application uses your browser's local storage only for what it needs to work:

• Your sign-in session, so you stay signed in.
• A flag showing that you are signed in.
• Which organisation you currently have selected.
• Your interface preferences, such as view settings.

This information stays in your browser and is cleared when you sign out or delete your account.

HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your account, organisation, and subscription data for as long as your account is active, or as needed to provide the Services to you. You can delete your data yourself at any time from within the app:

• Delete an organisation (owners only). This permanently deletes the organisation's subscriptions and payment history, payment methods, people and their assignments, departments, and members and their access. If it is the last organisation you own, any active paid plan must be cancelled first.
• Delete your account. Available once you no longer belong to any organisation (leave or delete your organisations first), and also from the onboarding screen. This permanently deletes your profile, sign-in details, billing account, and payment history. Any active paid plan, including a free trial, must be cancelled first; deleting your account ends any remaining paid or trial period immediately, with no refund for unused days.

Deletion happens immediately when you confirm it, and you will be signed out.

After deletion, some information may remain in the following places:

• Backups. Deleted data may remain in our encrypted database backups for up to 30 days, after which it is overwritten.
• Server logs. Technical logs, which may include IP addresses or account identifiers, are rotated automatically and kept for up to 30 days. They are not individually erased when an account is deleted.
• Payment records. Invoices and payment records held by our payment provider, Stripe, may be kept for as long as tax and accounting laws require.
• Trial eligibility. If you have ever started a paid plan, the one-way hash of your email address described under 'Payment Data' is kept indefinitely, even after your account is deleted, so that free trials stay limited to one per person. It cannot be used to recover your email address.

HOW DO WE KEEP YOUR INFORMATION SAFE?

We use appropriate technical and organisational measures to protect your information, including encrypting data in transit and at rest. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Transmission of information to and from our Services is at your own risk.

INTERNATIONAL DATA TRANSFERS

We are based in Sri Lanka, and your information is processed in other countries:

• Our servers, database, and sign-in service (AWS and Supabase) are located in the United States.
• Emails are sent through Amazon SES in India.
• Cloudflare, Stripe, OpenRouter, and AI model providers may process information in the United States and other countries where they operate.

Where we transfer information internationally, we take steps to ensure it is protected as required by applicable data protection laws.

DO WE COLLECT INFORMATION FROM MINORS?

WhoSubscribed is a business tool intended for founders, operators, and finance teams, and is not directed at or intended for use by individuals under 18. By using the Services, you represent that you are at least 18 years old. If you believe we have collected information from someone under 18, please contact us at support@whosubscribed.com and we will take steps to delete it.

WHAT ARE YOUR PRIVACY RIGHTS?

Depending on where you live, you may have rights under applicable data protection laws, such as Sri Lanka's Personal Data Protection Act, the GDPR in the European Economic Area, or the CCPA in California, including the right to:

• Access the personal information we hold about you.
• Correct inaccurate information, which you can also do directly from your account settings.
• Delete your personal information, which you can also do directly in the app - see 'HOW LONG DO WE KEEP YOUR INFORMATION?' above.
• Request a copy of your personal information in a portable format.
• Object to or restrict certain processing of your information.

We do not sell personal information. To exercise any of these rights, contact us at support@whosubscribed.com. We may need to verify your identity before fulfilling your request. If your information was added by an organisation using WhoSubscribed, please contact that organisation first - see 'Information About People You Track' above.

DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised 'Last updated' date at the top of this notice. If we make material changes, we will notify you by posting a notice on our Services or by emailing you directly.

HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

WhoSubscribed is operated by Azbow (Pvt) Ltd, Sri Lanka. If you have questions or comments about this notice, email us at support@whosubscribed.com.