Privacy Policy
This Privacy Policy explains how Sub Agent collects, uses, and protects information when you use the app. It is intended to match the data handling described in the App Store listing for the current production release, including the App Privacy disclosures shown in App Store Connect.
Data controller
Sub Agent is operated by Thenum ApS (CVR 40247165), Plantagevej 13, 3390 Hundested, Denmark. Thenum ApS is the data controller for the personal data described in this policy. You can reach us at [email protected].
Information we process
- Subscription, renewal, and budget information that you enter into the app.
- Settings and preferences such as reminders, currency, and app appearance.
- Purchase entitlement status provided by RevenueCat so the app can determine premium access and restore purchases.
- Product analytics events, including pseudonymous identifiers, app interaction events, screen views, feature usage data, device or app identifiers, and approximate location derived from IP-based GeoIP data sent to PostHog.
- Diagnostic, crash, and performance information used to keep the app reliable, including crash reports and technical context sent to Sentry.
- Basic interaction data related to external offers or outbound links shown in the app.
- If you choose to connect a bank account: account information such as account names, identifiers, and masked account numbers, and transaction data such as amounts, dates, currencies, and payment descriptions, accessed read-only with your explicit consent through our open banking provider.
How we use information
- To provide subscription tracking, reminders, and forecast features.
- To restore purchases and manage premium access.
- To improve app reliability, measure feature usage, and investigate failures.
- To review whether external offer surfaces are functioning correctly and safely.
- If you connect a bank account: to identify likely recurring charges in your own transactions and suggest them as subscriptions for you to review, confirm, or dismiss.
Bank account connections (open banking)
Sub Agent optionally lets you connect your own bank accounts so the app can find likely recurring charges. This feature is currently available for banks in Denmark. It works as follows:
- Your explicit consent. A bank connection is only created when you actively choose a bank and approve access by authenticating with your bank (for example with MitID). The legal basis for processing this data is your consent.
- Read-only access. We use an account information service to read account and transaction data. Sub Agent cannot move money, initiate payments, or change anything in your bank account.
- Provided through Enable Banking. Bank connectivity is provided by Enable Banking Oy, an authorized account information service provider, which processes your bank credentials consent flow and retrieves account data on our behalf.
- What we store. Our backend, hosted on Supabase, stores your bank connection record, basic account details (such as account name and a masked account number), and the derived subscription detections shown in the app. We do not build a server-side copy of your transaction history: raw transactions are processed transiently to derive detections and are not retained beyond short-lived technical processing of at most 24 hours.
- Retention. Connection data and derived detections are kept only while the bank connection exists. Authorization session records are deleted within 24 hours of completing, failing, or expiring. Inactive connections that are not linked to an account are revoked and deleted after 30 days of inactivity.
- Revoking access. You can disconnect a bank in the app at any time. Disconnecting deletes the connection, its account details, and its sync results from our backend and ends provider access. You can also revoke consent through your bank.
Manually entered subscription data stays on your device as described below. Bank connection data is the exception: it is processed and stored server-side as described in this section, because retrieving it from your bank requires a backend service.
App Store privacy categories
For the current production release, the App Store privacy disclosure categories for this app include coarse location, identifiers, product interaction, crash data, performance data, and other diagnostic data. These categories are used for analytics and app functionality and are disclosed in the App Store listing as data not linked to your identity.
Third-party processors
- RevenueCat processes purchase and entitlement data so the app can offer subscriptions, restore purchases, and confirm premium access.
- PostHog processes product analytics events so we can understand feature usage and improve the product.
- Sentry processes crash and diagnostic information so we can monitor app stability and investigate failures.
- Enable Banking (Enable Banking Oy, Finland) provides open banking connectivity and retrieves account and transaction data from your bank with your consent, if you use the bank connection feature.
- Supabase hosts the backend that stores bank connection records, account details, and derived subscription detections, if you use the bank connection feature.
Storage and processors
Subscription data, reminders, appearance settings, and currency preferences may be stored locally on your device. If premium purchases are used, RevenueCat processes entitlement and purchase state on our behalf. PostHog processes product analytics events. Sentry processes diagnostic and crash information used for app reliability. If you connect a bank account, bank connection records, account details, and derived subscription detections are stored on our Supabase-hosted backend as described in the bank account connections section above.
Analytics, diagnostics, and tracking
Sub Agent does not use data from this app for third-party advertising or cross-app tracking. Product analytics are used to understand how features are used and to improve the app. This may include approximate location information inferred by analytics providers from IP-based GeoIP data, such as country, region, city, or similar coarse location details. Crash, performance, and diagnostic data are used to maintain reliability and debug issues.
The app does not request your device's precise GPS location. When location-related analytics are present, they are approximate and inferred from network or IP-based GeoIP data rather than collected directly from device location services.
External offers and links
The app may show external offers or merchant links. When you open one of those links, you leave the app and the destination site’s own terms and privacy policy apply. We do not control third-party sites.
Data retention
Information is retained for as long as needed to provide the app, comply with legal obligations, resolve disputes, and maintain security. Retention may vary depending on whether data stays on-device or is processed by our service providers. Retention for bank connection data is described in the bank account connections section above.
Your choices
- You can change reminder and app preferences inside Settings.
- You can manage subscriptions through your Apple App Store or Google Play account.
- You can choose whether to interact with external offers or links.
- You can disconnect a connected bank at any time in the app, which deletes the connection and its data from our backend, or revoke consent through your bank.
Your rights
If you are in the European Union or European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including the right to access, correct, delete, and receive a copy of your personal data, the right to withdraw consent at any time (such as by disconnecting a bank), and the right to object to or restrict certain processing. To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with your supervisory authority; in Denmark this is Datatilsynet (www.datatilsynet.dk).
Contact
For privacy questions, contact [email protected].