Privacy Policy
We use your information to identify subscription waste and provide optimization recommendations. This page explains what we collect, why we collect it, and the controls available to you.
The data controller and developer is Subveris. Our contact email is help.subveris@gmail.com. Subveris is the application and brand responsible for the processing described in this policy.
Subveris values your privacy. This policy explains what information we collect, how we use it, and how we store it safely.
We use data only to provide and improve the core functionality of Subveris: to identify subscriptions, track usage, calculate recurring costs, and process payments. Google user data, including Gmail message content and metadata, is used only to find subscription-related information, create pending detection candidates, and improve the accuracy and functionality of the Gmail scanning feature you explicitly authorize. Detected candidates remain pending until you approve them. We do not use Google user data for advertising, profiling, credit decisions, lending, data brokerage, or unrelated analytics. We do not sell Google user data or use it to create advertising databases. We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Gmail-derived data is used only for the requesting user's personalized, user-facing subscription-detection and subscription-management features. We may share the minimum data needed with service providers that operate Subveris, such as Supabase for database and authentication services and Stripe for payment processing, solely to provide or improve Subveris features requested by you.
When you choose Connect Gmail, Subveris uses Google OAuth to access the Gmail account you authorize. The Gmail integration accesses message search results, message headers, message dates, sender information, subjects, and the limited message content needed to identify subscription receipts, invoices, renewals, charges, service names, prices, currencies, and billing dates. It does not access Gmail unless you authorize the connection, and it does not intentionally access unrelated messages.
Subveris uses this Google user data only to provide and improve the user-facing Gmail subscription discovery, subscription tracking, renewal, cost, and account-management features you request. It is not used for advertising, profiling, credit or lending decisions, data brokerage, unrelated analytics, or generalized artificial-intelligence or machine-learning training.
Extracted subscription information is stored with your Subveris account in Supabase so the application can show subscription candidates and user-approved subscriptions. Full Gmail message content is not intentionally retained after processing. Gmail OAuth credentials are stored only as needed for the authorized Gmail scan, are not sold or shared for unrelated purposes, and are deleted when you disconnect Gmail or delete your account. You can request deletion of Gmail-derived subscription data by deleting your account or contacting Subveris.
Google user data is disclosed only to Subveris personnel and service providers necessary to operate the requested feature, primarily Supabase for authentication, database storage, and hosted API functions. It is not sold, rented, or transferred to advertising networks or other unrelated third parties. All use and transfer of Google user data follows the Google User Data Policy, including the Limited Use requirements.
What the Extension Collects
How We Use Extension Data
Extension data is used only to: (1) automatically detect your subscriptions without manual entry, (2) track usage patterns across your subscription services, (3) identify unused or redundant subscriptions, and (4) provide recommendations for cost optimization within the Subveris product. Gmail message content is processed to identify subscription services, prices, currencies, and renewal dates and is not intentionally stored as full email content. Extracted subscription candidates are synced to your Subveris account and remain pending until you approve them. This data is subject to the same privacy protections as manually entered data. Google user data is not used for advertising, profiling, unrelated analytics, generalized AI/ML training, or any purpose outside providing or improving the user-facing functionality of Subveris.
Privacy & Control
We use Stripe to process payments and Supabase for authentication, database storage, and hosted API functions. Extension usage records are associated with your Subveris account rather than being anonymous. These providers process data under their own privacy terms. We do not transfer, disclose, or provide Google user data to third parties except to the limited service providers described below when necessary to provide or improve a Subveris feature requested by you.
Your data is stored in Supabase Postgres. Google user data is transmitted over HTTPS/TLS and access is restricted to the Subveris service and authorized service providers needed to operate the Gmail scanning feature. Stripe secret keys and Supabase service-role credentials are intended to remain in server-side environment variables and are not required by the browser. The extension stores its session token in browser extension storage so it can sync data, and that local storage should be protected by the browser account and device security.
Supabase, Stripe, Google, and other providers may process data outside the European Economic Area, including in the United States. The specific transfer mechanism and safeguards must be confirmed for each provider before publication. We will document an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful mechanism where it applies. You can request information about the applicable safeguards by contacting us.
We use HTTPS for deployed web and API traffic and rely on Supabase and Stripe security controls for hosted infrastructure. We use row-level security policies for user-owned database records where configured. No security system is infallible, so keep your account credentials private and report suspected unauthorized access promptly.
Depending on applicable law, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, receive a portable copy, object to processing based on legitimate interests, and withdraw consent. You may also object to direct marketing at any time.
To exercise a right, email help.subveris@gmail.comfrom the address associated with your account and describe your request. We may ask for information needed to verify your identity. We will respond without undue delay and normally within one month. This period may be extended by up to two additional months for complex requests, and we will explain any extension. Account settings provide export and account-deletion actions, but the current automated export does not include every data category. Contact us for data not available through those actions.
Subveris uses strictly necessary cookies or browser storage for authentication, session security, CSRF protection, preferences, and keeping you signed in. The browser extension uses extension storage for its session token, plan status, and tracking queue. This policy does not state that optional analytics technologies are used. You can control cookies through your browser settings, but disabling necessary storage may prevent login or core features from working.
Contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD):www.dataprotectionauthority.be, Rue de la Presse 35, 1000 Brussels, Belgium, contact@apd-gba.be, +32 (0)2 274 48 00.
We may update this policy to reflect changes in the service, law, or our data practices. We will publish the revised policy here, update the effective date, and provide additional notice through the service or email when a change materially affects your rights.