Privacy Policy

01. Overview & Scope

This Privacy Policy describes how SubsFolio ("we", "us", or "our") collects, uses, stores, and protects the personal and operational information of visitors, registered users, and organizations ("you" or "User") accessing our web application, browser extension, APIs, and associated subscription management tools (collectively, the "Services").

By accessing or registering for SubsFolio, you acknowledge that you have read and understood the practices detailed in this Policy. If you do not agree with our policies and practices, please do not use our Services.

02. Information We Collect

We collect data to provide smart subscription analytics and personalized alerts. The categories of information we collect include:

A. Information You Provide Directly

• Account Credentials: Name, email address, password hash, and optional profile details.
• Subscription & Spend Data: Service names (e.g. Figma, AWS, Zoom), billing amounts, currency, billing cycles (monthly, annual), next payment dates, categories, payment methods (card labels only), owner assignments, and attached notes/receipts.
• Workspace & Team Members: Organization name, workspace titles, and invited member email addresses and role assignments (Admin, Member, Viewer).
• Support Inquiries: Messages, feedback, contact forms, or bug reports submitted to our customer care team.

B. Information Collected Automatically

• Log and Device Data: IP address, browser type and version, operating system, device identifiers, and timestamped activity logs.
• Telemetry & Usage Patterns: Page views, feature usage (e.g. duplicate detection queries, CSV exports), and session durations.

03. How We Use Your Information

We process your data for the following legitimate business purposes:

• Delivering Core Functionality: Calculating your total SaaS spend, upcoming renewals, monthly breakdowns, and workspace totals.
• Automated Renewal Notifications: Sending automated email alerts before upcoming payment charges according to your custom reminder schedule (e.g., 1 to 30 days in advance).
• Duplicate Detection Intelligence: Analyzing your subscription list to identify overlapping software tools and recommending cost optimizations.
• Account Security: Verifying user authentication, sending password resets, detecting anomalous login activity, and preventing fraud.
• System Maintenance & Improvements: Debugging software errors, optimizing database queries, and improving user experience.

04. Data Sharing & Third-Party Service Providers

We never sell, rent, or trade your personal information. We only share information with trusted third-party service providers who assist us under strict data processing agreements:

We may also disclose information when required by law, subpoena, or government authority to comply with valid legal processes.

05. Storage & Encryption

We protect your information using enterprise-grade security protocols:

• Encryption in Transit: All communications between your browser and our servers are encrypted via Transport Layer Security (TLS 1.3).
• Encryption at Rest: Database records, backups, and user logs are encrypted using industry standard AES-256 encryption.
• Cryptographic Password Hashing: Passwords are protected using modern salted hashing algorithms (bcrypt / Argon2) and are never retrievable in plaintext.

06. Data Retention & Workspace Deletion

We retain your personal and subscription data for as long as your account remains active.

• Self-Serve Workspace Deletion: You can export all your subscription data in CSV format or delete your workspace directly from the Account Settings page at any time.
• Permanent Purge: When an account is deleted, all associated subscriptions, member permissions, and notification schedules are permanently wiped from our active production database within 30 days.

07. Your Rights (GDPR & CCPA)

Depending on your location, you hold statutory rights regarding your personal information, including:

• Right of Access: You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: You can update and correct any inaccurate profile information at any time.
• Right to Erasure ("Right to be Forgotten"): You may request complete deletion of your personal data.
• Right to Data Portability: You can export your subscriptions and cost reports in standard CSV format whenever you choose.
• Right to Object & Restrict Processing: You can opt out of non-essential communications and marketing notifications.

08. Cookies & Telemetry

SubsFolio uses first-party session cookies to manage authentication, maintain active login state, and secure your session. For a comprehensive overview of the cookies we utilize and how you can manage them, please review our Cookie Policy.

09. Contact Our Data Protection Team

If you have questions, feedback, or wish to exercise your legal data rights under this Privacy Policy, please contact our team:

10. SubsFolio Chrome Browser Extension

This section outlines our dedicated privacy and data handling practices for users of the official SubsFolio – Subscription Tracker Chrome Extension ("Extension").

10.1 Single Purpose & How It Works

The single purpose of the SubsFolio Extension is to help users identify, record, and track recurring software subscriptions directly into their SubsFolio workspace. As you browse merchant websites and complete checkout receipts or review subscription plans, the Extension analyzes on-page text locally within your browser to detect subscription charges.

10.2 Client-Side Processing & Excluded Pages

All page parsing occurs exclusively on your local device (client-side). The Extension does not collect, track, or transmit your overall browsing history, search queries, personal correspondence, or keystrokes. Furthermore, webmail clients (including Gmail and Yahoo Mail), search engines, and sensitive authentication portals are strictly excluded from scanning.

10.3 User Consent & Data Transmission

A detected subscription is only transmitted to SubsFolio when you explicitly interact with the Extension (e.g. clicking "Add to SubsFolio" on an in-page prompt or submitting the popup review form). The captured information (merchant name, recurring cost, cadence, and renewal date) is transmitted via encrypted HTTPS solely to https://subsfolio.com/api/extension.php and stored within your private workspace.

10.4 Authentication & Cookies

The Extension utilizes the cookies permission strictly to access the first-party SubsFolio authentication cookie (PHPSESSID) on subsfolio.com to provide seamless 0-click workspace synchronization. The Extension never accesses, reads, or stores third-party website cookies.

10.5 No Sale or Unauthorized Sharing of Data

In strict compliance with the Google Chrome Web Store Developer Program Policies, SubsFolio does not sell, rent, monetize, or transfer user data or browsing information to data brokers, advertising networks, or third-party analytical entities under any circumstances.