Privacy Policy

The data controller for Subtally is 101010 ENTERPRISES LIMITED, 15 East Campbell Street, Glasgow, United Kingdom, G1 5DT. You can reach us about privacy at support@101010enterprise.shop or +44 7822363801.

Subtally is online-only software: a subscription ledger, reminder and cancel-script studio. This policy applies to our website, the studio tool and our support channels.

We keep collection to the minimum needed to run the service:

• Account data — the email address and password hash you register with, and your plan tier.
• Subscription entries you create — the names, amounts, cycles, renewal days and notes you type or paste into the studio, and the ledgers, diagrams and recaps generated from them.
• Billing data — a Stripe customer and subscription identifier, plan, currency (USD), and payment status. Card details are handled by Stripe, not by us.
• Support and lead data — your name, email, chosen topic and message when you contact us or ask for renewal nudges.
• Technical data — basic request logs (IP address, timestamp, user agent) needed for security and to keep the service running.

We do not ask for and do not want financial credentials, bank logins, card numbers or documents. Please do not paste them into the studio.

Our collection sources are limited and transparent:

• Directly from you — the subscription list and details you type or paste into the studio, and the information you register or send us.
• From Stripe — your billing and subscription status after you choose a plan.
• Automatically from your device — basic technical request logs (IP address, timestamp, user agent) generated when you use the site.

We do not buy data or pull it from data brokers or other third parties, and we never read your bank, card or inbox. These are the only collection sources we use.

Under the UK GDPR and EU GDPR we rely on these bases:

• To provide the studio and your account — performance of our contract with you.
• To take payment and manage subscriptions — performance of a contract and our legal obligations (tax, accounting).
• To answer support and store leads you send — our legitimate interest in helping you, or your consent for renewal-nudge emails.
• To keep the service secure and prevent abuse — our legitimate interests.
• Optional analytics or marketing emails — only with your consent, which you can withdraw at any time.

Payments are processed by Stripe. When you check out, your card details go directly to Stripe over an encrypted connection. Subtally never receives your full card number, CVC or expiry date; we only receive a token, the payment status and the last-four digits Stripe chooses to share. Stripe acts as an independent processor for card data under its own terms and privacy policy.

We share data only with processors that help us run the service, under contract and only as needed:

• Hosting & delivery — Vercel Inc. hosts the website and serverless functions.
• Payments — Stripe, Inc. processes subscriptions and billing.
• Database, auth & storage — Supabase, for accounts, saved tallies and lead capture.
• Email — our email provider, to send account, support and renewal-nudge messages.
• AI provider — where the site owner enables an AI assist for drafting text, only the entries needed for that request are sent; this is optional and off unless configured.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Some processors are based outside the UK and EEA, including in the United States. Where data is transferred internationally we rely on appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with each provider's security commitments.

• Account and saved tallies — while your account is active, then deleted or anonymised within 90 days of closure.
• Billing records — kept for up to 7 years to meet tax and accounting obligations.
• Support and lead messages — up to 24 months, then deleted.
• Security logs — a short rolling window, typically 30–90 days.

You can ask us to delete your data sooner, subject to legal retention limits.

Because Subtally generates content, we are explicit about how AI-related data is handled:

• User input — the subscription list and details you type or paste are processed only to produce the output you ask for. As you work, parsing and analytics run in your browser from your own user input; a saved tally is stored against your account so you can return to it.
• Generated output — the ledger, diagrams, email drafts and monthly recap are the generated output created for you. Saved generated output is stored with your tally and is deleted when you delete the tally or your account.
• Uploaded or sample data — any example or sample data you load is treated the same as your own input and is not retained beyond your session unless you save it.

Where the site owner enables an optional AI assist, only the specific user input needed for that request is sent to the AI provider to return your generated output. We do not use your user input, generated output or uploaded/sample data to train machine-learning models. You can delete a saved tally at any time, and deleting your account removes your stored user input and generated output.

We use a small number of strictly necessary cookies for sign-in and security. Any analytics or preference cookies are optional and set only with your consent. See our Cookie Policy for the details and how to change your choices.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data or complete incomplete data.
• Delete your data ("right to be forgotten"), subject to legal limits.
• Restrict or object to certain processing, including direct marketing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time where we rely on it.

California residents (CCPA/CPRA): you have the right to know, delete and correct your personal information, and to opt out of sale or sharing. We do not sell or share your personal information, so there is nothing to opt out of, but you may still exercise your other rights. We will not discriminate against you for doing so.

To exercise any right, email support@101010enterprise.shop. We respond within the time limits set by applicable law.

Subtally is not for children. It may not be used by anyone under 13. Users aged 13–17 must have consent from a parent or guardian, who is responsible for their use. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.

We do not make decisions with legal or similarly significant effects about you using solely automated processing. The studio's suggestions are organisational prompts, not automated decisions about you.

We protect data with encryption in transit, access controls, and reputable infrastructure providers. Subscription and spending details are treated as sensitive and minimised. No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant regulator of a qualifying breach as required by law.

If you have a concern, please contact us first at support@101010enterprise.shop. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local supervisory authority.

We may update this policy as the service changes. The date at the top shows the latest version, and material changes will be highlighted on this page.