Privacy policy

Who we are

Subscriptrack is operated by mybakht Ltd, a company registered in England and Wales, United Kingdom ("we", "us"). We are the data controller for the personal data described here. Contact: privacy@subscriptrack.com.

What we collect

• Account data: your email address, password hash (or Google sign-in identifier), chosen currency and settings.
• Receipts you forward to your private Subscriptrack address, or that we fetch from an inbox you connect (Outlook / Microsoft 365). From a connected inbox we only read messages that look like receipts, invoices or subscription notices; other messages are not stored.
• Card or bank statements you upload yourself (PDF or CSV).
• The subscription records we derive from the above: merchant, plan, amount, currency, billing period, renewal date.
• Billing data: your plan, invoices and payment status. Card details are held by Stripe, not by us.
• Technical data: IP address, browser type and basic usage logs needed to run and secure the service.

How we use it

• To build and keep your subscription list up to date and to send the alerts you choose (renewals, trial expiry, price rises).
• To operate your account, take payment and respond to support requests.
• To keep the service secure and prevent abuse.

We rely on performance of a contract (providing the service you signed up for), our legitimate interests (security, service improvement) and, for a connected inbox, your consent, which you can withdraw by disconnecting it.

We do not sell personal data and we do not show advertising.

Processors we use

• Vercel — application hosting and scheduled jobs.
• Supabase — database, file storage and authentication.
• Stripe — payments and invoicing.
• Anthropic — AI extraction of subscription details from receipt text. Content sent for extraction is not used to train models.
• Microsoft Graph — only if you connect an Outlook / Microsoft 365 inbox, to read receipt emails.
• SendGrid — sending transactional email such as alerts and sign-in links.

Each processor acts under a data processing agreement. Some are located outside the UK and EEA; transfers are covered by UK and EU standard contractual clauses or an adequacy decision.

Retention

We keep your data for as long as your account exists. When you delete your account, receipts, statements, derived records and account data are removed from live systems immediately and from backups within 30 days. Invoice records are kept for six years as required by UK tax law.

To stop repeat free trials we keep a one-way hash of your email address and of your card fingerprint from Stripe, even after you delete your account. Neither can be turned back into your email or card number. We delete the text of emails and the files you upload 30 days after import, or sooner if you delete your account. The subscriptions and payment history read from them stay until you delete them or your account.

Your rights

Under UK GDPR and the EU GDPR you can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent. You can export your subscription list and delete your account yourself in the app, or email us for anything else. You also have the right to complain to the UK Information Commissioner's Office or your local supervisory authority.

Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to staff who need it and is logged.

Cookies

We use only strictly necessary cookies: your session, and a short-lived security cookie while you connect an Outlook inbox. There are no tracking or advertising cookies.

Your light or dark theme preference is stored in your browser's local storage, not in a cookie.

Changes

If we change this policy in a way that matters, we will email account holders before it takes effect. The date at the top shows the current version.