Privacy Notice

Last updated: 8/14/2026

1. Who we are

Subscription Tracker, trading as SpendZen, is the data controller for the personal data described in this notice. We decide why and how your personal data is processed when you use SpendZen. Contact: privacy@spendzen.app.

For purchases, our reseller Paddle.com is the Merchant of Record and acts as an independent controller of your payment and billing data.

2. Data we collect, why, and our legal basis

Account data (name, email, password hash or OAuth identifier, workspace and role) — to create your account, authenticate you, and provide the Service. Legal basis: performance of a contract.

Subscription records you enter (vendor, cost, billing cycle, renewal date, category, notes, cost allocation) — to deliver dashboards, reminders, and reporting. Legal basis: performance of a contract.

Workspace and membership data (invitations, approvals, audit log entries) — to run collaboration and approval features and to keep an audit trail. Legal basis: performance of a contract and legitimate interests in accountability.

Usage, device, and log data (IP address, browser/device identifiers, pages viewed, error logs) — for security, fraud prevention, debugging, and product improvement. Legal basis: legitimate interests.

Support messages — to answer your questions. Legal basis: legitimate interests / contract.

Billing identifiers (customer, subscription, and transaction IDs returned by Paddle, plan and entitlement status) — to apply the plan you purchased. Legal basis: performance of a contract and legal obligation. We never receive or store your card number.

Marketing communications, if you opt in — Legal basis: consent, withdrawable at any time.

3. What we do not collect

We do not connect to your bank and never hold banking credentials or card numbers. Optional email-receipt scanning is not enabled today; if we launch it, we will request read-only OAuth scopes, store tokens encrypted, and let you revoke access in Settings.

4. Who we share data with

Paddle.com — our Merchant of Record, for the sale of our products, checkout, subscription management, payments, invoicing, tax compliance, and refunds.
Service providers / subprocessors — cloud hosting and database (Supabase), application hosting and CDN, error monitoring, and email delivery, acting on our instructions.
Professional advisers — legal, accounting, and audit advisers where necessary.
Authorities — where required by law or to establish, exercise, or defend legal claims.

We do not sell your personal data.

5. International transfers

Your data may be processed outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses with our providers.

6. Retention

We keep account and subscription data while your account is active. After deletion, personal data is removed or anonymised within 30 days, except records we must keep for legal, tax, or accounting purposes (typically up to 7 years) and security logs kept for up to 12 months.

7. Your rights

Subject to applicable law you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent at any time. You can export your data (JSON) or delete your account from Settings, or email privacy@spendzen.app. We respond within one month. If you are in the UK/EEA you may also complain to your local supervisory authority; in India you may contact our grievance contact at the same address.

8. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS 1.2+) and at rest (AES-256), row-level security policies isolating workspace data, role-based access control, and least-privilege access for staff.

9. Cookies

We use strictly necessary cookies and local storage for authentication, session security, and remembering your workspace. Checkout pages may set cookies from Paddle to process your order. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

10. Changes and contact

We will post updates to this notice here and notify you of material changes. Questions: Subscription Tracker, privacy@spendzen.app.