1. Who We Are

Data Controller: Q-CONSULT MARKETING LTD, Malta. Contact for privacy matters: privacy@subsswitch.app. General support: support@subsswitch.app.

2. Information We Collect

2.1 Account Data

You can create a SubSSwitch account using one of three methods:

• Sign in with Google — we receive your name and email address from Google.
• Sign in with Apple — we receive your name and (optionally) email address from Apple.
• Email and password — you provide your email address and create a password.

2.2 Subscription Data

Information about your recurring subscriptions (service name, billing amount, billing cycle, renewal date) that you enter manually, that we detect from connected data sources, or that you upload via a bank statement file.

2.3 Bank Transaction Data

If you connect your bank account, the connection is provided by either Plaid Financial Ltd. or TrueLayer Limited (depending on your region). We receive read-only access (Account Information Services) to your transaction data (merchant name, amount, date, category). We use this data exclusively to identify recurring subscription charges. We do not initiate payments on your behalf.

2.4 Bank Statement File Uploads

If you choose to upload a bank statement file (CSV, Excel, OFX, QFX, or PDF) instead of connecting your bank directly, the file is encrypted at the application layer using AES-256-GCM and stored in our own database, hosted in the European Union (Railway, Amsterdam). Files are never stored with a third-party file-storage provider and are never accessible via public URLs — they can only be retrieved through authenticated API endpoints after an ownership check.

Uploaded bank statement files are processed in memory to extract transactions and are never stored on our servers. The extracted transaction data is retained with the statement record for up to 90 days; subscription transactions derived from it are retained for 12 months to help you track subscription history. System logs are retained for 6 months.

Bank statement files may contain information beyond subscription data, such as your account balance, other purchases, and personal details printed on the statement. We only extract and retain subscription-related transactions; other information in the file is not stored in our production database beyond the processing described in this section.

2.5 Email Inbox Scanning (Gmail, Outlook, iCloud Mail)

If you choose to enable inbox scanning, we request access to one or more of the following:

• Gmail via Google OAuth (gmail.readonly scope)
• Outlook / Microsoft 365 via Microsoft Graph API
• iCloud Mail via app-specific password / IMAP

This is not an authentication method — it is a separate, optional feature that requires your explicit consent. Inbox scanning grants SubSSwitch read-only access to your email for the specific purpose of detecting subscription confirmations, billing receipts, and renewal notices.

We do not store email content in our database. We store only the confirmed subscription information extracted from your inbox (merchant name, subscription amount, billing date). Message bodies, subject lines, senders, and attachments are not persisted in our database.

Your inbox may contain emails from third parties (such as service providers, colleagues, healthcare providers, or financial institutions). We process these emails solely to detect subscription information and do not use this access for any other purpose.

2.6 AI Processing of Email and Statement Content

To detect subscriptions accurately, we transmit specific excerpts of email content and processed transactional text from bank statements to a third-party AI provider, Anthropic PBC (Claude Haiku 4.5), over an encrypted connection (TLS). The following limits apply to what is transmitted:

• Emails: sender field (up to 200 characters), subject (up to 300 characters), and body text (up to 8,000 characters). No attachments or full email headers are sent.
• Bank statements: only transactional lines extracted from the statement (merchant name, amount, date). Account balance, personal identifiers, and non-subscription transactions are filtered out before transmission. Text extraction and OCR of scanned statements are performed locally on our own servers — the statement file itself is never transmitted to Anthropic.

If you choose to import subscriptions by uploading a screenshot of your subscriptions list, that image is transmitted to Anthropic for extraction under the same terms. The image is processed in memory only and is never stored on our servers.

Anthropic does not use API-submitted data to train its AI models (per Anthropic's Commercial Terms of Service). Processing occurs in the United States and is governed by our Data Processing Agreement with Anthropic, including Standard Contractual Clauses (SCCs) and reference to the EU-US Data Privacy Framework.

2.7 Usage Data

Pages and screens visited, features used, session duration, device type, and approximate geographic location (country level).

3. How We Use Your Data

We use your data exclusively to:

• Provide and maintain the Service
• Detect, track, and visualize your recurring subscriptions
• Recommend alternative services (which may include affiliate offers)
• Communicate with you about your account and the Service
• Improve and develop the Service
• Comply with our legal obligations

We do not use your personal data for any other purpose. Specifically, we do not:

• Sell or rent your data to third parties
• Use your data for advertising or marketing by third parties
• Use your Gmail, Outlook, iCloud, or bank data to train artificial intelligence or machine learning models
• Allow humans on our team to read your emails, except (a) with your explicit consent, (b) where required by law, or (c) for aggregated, anonymized security and troubleshooting purposes

4. Google API Services User Data Policy

SubSSwitch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, in relation to Gmail data accessed via the gmail.readonly scope:

• We access only emails that match subscription-related patterns (sender domains, subject keywords, transactional email markers)
• We extract only the following fields per matching email: sender, subject, date, transaction amount, and merchant identifier
• We do not store the full email body or attachments in our database
• We do not transfer Gmail-derived data to any third party except (a) to Anthropic (our AI processor) under the limits described in Section 2.6, and (b) as needed to display detected subscriptions back to you in the Service
• We do not use Gmail-derived data for advertising
• We do not use Gmail-derived data to train AI/ML models
• We do not allow humans to read Gmail data except under the limited exceptions in Section 3

5. Data Protection Mechanisms for Sensitive Data

We apply the following technical and organizational measures to protect sensitive data (including Gmail data, bank transaction data, authentication credentials, and OAuth tokens).

5.1 Encryption in Transit

All data transmitted between your device, the Service, our sub-processors, and our AI processor is encrypted using TLS 1.2 or higher. Inter-service traffic within our hosting infrastructure (Railway) is additionally encrypted end-to-end using WireGuard tunnels (ChaCha20 / Curve25519 / BLAKE2s).

5.2 Encryption at Rest

Personal data is stored on infrastructure hosted in the European Union (Railway, EU West / Amsterdam region, running on Google Cloud Platform europe-west4). Database-level encryption at rest is provided by our hosting provider.

Sensitive fields — including OAuth access and refresh tokens for Google, Microsoft, Plaid, TrueLayer, and IMAP credentials — are additionally encrypted at the application layer using AES-256-GCM with a random initialization vector per record and a GCM authentication tag to prevent tampering. Uploaded files (bank statement files and profile photos) are also encrypted at the application layer using AES-256-GCM before being written to the database. Encryption keys are stored as environment variables, not in the database.

5.3 Password Storage

If you sign up directly with an email and password, your password is stored using industry-standard one-way hashing (bcrypt with cost factor 12). We do not store your password in plain text and cannot retrieve it. We do not use reversible encryption for passwords. At login, we verify your password by comparing hashes — the password is never decrypted.

5.4 Access Controls

Access to production systems and personal data is restricted to authorized personnel only, on a need-to-know basis. Access is logged. Two-factor authentication is enforced for all administrative access to our hosting infrastructure and code repositories.

5.5 Data Minimization

We collect and retain only the data necessary to provide the Service. From email scanning we do not store message content — only extracted subscription metadata. From bank statements we extract only transaction data relevant to subscriptions before transmitting to our AI processor.

5.6 Pseudonymization

Where technically feasible, personal data is pseudonymized in our analytics and operational systems.

5.7 Sub-Processors

We share personal data only with the following sub-processors, each bound by appropriate data protection agreements:

• Railway Corporation — hosting infrastructure (EU West / Amsterdam, running on Google Cloud Platform). See trust.railway.com.
• Plaid Financial Ltd. — open banking (Account Information Services). See plaid.com/legal.
• TrueLayer Limited — open banking (Account Information Services). See truelayer.com/legal.
• Anthropic PBC — AI-based content analysis (Claude Haiku 4.5). See anthropic.com/legal/privacy.
• Google LLC — Sign in with Google, Gmail OAuth access, and Firebase Analytics (only after cookie consent).
• Microsoft Corporation — Outlook OAuth integration, if used.
• Apple Inc. — Sign in with Apple, iCloud Mail integration.
• Resend, Inc. — transactional email delivery. See resend.com/legal/privacy-policy.

Our hosting provider Railway may engage its own sub-processors (including Google Cloud for infrastructure, Cloudflare and Fastly for content delivery, and others) to provide the hosting service. The current Railway sub-processor list is available at trust.railway.com.

We do not sell or share your personal data with any third party for marketing purposes.

6. Data Retention

• Account data — retained while your account is active and permanently and immediately removed upon account closure (see Section 8).
• Subscription and bank transaction data — retained for up to 12 months to support subscription history features.
• Bank statement files — never stored; processed transiently in memory during parsing. Extracted data is deleted 90 days after upload via automated cron job.
• Gmail / Outlook / iCloud message content — not stored in our database at any point.
• Application and access logs — retained for 6 months for security and troubleshooting purposes.
• Backups — encrypted database backups (including Point-in-Time Recovery snapshots) are managed by our hosting provider and may persist beyond active data for the provider's standard backup window before being permanently overwritten in the normal backup rotation.

7. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your personal data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta or your local data protection authority

To exercise any of these rights, email privacy@subsswitch.app. We respond within 30 days.

8. Account Deletion and Revoking Access

When you delete your SubSSwitch account, we:

• Delete all associated data from our database via cascade deletion (account, subscriptions, bank connections, extracted subscription data)
• Revoke your Plaid connection via Plaid's /item/remove API
• Revoke your TrueLayer connection via TrueLayer's revocation endpoint
• Revoke your Google Sign-In and Gmail scan grants via Google's revocation endpoint
• Delete all uploaded files (bank statements, profile photos) — they are stored in our own database and are removed by the same cascade deletion

Microsoft (Outlook) limitation: Microsoft does not provide a programmatic revocation endpoint for third-party OAuth apps. We delete stored Microsoft tokens on our side, but you should also manually revoke SubSSwitch's access at https://account.live.com/consent/Manage to fully disconnect on Microsoft's side.

You can revoke access to connected accounts at any time without deleting your SubSSwitch account:

• Google / Gmail: https://myaccount.google.com/permissions
• Microsoft / Outlook: https://account.live.com/consent/Manage
• Apple / iCloud Mail: appleid.apple.com → Sign-In and Security → App-Specific Passwords → delete the password named "SubSSwitch". (For Sign in with Apple, use Apps Using Your Apple ID on the same page.)
• Plaid: Settings → Connected Accounts within SubSSwitch, or via my.plaid.com

9. International Data Transfers

Our primary infrastructure is located in the European Union (Amsterdam). However, several of our sub-processors are based in the United States (including Anthropic, Plaid, Google, Microsoft, Apple, and Resend), and Railway's operational team is US-based.

These transfers are governed by:

• EU Standard Contractual Clauses (SCCs) included in our Data Processing Agreements with each processor
• Where applicable, the EU-US Data Privacy Framework
• Supplementary technical measures such as encryption in transit and at rest

10. Age Restriction

The Service is intended for users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18. If you believe we have collected such data, contact privacy@subsswitch.app and we will delete it.

11. Cookies

We use essential cookies for authentication and session management. With your consent (via the cookie banner), we also use analytics cookies (Google Firebase Analytics) to understand how the Service is used. Analytics is disabled until you accept, and you can decline or withdraw consent at any time. We do not use advertising cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

Q-CONSULT MARKETING LTD
2 Ta' Ninu Triq Laqxija
Birkirkara BKR 4032, Malta
VAT MT28140713

Privacy matters: privacy@subsswitch.app. General support: support@subsswitch.app.

You may also contact the Office of the Information and Data Protection Commissioner (IDPC) of Malta at idpc.org.mt.