Privacy Policy

Who we are

Subs'n'Docs is a web app for keeping track of subscriptions, documents, deadlines and payment cards, and for reminding you about their dates.

The service is operated by PE Evgenii Kim, an individual entrepreneur (sole proprietor) registered in the Kyrgyz Republic, trading as Subs'n'Docs ("we", "us"), in Bishkek, Kyrgyz Republic.

For the personal data described in this policy, we are the controller: we decide why and how that data is processed.

Questions or requests about your personal data can be sent to support@subsndocs.com.

This policy covers the Subs'n'Docs website and app, Telegram bot, forwarding address, reminders and monthly reports, connections to AI assistants, and purchases of Lifetime.

What we store

Your account

We store the email address you use to sign in and your account settings, including your language, time zone, currencies, reminder preferences, monthly report preference and first-run guide progress.

Your records

We store the information you choose to add to Subs'n'Docs, such as:

• names and categories;
• dates and deadlines;
• optional prices and currencies;
• billing periods;
• whether a subscription is a trial or renews automatically;
• optional links and notes;
• optional information about where a physical document is stored;
• profiles you create for people, pets, vehicles or property;
• links between records, such as a visa that depends on a passport;
• a history of changes to your records.

For a payment card that you choose to track in Subs'n'Docs, we store only the information you enter: a nickname, card network, optional last four digits, and expiry month and year.

Do not enter full card numbers, CVV codes, PINs or online banking credentials.

Reminder and delivery data

We store the reminder channels you enable, such as your email address, a connected Telegram chat and a private calendar link.

We also keep technical information about reminders that were queued or sent and whether the delivery provider accepted them.

We do not use reminder content for advertising or marketing profiles.

Purchases

If you buy Lifetime, Paddle handles the payment as Merchant of Record.

We may receive and store limited information about the transaction, such as an internal account reference, Paddle order or transaction identifier, purchase date, amount, currency, status and whether the purchase was refunded.

Payment information used at Paddle checkout — such as your full card number, CVV or bank credentials — is provided directly to Paddle and is not received or stored by Subs'n'Docs.

This is separate from the optional limited payment-card information you may choose to store inside Subs'n'Docs for your own subscription tracking.

Information you should not store

Subs'n'Docs is designed to track dates and basic information, not copies of sensitive documents.

We do not ask you to upload or enter:

• passport or identity document scans;
• document numbers;
• full payment card numbers;
• CVV or PIN codes;
• passwords;
• online banking credentials.

Please do not add this information to notes or other free-text fields.

Account and sign-in

Subs'n'Docs does not use passwords.

You sign in using a one-time link sent to your email address. The link works once and expires after 15 minutes. We store only a cryptographic hash of the sign-in token rather than the token itself.

After sign-in, a session cookie keeps you signed in for up to 30 days, or up to 7 days without activity.

Signing out ends the current session. Settings can also be used to end sessions on other devices.

Sensitive account actions, such as exporting your data or deleting your account, may require a recent sign-in confirmation.

Reminders, monthly reports and calendars

Subs'n'Docs sends reminders only through channels you enable.

These may include:

• email;
• Telegram;
• a private calendar link.

You can disable reminder channels in Settings.

The monthly report is off by default. If you enable it, the report may include upcoming subscription charges, ending trials, document expiries, deadlines and expiring cards. Because of this, it may contain names, dates and prices from your records.

The private calendar link may contain the names and dates of active records and subscription prices. Anyone who obtains that link may be able to read the calendar, so you should treat it like a password. You can replace or disable the link in Settings.

Reminder emails may contain quick actions such as marking an item as paid or asking to be reminded later. A link does not change a record until you confirm the action.

Adding subscriptions from receipts

If you paste receipt text directly into the subscription form, it is processed in your browser using fixed rules. The pasted text is not sent to our server.

If you send receipt or confirmation text to the Subs'n'Docs Telegram bot, our server processes it to prepare a subscription draft.

The original text is not intentionally stored by Subs'n'Docs. Extracted information may be kept for up to 30 minutes while you review the draft.

Messages sent to the bot also pass through Telegram. Bot conversations are not end-to-end encrypted and may remain in your Telegram history until you delete them.

If you enable email forwarding, Subs'n'Docs gives you a personal forwarding address. Messages sent to that address first pass through our email provider, Resend.

We process the message to prepare a draft. We do not intentionally retain the complete message body after processing. The extracted information and subject may be kept for up to 14 days so that you can review the draft.

Resend may process or temporarily retain messages and delivery information under its own terms and privacy notice.

If Gmail sends a forwarding confirmation code to your Subs'n'Docs forwarding address, we may keep that code for up to 3 days.

Nothing received through receipt forwarding is automatically added to your records without your confirmation.

Receipt parsing does not use an external AI service. It is performed using fixed processing rules.

Creating an account from the blog

The passport calculator in the blog works in your browser and sends nothing. If you choose "Add it to Subs'n'Docs" and tick the box, we receive your email address and two dates: when your passport expires and the day to start renewing it. We send you a sign-in link by email.

The two dates are kept only together with that link, until you open it or ask for a newer one; unused links are deleted within about a day after they expire. When you open the link, the dates become a document called "Passport" and a deadline called "Start the passport renewal" in your account, and they are removed from the link. We do not receive the dates of your trip and we never ask for a passport number.

We use your address only to send the link and the reminders you turn on, and you can delete the records or the whole account in the app at any time.

AI assistants

You can choose to connect an AI assistant, such as Claude or ChatGPT, to your Subs'n'Docs account.

Nothing is connected unless you start the connection and approve it.

Depending on the permissions you grant, the assistant may be able to read information such as:

• record names;
• dates;
• prices;
• currencies;
• categories;
• the card associated with a subscription by network and last four digits.

The assistant does not receive full payment-card numbers because Subs'n'Docs does not store them.

We also restrict assistant access to information such as private notes, document storage locations and your sign-in email unless a feature explicitly says otherwise.

If you grant write permissions, an assistant may perform supported actions such as adding subscriptions, documents or deadlines, renewing a document or marking a subscription as paid.

Connected assistants cannot delete or cancel records through the Subs'n'Docs connection.

You can see and revoke assistant connections in Settings. Revoking a connection stops future access through that connection.

Information an assistant reads is sent to the provider of that assistant and is then handled under your relationship with that provider and its own privacy terms. We do not control how an external AI provider processes information after you instruct Subs'n'Docs to send it.

We store technical information about the connection, such as the assistant name, permissions, approval time, last-used time and cryptographic hashes of access credentials.

We do not send your records to an AI provider unless you choose to connect an assistant and use that connection.

Profiles and information about other people

Subs'n'Docs allows you to create profiles for family members and other people.

If you add personal information about another person, you are responsible for having an appropriate reason, permission or other lawful basis to enter and use that information.

Do not use Subs'n'Docs to store sensitive information about another person that the service does not require.

Service providers and other recipients

We do not sell personal data.

We do not share personal data for targeted advertising or use it to build advertising profiles.

We use a limited number of service providers to operate Subs'n'Docs.

Hetzner

Our application server and database are hosted by Hetzner in Germany.

Hetzner processes infrastructure data on our behalf as a hosting provider.

Resend

Resend provides email delivery and receipt forwarding.

It may receive your email address, the contents of emails we send to you and messages sent to a Subs'n'Docs forwarding address.

Databuddy

Databuddy (databuddy.cc) provides website analytics for our public pages.

It receives the address and title of the page you view and the technical information your browser sends, and it turns your IP address into an approximate country, region and city without keeping the address itself.

It also stores the recordings of visits to those pages that are described under Cookies and local storage.

Our server also tells Databuddy when a known AI crawler or assistant reads a public page: the page address without its query string, and the crawler's user agent and referrer. Visits by people are not sent this way.

It does not receive anything from your account.

Telegram

If you connect Telegram or use the Subs'n'Docs bot, Telegram processes the messages and technical information needed to deliver them.

Telegram operates under its own terms and privacy policy.

Paddle

Purchases of Lifetime are processed by Paddle as our reseller and Merchant of Record.

When you purchase through Paddle, you provide payment and billing information directly to Paddle.

Depending on your location, Paddle may process information such as your name, email address, country, billing details, payment information and tax information.

Paddle acts independently in relation to much of this payment processing and handles that data under its own privacy notice (https://www.paddle.com/legal/privacy).

Subs'n'Docs receives only the limited transaction information needed to identify the purchase, activate the plan, handle refunds and maintain appropriate transaction records.

AI providers

An AI provider receives information from your Subs'n'Docs account only when you choose to connect its assistant and request or permit access.

The provider processes that information under its own terms and privacy policy.

Legal requirements

We may disclose information where we are legally required to do so, or where reasonably necessary to protect users, the service or our legal rights.

Where your data is processed

Our primary application server and database are hosted with Hetzner in Germany.

Subs'n'Docs is operated from the Kyrgyz Republic. Authorised administration, maintenance and customer support may therefore involve access to systems from the Kyrgyz Republic.

Other service providers, including email, messaging, payment and AI providers, may process information in other countries depending on their infrastructure and your location.

Data protection rules differ between countries.

Where applicable data protection law requires a specific safeguard for a transfer of personal data to a separate organisation in another country, we use or require an appropriate lawful mechanism for that relationship. Depending on the circumstances, this may include an adequacy decision, contractual safeguards such as Standard Contractual Clauses, or an equivalent mechanism recognised under applicable law.

You can contact support@subsndocs.com if you want more information about the providers used for a particular feature.

Why we use your data

We process personal data only for purposes connected with operating Subs'n'Docs.

These purposes include:

• creating and maintaining your account;
• storing and displaying the records you enter;
• calculating and sending reminders;
• generating reports and calendars you enable;
• providing receipt parsing and forwarding features you request;
• providing AI connections you choose to enable;
• providing exports and account controls;
• activating Lifetime after a purchase;
• handling refunds, disputes and support;
• protecting accounts and preventing abuse;
• maintaining and improving the reliability and security of the service;
• complying with applicable legal obligations.

Where the GDPR or UK GDPR applies, the legal basis depends on the processing.

Core account and service processing is generally necessary to perform our contract with you.

Security, fraud prevention and basic service administration may be based on our legitimate interests in operating a safe and reliable service.

Optional features may be processed because you requested or enabled them and, where consent is required by law, based on your consent. You can stop that processing by disabling the feature or revoking the connection.

Some transaction and legal records may be processed because we are required to keep them by law.

Administrative access

Subs'n'Docs is designed so that routine operation does not require the operator to read the contents of individual records.

Limited account and technical information may be available for support, security and service administration.

Administrative access is restricted and should be used only when necessary to operate or support the service.

How long we keep data

Your account and records are generally kept until you delete individual records or delete your account.

Typical technical retention periods include:

• sign-in links: up to 15 minutes;
• sessions: up to 30 days, or up to 7 days without activity;
• Telegram receipt drafts: up to 30 minutes;
• forwarded-email drafts: up to 14 days;
• Gmail forwarding confirmation codes: up to 3 days;
• short-lived security and rate-limiting information: usually about 2 days.

When you delete your account, active account content such as records, profiles, reminder settings, channels, calendar links, forwarding addresses, drafts, assistant connections and sessions is removed from the live service.

Short-lived database backups may remain for up to 7 days. If a backup containing a deleted account is restored, deletion procedures are applied again.

We may retain a minimal internal identifier where necessary to ensure deleted accounts remain deleted after a backup restoration.

The record of your purchase (order number, date, amount, currency and status) is removed together with your account.

Paddle independently retains its own transaction records according to its legal obligations and retention policies.

Technical logs

We minimise technical logging and do not use web activity logs for advertising or behavioural profiling.

The application is configured not to intentionally place names, prices, record contents or message text into routine error logs.

Infrastructure, email, security or network providers may process limited technical metadata or security logs as part of providing their services and protecting their systems.

Security

We use technical and organisational measures intended to protect personal data.

These include encrypted network connections, access controls, rate limiting, firewall protection and key-based server administration.

Sensitive access credentials such as sign-in tokens, private calendar tokens and assistant access keys are stored as cryptographic hashes where the feature allows it.

We also design the database and application to separate one account's data from another account's data.

No online service can guarantee absolute security.

If we become aware of a personal-data breach, we will investigate it and provide notifications where required by applicable law.

Cookies and local storage

Subs'n'Docs uses a session cookie needed to keep you signed in and protect authenticated requests.

Your browser may also store a small number of preferences, such as list sorting, filters or display options.

We do not use advertising or behavioural-tracking cookies.

We do not use third-party analytics to build advertising profiles about you.

On our public pages (the home page, guides, blog, pricing and similar) we count visits with Databuddy, together with how fast the pages load and any script errors they hit. Its script keeps a visitor identifier in your browser's local storage and a session identifier in session storage; it sets no cookies. It is not used on sign-in, account or payment pages, and it follows the Do Not Track and Global Privacy Control signals of your browser.

On the same pages we also record visits (pointer movement, scrolling and clicks) with Databuddy session replay, to see where visitors get stuck. Page text and anything you type are masked in your browser before anything is sent, the sign-in boxes are left out of recordings entirely, and recordings are deleted after 30 days. Nothing is recorded once you are signed in.

When you buy Lifetime, you pay either in a Paddle checkout shown on our payment page or on a page hosted by Paddle. Paddle loads its checkout from its own servers and may set its own cookies and process technical data such as your IP address, under its own privacy notice (https://www.paddle.com/legal/privacy). This happens only on the payment step, and only if you choose to buy.

Because the cookies used for the service are necessary for the functions you request rather than advertising, we do not use a marketing cookie-consent banner solely for those cookies.

Your rights and choices

You can see and change your records directly in Subs'n'Docs.

You can also export your data and delete your account from Settings.

Depending on where you live and which privacy law applies, you may also have rights to:

• request access to personal data we hold about you;
• correct inaccurate data;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive a portable copy of your data;
• withdraw consent where processing is based on consent;
• complain to an applicable privacy or data-protection authority;
• exercise other rights available under the law where you live.

If applicable law gives you a right to appeal our response to a privacy request, you may do so by replying to our response.

We will not discriminate against you for exercising privacy rights that apply to you.

We do not sell your personal data or use it for targeted advertising.

Requests can be sent to support@subsndocs.com.

Where a specific legal response period applies, we will respond within that period. For GDPR and UK GDPR requests, this is generally within one month, subject to permitted extensions.

For payment information held directly by Paddle, you may also need to contact Paddle.

If you are in the European Economic Area or the United Kingdom, you may have the right to complain to the data-protection authority responsible for your location.

Children

You must be at least 16 years old to create or use a Subs'n'Docs account.

Subs'n'Docs is not intended for children under 16 and we do not knowingly allow children under 16 to create accounts.

If you believe that a child under 16 has created an account, contact support@subsndocs.com.

A parent or other adult account holder may store ordinary document or deadline information relating to a child in a family profile, provided that the adult has the right to do so.

Changes to this policy

We may update this Privacy Policy when the service, our providers or applicable requirements change.

When we make a meaningful change, we will update the date at the top.

If a change materially affects how we use existing personal data, we will provide additional notice where appropriate, such as through the app or by email.

Contact

PE Evgenii KimTrading as Subs'n'DocsBishkek, Kyrgyz Republic

Privacy and data requests: support@subsndocs.com