Privacy Policy

1. Who is responsible for your data

The controller of the personal data collected through arkontrol.com and the arkontrol.app application is:

• Owner: Arkontrol
• Country: Spain
• Contact email: info@arkontrol.com
• Company registration and tax identification details: pending publication.

Write to that address about anything concerning your personal data, including the exercise of the rights described in section 8.

2. This website collects no personal data

The arkontrol.com site is a static page: it has no forms and sends no request to any third-party server beyond those described in section 9. Browsing this site creates no record tied to you beyond the technical server logs described in section 3.7 and, if you accept them, the analytics or marketing cookies described in the Cookie Policy.

Processing of personal data begins when you sign in to the application at arkontrol.app. The rest of this policy concerns that application.

3. What data we process

3.1. Your account data

Access to Arkontrol is exclusively through your Google account. We create no passwords and ask you to remember none. From that sign-in we receive your email address, your name and, if you have one, your profile picture. We do not receive your Google password and never have access to it.

3.2. The inventory you record

Arkontrol is an inventory: almost everything in it is written by you. That includes the names of the platforms you use, their category, web address and purpose; the plan name, cost, currency, renewal date and notes for each subscription; and the tags and categories you create to organise it.

3.3. Access accounts for each platform

For every platform you can record the email address you sign in with, the role you hold there, and whether that account has two-factor authentication enabled (a simple yes or no).

3.4. Password manager references (optional)

If you use a password manager, you can note which one you use, the name of the entry inside it, and its link. This reference helps you know where to look. You do not need a password manager to use Arkontrol: your password stays wherever you keep it and never reaches Arkontrol.

3.5. Payment methods

You can create labels to distinguish which card or method pays for each subscription. For each one we store only the name you give it and, optionally, the last four digits. Never the full number, the expiry date or the security code.

3.6. Google Calendar connection

If you choose to sync your renewals with Google Calendar, Arkontrol creates a secondary calendar named "Arkontrol" in your account and writes your renewal events to it. We store the Google address of the connected account, an encrypted refresh token that lets us create and update those events, the identifier of that calendar and the identifier of each event Arkontrol has created. The permission requested reaches only that calendar: Arkontrol cannot see or modify your personal calendars, and it does not read your mail, your contacts or your files. When you disconnect the sync from the application, the "Arkontrol" calendar is deleted along with the events it contains; you can also revoke the permission at any time from your Google account security settings.

3.7. Alert records and technical logs

When we send you a renewal alert by email, we record which subscription triggered it, how many days in advance, and on what date it was sent. This record exists so we do not send you the same alert twice. In addition, the servers hosting the service generate ordinary technical logs (IP address, date, time and requested resource) for security and diagnostic purposes.

3.8. Invoices you attach (Pro and Ultra plans)

If your plan includes it (Pro and Ultra, and also during the free trial), you can attach invoice files to each subscription, as PDF or image files of up to 5 MB each. They are stored in a private Supabase space tied to your account and may contain the personal data that appears in them, such as your name or billing address. You can delete them yourself in the application, and we also delete them if you request erasure of your account.

3.9. Purchases and the free trial

When you purchase a plan, payment is made on Stripe's payment page. From the purchase, Arkontrol keeps only the plan you bought and its status; payment details are handled by Stripe and we do not store them (see section 6).

To grant the free trial only once, we store the internal identifier that Google assigns to your account (not your email or your name). We keep it even if you delete your account, because its only purpose is to prevent another free trial from starting with the same Google account. Legal basis: our legitimate interest in preventing abuse of the service.

4. What Arkontrol never stores

By design, and not as a promise that depends on our good intentions, Arkontrol has nowhere to store:

• Passwords for your platforms.
• Two-factor authentication codes or their generating secrets.
• API keys or third-party service tokens other than the Google Calendar token described in section 3.6.
• Full card numbers, expiry dates or security codes.

We also ask you not to type them into free-text fields such as notes: those are ordinary text fields, meant for reminders, not for secrets.

5. Why we use your data, and on what legal basis

• To provide the service (storing your inventory, calculating your monthly and annual cost, showing your renewals and letting you sign in): legal basis, performance of the contract you accept by using Arkontrol.
• To send you renewal alerts by email: performance of the contract, since this is one of the service's core functions. You can turn them off at any time in your preferences.
• To sync with Google Calendar: your consent, given when you connect the account and withdrawn by disconnecting it.
• To keep the service secure and available (technical logs, abuse prevention, backups): our legitimate interest in protecting the service and the people who use it.
• To reply to your messages when you write to us: legitimate interest in assisting you.
• To comply with legal obligations, including tax and accounting ones where payments exist: legal obligation.

We do not use your data for advertising, we build no commercial profiles, we make no automated decisions with legal effects on you, and we neither sell nor share your information with anyone.

6. Who else processes your data

To operate, Arkontrol relies on a deliberately small number of providers. All of them act as data processors: they process data on our instructions and may not use it for their own purposes.

• Supabase — database and authentication system. This is where your inventory lives.
• Google — sign-in and, if you enable it, Google Calendar sync.
• Resend — delivery of renewal alert emails.
• Hostinger — hosting for the website and the application.
• logo.dev — the service that supplies platform logos. When the application displays a logo, your browser requests it directly from logo.dev, which therefore receives your IP address and the usual technical data of that request, along with the domain of the platform whose logo is shown. It receives neither your identity nor the rest of your inventory.

To charge for paid plans we also use Stripe, which processes the payment on its own page: Stripe handles your card details and those needed to calculate and record the applicable tax, in line with its own privacy policy. Arkontrol never stores your full card details.

7. International transfers and retention

Some of the providers above, and also Stripe, are based, or run infrastructure, outside the European Economic Area, chiefly in the United States. Those transfers rely on the mechanisms set out in the General Data Protection Regulation: standard contractual clauses approved by the European Commission or, where applicable, the adequacy decision covering the provider.

We keep your inventory for as long as your account is active. If you request deletion, it is removed along with all its associated content: the database is structured so that deleting your workspace cascades to your platforms, accounts, subscriptions and tags. Technical logs are kept for short periods, and data subject to tax or accounting obligations for the periods required by law. The Google identifier described in section 3.9 is the one exception.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given. Many of these you can exercise directly in the application: your inventory is editable and deletable at all times.

For the rest, write to info@arkontrol.com from the email address associated with your account. We will respond within one month at most. The Pro and Ultra plans (and the free trial) let you export your subscription inventory to a CSV file from within the application. If your plan does not include that feature, or you need a copy of other data of yours, we will provide it in a structured, commonly used and machine-readable format, handling your portability request manually through that same address.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

9. Cookies and browser storage

When you visit arkontrol.com we show a notice so you can choose which cookies, beyond the strictly necessary ones, you want to allow; analytics and marketing cookies only activate if you explicitly accept them, and you can change your decision at any time from "Cookie preferences" in the footer. Details of each category are in the Cookie Policy.

The application uses only the strictly necessary cookies required to keep you signed in: without them, signing in would not be possible. Because they are essential to deliver a service you have requested, they do not require prior consent. The application also stores preferences such as light or dark theme in your browser's local storage; that information never leaves your device.

10. Minors

Arkontrol is intended for people over 18. We do not knowingly collect data from minors. If we find that an account belongs to someone under that age, we will delete it.

11. Security

Each workspace is isolated by row-level security policies in the database: one account's data is not reachable from another. Access always takes place over an encrypted connection. The Google Calendar token is stored encrypted. Even so, no system is infallible: should a security breach affect your data, we will inform you and notify the supervisory authority as required by law.

12. Changes to this policy

If we amend this policy, we will update the date at the top of this page. Where the change is substantial (for example, adding a new provider or a new purpose) we will tell you by email or through a visible notice in the application before it takes effect.