Privacy Policy

1. Who is responsible for your data

The controller of the personal data collected through arkontrol.com and the arkontrol.app application is:

• Owner: Arkontrol
• Country: Spain
• Contact email: info@arkontrol.com
• Company registration and tax identification details: pending publication.

Write to that address about anything concerning your personal data, including the exercise of the rights described in section 8.

2. This website collects no personal data

The arkontrol.com site is a static page: it has no forms and sends no request to any third-party server beyond those described in section 9. Browsing this site creates no record tied to you beyond the technical server logs described in section 3.7 and, if you accept them, the analytics or marketing cookies described in the Cookie Policy.

Processing of personal data begins when you sign in to the application at arkontrol.app. The rest of this policy concerns that application.

3. What data we process

3.1. Your account data

Access to Arkontrol is exclusively through your Google account. We create no passwords and ask you to remember none. From that sign-in we receive your email address, your name and, if you have one, your profile picture. We do not receive your Google password and never have access to it.

3.2. The inventory you record

Arkontrol is an inventory: almost everything in it is written by you. That includes the names of the platforms you use, their category, web address and purpose; the plan name, cost, currency, renewal date and notes for each subscription; and the tags and categories you create to organise it.

3.3. Access accounts for each platform

For every platform you can record the email address you sign in with, the role you hold there, and whether that account has two-factor authentication enabled (a simple yes or no).

3.4. Password manager references (optional)

If you use a password manager, you can note which one you use, the name of the entry inside it, and its link. This reference helps you know where to look. You do not need a password manager to use Arkontrol: your password stays wherever you keep it and never reaches Arkontrol.

3.5. Payment methods

You can create labels to distinguish which card or method pays for each subscription. For each one we store only the name you give it and, optionally, the last four digits. Never the full number, the expiry date or the security code.

3.6. Google Calendar connection

If you choose to sync your renewals with Google Calendar, we store the Google address of the connected account, an encrypted refresh token that lets us create and update those events, and the identifier of each event Arkontrol has created. The permission requested is limited to calendar events; we do not read your mail, your contacts or your files. You can disconnect the sync at any time from the application and revoke the permission from your Google account security settings.

3.7. Alert records and technical logs

When we send you a renewal alert by email, we record which subscription triggered it, how many days in advance, and on what date it was sent. This record exists so we do not send you the same alert twice. In addition, the servers hosting the service generate ordinary technical logs (IP address, date, time and requested resource) for security and diagnostic purposes.

4. What Arkontrol never stores

By design, and not as a promise that depends on our good intentions, Arkontrol has nowhere to store:

• Passwords for your platforms.
• Two-factor authentication codes or their generating secrets.
• API keys or third-party service tokens other than the Google Calendar token described in section 3.6.
• Full card numbers, expiry dates or security codes.

We also ask you not to type them into free-text fields such as notes: those are ordinary text fields, meant for reminders, not for secrets.

5. Why we use your data, and on what legal basis

• To provide the service (storing your inventory, calculating your monthly and annual cost, showing your renewals and letting you sign in): legal basis, performance of the contract you accept by using Arkontrol.
• To send you renewal alerts by email: performance of the contract, since this is one of the service's core functions. You can turn them off at any time in your preferences.
• To sync with Google Calendar: your consent, given when you connect the account and withdrawn by disconnecting it.
• To keep the service secure and available (technical logs, abuse prevention, backups): our legitimate interest in protecting the service and the people who use it.
• To reply to your messages when you write to us: legitimate interest in assisting you.
• To comply with legal obligations, including tax and accounting ones where payments exist: legal obligation.

We do not use your data for advertising, we build no commercial profiles, we make no automated decisions with legal effects on you, and we neither sell nor share your information with anyone.

6. Who else processes your data

To operate, Arkontrol relies on a deliberately small number of providers. All of them act as data processors: they process data on our instructions and may not use it for their own purposes.

• Supabase — database and authentication system. This is where your inventory lives.
• Google — sign-in and, if you enable it, Google Calendar sync.
• Resend — delivery of renewal alert emails.
• Hostinger — hosting for the website and the application.
• logo.dev — the service that supplies platform logos. When the application displays a logo, your browser requests it directly from logo.dev, which therefore receives your IP address and the usual technical data of that request, along with the domain of the platform whose logo is shown. It receives neither your identity nor the rest of your inventory.

When paid plans become available, a payment provider will be added, and it will appear on this list before it is possible to subscribe. Arkontrol will under no circumstances store your full card details: those will be handled directly by that provider.

7. International transfers and retention

Some of the providers above are based, or run infrastructure, outside the European Economic Area, chiefly in the United States. Those transfers rely on the mechanisms set out in the General Data Protection Regulation: standard contractual clauses approved by the European Commission or, where applicable, the adequacy decision covering the provider.

We keep your inventory for as long as your account is active. If you request deletion, it is removed along with all its associated content: the database is structured so that deleting your workspace cascades to your platforms, accounts, subscriptions and tags. Technical logs are kept for short periods, and data subject to tax or accounting obligations for the periods required by law.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given. Many of these you can exercise directly in the application: your inventory is editable and deletable at all times.

For the rest, write to info@arkontrol.com from the email address associated with your account. We will respond within one month at most. Automatic CSV export of your data is not yet available; until it is, we will handle portability requests manually through that same address.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

9. Cookies and browser storage

When you visit arkontrol.com we show a notice so you can choose which cookies, beyond the strictly necessary ones, you want to allow; analytics and marketing cookies only activate if you explicitly accept them, and you can change your decision at any time from "Cookie preferences" in the footer. Details of each category are in the Cookie Policy.

The application uses only the strictly necessary cookies required to keep you signed in: without them, signing in would not be possible. Because they are essential to deliver a service you have requested, they do not require prior consent. The application also stores preferences such as light or dark theme in your browser's local storage; that information never leaves your device.

10. Minors

Arkontrol is intended for people over 18. We do not knowingly collect data from minors. If we find that an account belongs to someone under that age, we will delete it.

11. Security

Each workspace is isolated by row-level security policies in the database: one account's data is not reachable from another. Access always takes place over an encrypted connection. The Google Calendar token is stored encrypted. Even so, no system is infallible: should a security breach affect your data, we will inform you and notify the supervisory authority as required by law.

12. Changes to this policy

If we amend this policy, we will update the date at the top of this page. Where the change is substantial (for example, adding a new provider or a new purpose) we will tell you by email or through a visible notice in the application before it takes effect.