Privacy Policy

Last updated: July 14, 2026

1. Operator and launch status

SubWard is operated by Arven Digital and is available as a web service at subward.app.

Pre-launch legal notice:the operator's full legal name, registration details, business address, data-controller location, and required privacy notices must be completed and confirmed by the operator and legal counsel before launch. This policy does not invent or imply a registered entity or address.

2. Data we process

  • Account and authentication data, including email address, optional display name, and a password hash.
  • Subscription fields, billing dates, amounts, categories, payment-method labels, profile membership, and service metadata.
  • Billing status, plan, and transaction identifiers supplied by Lemon Squeezy. We do not store payment-card numbers.
  • Service and security metadata such as IP address, browser information, access time, feature events, and error information.
  • Forwarded receipt content, including sender information, subject, email body, and supported PDF attachments, when you choose email import.

We do not connect to or access your inbox; you decide which messages to forward.

3. Encryption scope

On profiles where client encryption is explicitly enabled, supported fields entered and encrypted by the client, such as subscription names and notes, may be end-to-end encrypted before transmission.

This protection does not cover everything. Email/API imports, pending-review records, reminders, operational metadata, category and billing fields, and records in unencrypted profiles are server-readable and processed by SubWard until any explicit supported client-encryption step occurs. Imported receipt body and PDF content must be readable during extraction and review processing.

4. Purposes and legal bases

We process data to provide and secure the service, authenticate users, import and review subscriptions, send requested operational messages, administer billing, prevent abuse, diagnose errors, and improve the product. Applicable legal bases may include performance of a contract, legitimate interests, consent, and legal obligations; the operator and legal counsel must confirm the applicable bases and jurisdiction-specific notices before launch.

5. Processors and recipients

  • Hetzner Online GmbH — VPS infrastructure for the web service, API, and self-managed PostgreSQL and Redis. The operator must verify and document the production server location before launch.
  • Resend — transactional email delivery.
  • Cloudflare Email Worker— receipt email forwarding and delivery to SubWard's import endpoint.
  • Google Gemini / Generative Language API — extraction of subscription details; when fallback extraction is used, forwarded receipt body or PDF content and related sender/subject context are sent to Google for processing.
  • Lemon Squeezy — merchant-of-record payment, tax, billing, refund, and customer-portal processing.

We do not sell personal data.

6. International transfers

Hosting-location and data-residency claims must be verified against the production VPS before launch. Hetzner, Resend, Cloudflare, Google, and Lemon Squeezy may process data in the EEA, United States, or other locations in which they or their subprocessors operate. Where applicable law requires it, the operator must put in place and document an appropriate transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, before launch.

7. Retention and deletion

Account and service records are kept while needed to provide the service and for legitimate security, billing, compliance, dispute, and backup purposes. Deletion requests are processed subject to technical backup cycles and legal obligations. Provider records may follow provider or merchant-of-record retention requirements. Specific log and deletion deadlines are not promised here until the operator has verified and approved a retention schedule. We do not state a raw-message retention period that has not been operationally verified.

8. Your rights and contact

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent. You may also complain to the relevant supervisory authority.

Contact: support@subward.app