This Privacy Policy explains how Subfoxy ("we," "us," or "our"), operated by FogSaaS, collects, uses, stores, and protects your personal data when you use our subscription tracking platform available at www.subfoxy.com (the "Service"). This policy complies with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR").
By accessing or using Subfoxy, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller Identity
The data controller responsible for your personal data is:
For all matters related to data protection, you may reach us at the email address above.
3. Data We Collect
We collect and process the following categories of personal data:
3.1 Account Information
Full name — provided during registration
Email address — used for authentication, communication, and account recovery
3.2 Technical Data
IP address — collected automatically when you access the Service
Browser type and version — collected for compatibility and analytics purposes
Device information — operating system, screen resolution, and language preferences
3.3 Subscription Data
Subscription entries — names, costs, billing cycles, renewal dates, and categories of subscriptions you track within the Service
Usage patterns — features accessed, dashboard configurations, and interaction data
3.4 Payment Data
Last 4 digits of payment card — stored for reference and transaction tracking only
Subscription plan type — Free or Pro plan status
Billing history — invoice dates and payment status
We do not collect, store, or have access to your full credit card number, CVV, or any other raw financial data. All payment processing is handled securely by our payment partner, Lemon Squeezy.
3.5 Bank CSV Files
🔒 Important: When you use the bank statement import feature, your CSV files are parsed and processed entirely within your browser (client-side). The file data is never uploaded to our servers, transmitted over the network, or stored in any database. We have zero access to your bank transaction data.
4. Purposes of Data Processing
We process your personal data for the following purposes:
Service delivery — to create and manage your account, provide the subscription tracking dashboard, and enable all core features
Authentication and security — to verify your identity, protect your account, and prevent unauthorized access
Payment processing — to manage subscriptions to our Pro plan, process payments, and issue invoices
Communication — to send service-related notifications, renewal reminders, and respond to support requests
Analytics and improvement — to understand usage patterns, improve the Service, fix bugs, and develop new features
Legal compliance — to fulfill our obligations under applicable laws and regulations
5. Legal Bases for Processing
5.1 Under KVKK (Law No. 6698)
We process your personal data under the following legal bases as defined in Article 5 and Article 6 of the KVKK:
Article 5(2)(a) — Expressly prescribed by law: Processing necessary to comply with Turkish commercial and tax regulations
Article 5(2)(c) — Contractual necessity: Processing required for the performance of the service agreement between you and Subfoxy
Article 5(2)(ç) — Legal obligation: Processing necessary to fulfill our legal obligations as a data controller
Article 5(2)(e) — Establishment or protection of a right: Processing necessary for the establishment, exercise, or defense of legal claims
Article 5(2)(f) — Legitimate interests: Processing necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms
Article 5(1) — Explicit consent: Where no other legal basis applies, we will obtain your explicit consent before processing
5.2 Under GDPR
For users in the European Economic Area (EEA), we process personal data under the following legal bases as defined in Article 6 of the GDPR:
Article 6(1)(a) — Consent: Where you have given clear consent for specific purposes
Article 6(1)(b) — Contractual performance: Processing necessary for the performance of our contract with you
Article 6(1)(c) — Legal obligation: Processing necessary to comply with applicable law
Article 6(1)(f) — Legitimate interests: Processing necessary for our legitimate business interests, balanced against your rights
6. Data Sharing and Third-Party Services
We share your personal data with the following third-party service providers, strictly for the purposes described below:
Service Provider
Purpose
Data Shared
Location
Firebase (Google Cloud)
Authentication, real-time database, and cloud storage
Name, email, account data, subscription entries
United States / EU (Google Cloud regions)
Vercel
Website hosting and edge delivery
IP address, browser information (via server logs)
United States / Global CDN
Lemon Squeezy
Payment processing (PCI-DSS Level 1 compliant)
Email, payment card data (processed directly by Lemon Squeezy)
United States
We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes. Data may also be disclosed if required by law, court order, or governmental authority.
6.1 International Data Transfers
Some of our service providers are located outside of Turkey and the EEA. Where your data is transferred internationally, we ensure adequate safeguards are in place, including:
Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Contractual commitments from service providers to protect your data
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
Account data: Retained for the duration of your active account, plus 30 days after account deletion to allow for recovery
Subscription tracking data: Retained for the duration of your active account and deleted upon account closure
Payment records: Retained for 10 years in accordance with Turkish Commercial Code and tax regulations
Technical logs (IP, browser data): Retained for up to 12 months, then anonymized or deleted
Support correspondence: Retained for up to 24 months after resolution
When data is no longer needed, it is securely deleted or irreversibly anonymized.
8. Your Rights
Under both KVKK (Article 11) and GDPR (Articles 15–22), you have the following rights regarding your personal data:
Right of Access: Request information about whether your personal data is being processed and obtain a copy of it
Right to Rectification: Request correction of inaccurate or incomplete personal data
Right to Deletion (Erasure): Request deletion of your personal data when it is no longer necessary for the purposes for which it was collected
Right to Restriction: Request that we restrict processing of your data under certain circumstances
Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV)
Right to Object: Object to processing based on legitimate interests, including profiling
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
Right to Lodge a Complaint: File a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu) or a relevant EU supervisory authority
To exercise any of these rights, please contact us at info@subfoxy.com. We will respond to your request within 30 days as required by law.
9. Security Measures
We implement appropriate technical and organizational measures to protect your personal data:
Encryption in transit: All data transmitted between your browser and our servers is encrypted using 256-bit SSL/TLS encryption
Encryption at rest: Data stored in Firebase is encrypted at rest using Google Cloud's default encryption
Firebase Security Rules: Granular database access rules ensure that users can only read and write their own data
Authentication security: Firebase Authentication with secure token management and session handling
Access controls: Administrative access to data is restricted to authorized personnel only
Payment security: Payment processing is handled entirely by Lemon Squeezy, which is PCI-DSS Level 1 certified — the highest level of payment security compliance
Regular monitoring: We continuously monitor for security vulnerabilities and apply updates promptly
10. Children's Privacy
Subfoxy is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it immediately. If you believe a child has submitted data to us, please contact us at info@subfoxy.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
Update the "Last updated" date at the top of this page
Notify registered users via email for significant changes
Display a prominent notice on the Service
We encourage you to review this page periodically to stay informed about how we protect your data.
12. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
For complaints regarding data protection, you may also contact:
KVKK Authority (Turkey): Kişisel Verileri Koruma Kurumu — www.kvkk.gov.tr
EU Supervisory Authorities: Contact your local data protection authority in the EEA
California Consumer Privacy Act (CCPA) — Do Not Sell or Share My Personal Information
Under the California Consumer Privacy Act (CCPA), California residents have the right to:
Know what personal information is being collected about them
Know whether their personal information is sold or disclosed and to whom
Say no to the sale or sharing of their personal information
Access their personal information
Request deletion of their personal information
Equal service and price, even if they exercise their privacy rights
Subfoxy does not sell or share your personal information. We do not sell, rent, or trade personal information to third parties for monetary or other valuable consideration. Our revenue comes exclusively from subscription fees.
To exercise any of your rights under the CCPA, or if you have questions about our privacy practices, please contact us at: info@subfoxy.com
We will respond to verifiable consumer requests within 45 days.