Privacy Policy

1. Who We Are

SubSavvy ("we", "us", "our") operates subsavvy.ca, a service that helps Canadians identify and cancel forgotten subscriptions. This Privacy Policy explains how we collect, use, and protect your personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

2. Information We Collect

Bank Statement Content: When you upload a PDF or CSV file, we extract transaction text solely to identify subscription charges. We do not store, transmit, or retain the original file or any raw transaction data.

Detected Subscription Data: The subscription names, amounts, and frequencies identified by our AI are stored to display your results — for up to 24 hours on a free scan, and until you delete your account on a paid scan.

Email Address: If you choose to set reminders, we collect your email address to send reminder notifications.

Session Identifier: We use a cookie-based session ID to associate your scan results with your browser session without requiring account registration.

Payment Information: Stripe processes all payments. We receive only a confirmation token; no card numbers or banking details are stored on our servers.

3. How We Use Your Information

To analyze your bank statement and identify recurring subscriptions.

To display your results and provide cancel guides.

To send reminder emails if you opt in.

To process payments via our payment processor, Stripe.

We do not use your information for marketing, advertising, or profiling. We do not sell your data to third parties.

4. Data Retention

Uploaded files are deleted immediately after text extraction — they are never written to disk.

Free scan results (detected subscriptions) are automatically deleted 24 hours after creation, whether or not you are signed in.

Paid scan results are retained until you delete your account. You can delete it yourself at any time from Account Settings.

Email addresses for reminders are retained until you unsubscribe using the link in any reminder email, or until you delete your account.

Payment records are retained for 7 years as required by Canadian tax law. When an account is deleted, the payment record is kept with no link back to you or your scans.

5. Data Security

All data is transmitted over HTTPS (TLS 1.3). Data at rest is stored in Supabase (hosted in North America) with encryption enabled. We apply the principle of least privilege — only the minimum data required to provide the service is retained.

6. Third-Party Service Providers

Anthropic (Claude API): Transaction text is sent to Anthropic's API for analysis. Anthropic does not use API data for model training.

Stripe: Handles all payment processing. Stripe is PCI-DSS compliant.

Resend: Sends transactional emails. Email content is limited to reminder details.

Supabase: Hosts our database in North America.

Vercel: Hosts our application on edge infrastructure.

Google Analytics: Loaded only after you accept analytics cookies. Used to measure aggregate traffic and improve the site. We do not share analytics data for advertising or sell it to third parties.

7. Your Rights Under PIPEDA

You have the right to access the personal information we hold about you.

You have the right to request correction of inaccurate information.

You have the right to withdraw consent and request deletion of your data.

If you have an account, you can delete it and everything attached to it yourself, at any time, from Account Settings. Deletion is immediate and cannot be undone.

To exercise any of these rights, contact us at [email protected].

8. Cookies and Similar Technologies

Essential session cookie (subsavvy-session): Associates your scan with your browser. This cookie is required for the service to function, does not track you across other websites, and expires at the end of your browser session. No consent is required for strictly necessary cookies.

Analytics cookies (Google Analytics): Loaded only after you click "Accept" on the cookie banner. These cookies help us measure aggregate traffic and improve the site. They are not used for advertising and we do not sell analytics data.

Consent record (subsavvy.cookieConsent): When you make a choice on the cookie banner, your decision is stored in your browser's local storage so we do not show the banner again. This entry stays on your device only and is never transmitted to our servers.

You can change your choice at any time using the "Cookie Settings" link in the footer. Declining or revoking consent stops new analytics events; to fully clear analytics cookies already set in your browser, use your browser's privacy settings.

9. Children's Privacy

SubSavvy is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date at the top of this page. Your continued use of the service after any changes constitutes acceptance of the updated policy.