Privacy Policy

Last updated: July 5, 2026 · DRAFT — pending attorney review

Note to counsel: this draft was prepared without legal advice. Items needing review are bracketed [LIKE THIS]. Key open questions: GLBA applicability and required notices for a consumer fintech using bank-aggregation data; CCPA/state-law thresholds and required disclosures; whether the cancellation-agency language belongs here or only in the Terms.

Who we are

MySubscriptions ("we", "us") operates mysubscriptions.com, a service that helps you find recurring subscription charges by securely connecting your bank accounts and credit cards, and helps you cancel subscriptions you no longer want. This policy explains what we collect, why, and the choices you have. [COUNSEL: insert legal entity name, state of incorporation, and registered address.]

Information we collect

Information you give us

Account information: your name, email address, and a password (stored only as a secure hash).
Cancellation details: when you ask us to cancel a subscription for you, the information you provide so we can act — such as the email address on your account with that merchant, your plan name, and any notes.

Financial information, via Plaid

When you connect a bank account or credit card, you do so through Plaid Inc. Your bank username and password go directly to your bank through Plaid — we never see, receive, or store your bank credentials. Through Plaid we receive:

Account metadata: institution name, account name and type, and the last digits of the account number.
Transaction data: dates, amounts, merchant names and descriptions, and transaction categories — this is what lets us detect recurring charges.
Account balances.

Plaid's collection and use of your information is governed by its End User Privacy Policy. You can manage or revoke Plaid's connections at my.plaid.com.

Information collected automatically

Standard technical data: IP address, browser type, pages visited, and cookies necessary for the service to function (session and security cookies). We do not use advertising cookies or cross-site trackers.

How we use your information

Detect recurring subscription charges in your transactions and show them to you.
Carry out cancellation requests you make — including contacting the merchant on your behalf.
Send you service emails: cancellation status updates, alerts about upcoming or unexpected charges, and account notices. You can opt out of non-essential alerts.
Operate, secure, and improve the service, and comply with law.

What we do not do

We do not sell your personal information. [COUNSEL: confirm phrasing against CCPA "sale/share" definitions.]
We do not use your financial data for advertising or share it with data brokers.
We cannot move money — our access through Plaid is read-only.

When we share information

Plaid — to establish and maintain your bank connections, as described above.
Merchants — only the details needed to execute a cancellation you requested (for example, your name and the email on your merchant account).
Service providers — hosting, email delivery, and error monitoring vendors bound to use data only for providing services to us. [COUNSEL: list final vendors before launch.]
Legal — when required by law or to protect rights, safety, or the integrity of the service.

Data retention and deletion

We keep your data while your account is active. When you delete your account (Profile → Delete Account), we revoke our access to your bank connections at Plaid and permanently delete your accounts, transactions, detected subscriptions, and cancellation history from our systems. Backups age out within [COUNSEL/OPS: confirm backup retention window, e.g. 30 days]. You can also disconnect an individual bank at any time, which stops all future data collection from it.

Security

All traffic is encrypted in transit (TLS 1.2+).
Bank connection tokens are encrypted at rest; we never store bank credentials.
Access to production systems is restricted and logged.

Your rights

Depending on your state of residence, you may have rights to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising them. You can exercise access and deletion directly from your account, or email privacy@mysubscriptions.com. [COUNSEL: complete state-privacy-law section (CCPA/CPRA, VCDPA, etc.), verification procedure, response deadlines, and whether GLBA exemptions apply to any data categories.]

Children

MySubscriptions is for adults. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we make material changes, we'll email you and post the update here with a new "last updated" date.

Contact

privacy@mysubscriptions.com
[COUNSEL: add mailing address.]