Privacy Policy

SubDesk ("we", "us") decides how the personal data described here is used, which makes us its controller. For anything on this page, write to [email protected].

This policy covers the website and the app at subdesk.app. It sits beside the Terms of Service.

Almost everything we hold is something you typed or uploaded.

• Your account: your name, your email address and a password, which is stored only as a salted hash. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• Your records: subscriptions with their prices, billing dates, categories, payment and price history, free trials, cancel-by dates and the cancellation links or steps you save; warranties and insurance policies with their providers, reference numbers, dates and premiums; reminder settings; and any notes.
• Your cards: a nickname, the card type, the last four digits and, if you add it, the month the card expires. Never the full number, never the security code.
• Your clients, on the Pro plan: the name, invoicing currency and notes you give each client, and what you bill them.
• Your files: invoices you upload as PDFs or images, and any image you upload as an icon.
• Workspaces and sharing: workspace names and display currencies, the email addresses you invite, the role of each member, and a history of who added, changed or deleted what.
• Billing, if you buy a plan here: your Stripe customer and subscription identifiers, the plan, the billing interval, its status and the end of the current period. Payment details go to Stripe and never reach us.
• Redeem codes: which codes your account redeemed and when, the plan and duration each gave, and a count of failed attempts, kept for a day, used to stop guessing.
• Technical data: your IP address, browser type and the time of each request, in the server logs of our hosting and database providers.
• Messages: whatever you send us when you write to support.

• Bank, card-issuer or payment-app connections. Nothing is read from your accounts.
• Full card numbers, security codes or bank logins. Please do not put them in notes or uploads either.
• The contents of your inbox. We do not scan email for receipts.
• Advertising identifiers, cross-site tracking or behavioural profiles. The site runs no analytics or advertising scripts.
• Special categories of data, such as health or biometric data. An insurance policy you record may reveal something of the kind; record only what you are comfortable storing.

• To run the service for you: showing your records, doing the sums, building reports, sending the reminders you switch on, and sharing a workspace with the people you invite. Basis: our contract with you.
• To take payment, apply the plan you bought or redeemed, and handle refunds. Basis: our contract with you.
• To keep the service secure: preventing abuse, throttling code guessing, investigating incidents and fixing faults. Basis: our legitimate interest in a safe and working service.
• To answer you when you write to us. Basis: our legitimate interest in supporting our users, or our contract with you.
• To keep the billing and tax records the law requires. Basis: legal obligation.

We do not use your records to train machine-learning models, we do not make decisions about you by automated means that have legal or similar effects, and we do not look into an account's contents except to fix a problem you reported, to investigate abuse, or where the law compels us.

• Account email: confirming your address, resetting a password, security notices.
• Reminders you switched on: before a renewal, a cancellation deadline, a card expiry, the end of a warranty or policy, or a client bill. You choose them, and switch them off, on the Reminders page.
• Workspace invitations, sent to the address the workspace owner typed. If you received one and do not want it, ignore it; no account is created until you accept.
• Notices about the service: changes to the terms, to prices or to this policy, and anything affecting your data.

We do not send marketing email unless you have asked for it, and every such email would carry a way to stop it.

We do not sell or rent personal data. It is handled by the providers that run the service for us, each under a contract that limits them to doing so:

• Supabase: the database, sign-in, and file storage for invoices.
• Vercel: hosting of the website and the app, including request logs.
• Stripe: payment, invoices and the billing portal for plans bought here. Stripe is an independent controller of the payment details you give it; see Stripe's privacy policy.
• Google: only if you choose to sign in with Google.

If we add a provider, for example to deliver email, it will be listed here before it handles your data.

If you bought a plan through a marketplace such as AppSumo, the marketplace is the seller and holds your purchase and payment details under its own privacy policy. We receive the code, and we may exchange with the marketplace whether a code was redeemed, refunded or cancelled, so that a refund ends the plan it paid for. We do not receive your payment details.

The people you share a workspace with see everything in that workspace, along with your name, email address and the changes you made in it.

We may disclose data where the law requires it, or to establish or defend a legal claim. If the service is ever transferred to a successor, your data moves with it under this policy, and you will be told beforehand.

The site sets no advertising or analytics cookies. The app keeps a few things in your browser's local storage so that it works: your sign-in session, your appearance setting (light, dark or system), and interface preferences such as the last view you chose. Clearing your browser data removes them and signs you out.

Paying takes you to a page hosted by Stripe, which sets its own cookies to process the payment and prevent fraud.

SubDesk is run from Thailand, and our providers process data in data centres in several countries, which may be outside the one you live in. Where the law requires a safeguard for such a transfer, we rely on the standard contractual clauses or the equivalent mechanism in our providers' data processing agreements.

• Your account and records: for as long as the account is open. Moving to a lower plan deletes nothing.
• What you delete in the app, a subscription, an invoice, a workspace, is removed from the live database at once.
• A closed account: deleted, with its records and files, at once when you delete it from your Profile page, or within 30 days of a request by email. Copies in backups are overwritten within a further 30 days. Any paid plan is cancelled at the same moment.
• Records of payments and refunds: for as long as tax and accounting law requires, which can be several years. These hold no more than is needed to show the transaction.
• Server logs: for a short period set by our providers, normally no more than 30 days.
• What you added to someone else's workspace stays in that workspace, which belongs to its owner. When your account is deleted, your name and email address are taken out of that workspace's history and any invite still waiting for you is withdrawn.

Traffic is encrypted in transit. The database enforces, row by row, that an account reads and writes only its own workspaces and the ones shared with it. Invoice files sit in private storage and are served through short-lived links. Passwords are stored as salted hashes; we never see them.

No system is perfectly secure. If a breach affects your personal data we will tell you, and the authorities where required, without undue delay.

Wherever you live, you can ask us to:

• give you a copy of your data, in a common machine-readable format;
• correct anything that is wrong, most of which you can do yourself in the app;
• delete your account and data;
• restrict or stop a use of your data that rests on our legitimate interest;
• withdraw a consent you gave, without affecting what was done before.

The first and the third you can do yourself, under Your data on your Profile page: the export is a ZIP file holding everything in your own workspaces as CSV files, which any spreadsheet opens, together with the invoice files you uploaded, and deleting the account takes effect at once. For anything else, or if you cannot sign in, write to [email protected] from the account's email address, so we know the request is yours. We answer within 30 days and do not charge for it. We will not treat you differently for using these rights.

These rights are given by, among others, the EU and UK General Data Protection Regulation, Thailand's Personal Data Protection Act and the California Consumer Privacy Act; we apply them to everyone. If you think we have handled your data wrongly, you can also complain to the data protection authority where you live, or to Thailand's Personal Data Protection Committee.

When you record a client or invite someone to a workspace, you give us data about another person. You are responsible for having the right to do so. If you are such a person and want to know what an account holds about you, write to us and we will pass the request to the account's owner, or act on it ourselves where the law requires.

The service is for adults. We do not knowingly collect data from anyone under 18; if you believe a child has opened an account, tell us and we will delete it.

When we change this policy the date at the top changes with it. If a change is material, a new provider, a new use of your data, we will tell you by email or in the app at least 30 days before it takes effect.

Privacy questions and requests go to [email protected].