1. Who is responsible for your data

The data controller within the meaning of the GDPR is:

Company name: JHUNTING SRL
Legal form: private limited liability company
Registered office: Oudesmidsestraat 20, 1700 Dilbeek, Belgium
Enterprise number (CBE): 0811.369.762
Contact: adm@abonea.app

ABONEA is a subscription tracking service. It helps you list your subscriptions, see what they cost and receive reminders before renewal dates.

2. What ABONEA does not do

These points define the service as much as what it does, and they limit the data we hold:

We never take any money. ABONEA is not a payment provider and carries out no transaction.
We store no banking data. No card number, no IBAN, no banking credentials. The payment methods you attach to a subscription are simply free-text labels you type in yourself, for example “Personal Visa” or “Joint account”.
We are not connected to your bank accounts. ABONEA detects no direct debit: you enter your subscriptions manually. The only time a statement is read is when you trigger it yourself with the analysis feature described in section 3.4, and the statement is never kept.
We do not sell your data and do not pass it on to any advertiser.

3. The data we process

3.1 Account data

Data	Status	Source
Email address	Required	You
Password (hashed, never readable)	Required	You
First name, last name	Optional	You
Phone number	Optional	You
Biography	Optional	You
Profile picture	Optional	You
Preferred language	Optional	You
Subscription logo	Optional	You

If you sign in through an external provider (Google, GitHub, etc.), we receive your email address from them and, where applicable, your name and profile picture.

3.2 Data you create in the service

Your subscriptions (service name, amount, billing frequency, start date, category, billing company), your wishlists, your payment method labels, your ratings and the alerts generated for you.

This data describes your consumption habits. It is accessible to you alone and is never shared with other users.

About the “hide a subscription” feature: it replaces the name, the category and the billing company with dots on screen, so that someone looking over your shoulder cannot read them. It is not encryption: the data remains stored in plain text on our servers, like all your other subscriptions. Do not rely on this feature to protect information you would rather not entrust to us.

3.3 Technical data

An activity log for your account, which you can consult in your settings: it records the date and the nature of important actions (sign-in, password change, enabling two-factor authentication, account deletion).

Your IP address is used at the time of the request to limit the number of calls and for the anti-bot check. It is not recorded in your activity log, and neither is your browser or your device.

3.4 Statements you submit for analysis

If you use the statement analysis feature (optional, reserved to the Premium plan), you submit a bank or card statement to us as a PDF or an image. The file is processed in memory, for the duration of the request, and is never saved: not the file, not the extracted lines, not the subscription proposals.

For a PDF: only the debit lines extracted from the document (date, label, amount) are transmitted to the analysis provider. Account numbers, card numbers, SEPA mandate references and structured communications are masked in them before sending. Transaction labels are transmitted as they are, and a label alone can reveal sensitive information, for example the name of a pharmacy.
For an image: the image itself is transmitted to the analysis provider, after resizing and removal of its metadata (including the GPS position). We cannot mask its content before sending: in that case our commitment is to keep nothing, not to mask.

The result of the analysis is shown to you for review, then discarded. Only the subscriptions you confirm are saved, like the ones you enter by hand (section 3.2). The processors that receive this data, Requesty and the model provider, are described in section 5.

3.5 Joining our email lists, without an account

On our site, you can leave your email address, without creating an account and without any commitment, to join one or more of these lists:

the waiting list, to be told when the service opens;
the mobile apps launch, to be told when they reach the App Store and Google Play;
the blog newsletter, to receive our new articles;
the professionals list, to be contacted about the Pro plan.

Each registration is separate and rests on its own consent: you can leave one list without leaving the others. For each registration, we record:

your email address;
the language you signed up in;
the list you chose;
your profession, if you chose to give it (professionals list);
the source that brought you to the form (for example a shared link or a campaign);
the date and time of your consent together with the version of the text you accepted, both stamped by our server and kept as proof of that consent.

This data is only used to send you the emails of the list you chose. The legal basis is your consent (art. 6(1)(a) GDPR).

You can withdraw it at any time through the unsubscribe link present in every one of those emails. Your registration on that list is then erased, not merely switched off.

Neither your IP address nor your browser is kept. The processor that receives this data to send the emails is named in section 5, and the retention period in section 6.

3.6 Emails that accompany your account

When you have an account, we send you a few emails to help you use ABONEA:

a reminder, if your email address is still unconfirmed one day after you signed up;
tips during your first month: adding your subscriptions, preparing a cancellation, then, after one month, a presentation of the paid plans and their trial;
during a free trial: tips to make the most of it, a reminder the day before it ends with the date and amount of the first charge, then a message if the trial ended without a subscription.

To tailor these emails, we use your first name, your language, the number and monthly total of the subscriptions you track, the number of statements analysed during the trial and a professional interest indicator.

This indicator is turned on if you answer “Yes” to the question asked after you sign up, if you arrive through a link meant for professionals, if you mark a subscription as professional or if you choose the Pro plan. It only adds tips about business subscriptions: it changes neither your account nor your rights.

The trial ending reminder warns you of a charge: it relies on the performance of a contract (art. 6(1)(b) GDPR), as does the address confirmation reminder. The tips rely on our legitimate interest (art. 6(1)(f) GDPR) in helping you use the service you created an account for.

You can refuse these tips at any time, through the unsubscribe link in each of them or from your account settings, on the web and on mobile. The trial ending reminder is still sent, because it concerns your billing.

These emails contain no tracking pixel and no redirected link: we measure neither opens nor clicks. They are sent by the provider that sends the service emails, named in section 5, not by the one used for our email lists. We only keep, for each email, the sequence step, whether it was sent or skipped, and its date, to follow how the sequences perform in aggregate statistics.

4. Why we process it

Purpose	Legal basis
Create and manage your account	Performance of a contract
Provide the subscription tracking service	Performance of a contract
Send you the emails the account requires (verification, password reset)	Performance of a contract
Send you the alerts you have enabled	Performance of a contract
Remind you of the end of your free trial and of the first charge	Performance of a contract
Send you tips to use your account, tailored to your professional interest	Legitimate interest, with a right to object at any time
Analyse a statement you submit, to propose subscriptions to you	Performance of a contract
Send you the emails of the lists you joined (waiting list, mobile apps launch, blog newsletter, professionals)	Consent (art. 6(1)(a) GDPR)
Measure the trial and subscription journey (usage statistics)	Consent (art. 6(1)(a) GDPR)
Count visits to the abonea.app presentation site, with no cookie and no identification	Legitimate interest
Analyse in detail how the abonea.app presentation site is visited (statistics cookie, clicks, recording of your browsing)	Consent
Secure the service (anti-bot, rate limiting, activity log)	Legitimate interest
Detect and fix errors and outages in the service	Legitimate interest
Comply with our legal obligations	Legal obligation

You stay in control of alerts: every notification type can be turned off in your settings.

5. Who else has access

We use technical service providers. Each one receives only what it needs:

Processor	Role	Data transferred
Hostinger	Hosting of the servers and the database	All service data
OVHcloud	Sending the service emails	Email address, message content
Cloudflare (Turnstile)	Anti-bot check at sign-up	IP address, verification token
Apple / Google	Push notifications, if you enable them	Device token, notification content
Requesty	Routing of statement analysis requests to the artificial intelligence model	Masked debit lines from a PDF, or the submitted image
Google (Gemini model)	Analysis of the statements to extract subscription proposals	The same data, received through Requesty
PostHog	Usage statistics, only if you consent	Opaque account identifier, journey events (including the catalog service picked), pages visited, masked session recording (web)
PostHog	Visit statistics of the abonea.app presentation site	Without your consent: pages viewed, origin, type of device, country. With your consent: in addition, visitor identifier, clicks, recording of your browsing. No account data
Acumbamail	Sending the emails of the lists you joined	Email address, language, declared profession, source
tawk.to	Support chat, as soon as you are signed in to the web application	IP address, account identifier, name, email address, messages exchanged, address and title of the pages viewed
Sentry	Detecting and fixing errors in the service	Error reports and technical diagnostic data (device, system, application version), account identifier

Requesty and Google are only involved if you use statement analysis. They act as processors, for the sole purpose of extracting subscription proposals, and are not allowed to use this data for any other purpose. The analysis model is chosen by ABONEA and may change; this policy will be updated if the provider changes.

Acumbamail is only involved if you joined one of our email lists (section 3.5). It acts as a processor, for the sole purpose of sending you the emails announced when you signed up, and is not allowed to use this data for any other purpose. The sending provider is chosen by ABONEA and may change; this policy will be updated if the provider changes.

tawk.to (tawk.to Inc., United States) provides the support chat shown at the bottom of the web application. It is loaded as soon as you are signed in, never on the public pages or in the mobile application. It then receives your IP address and technical information about your browser, your account identifier, your name and your email address, so that we know who to answer, the address and title of the pages of the application you view, then the messages you write there. The connection is cut when you sign out. It acts as a processor, for the sole purpose of answering you, and is not allowed to use this data for any other purpose.

If you enable push notifications for a hidden subscription, the notification shown on your lock screen uses the masked label, not the real name.

Images you choose to add (for example a custom logo on a subscription) are kept in our file storage service until you delete them or your account is deleted.

Our servers and our database are located in the European Union.

PostHog hosts the usage statistics on its EU Cloud offering, in Frankfurt, within the European Union. In the application, it is only involved if you have consented; on the abonea.app presentation site, it is limited to an anonymous count of visits as long as you have not accepted its statistics cookie (section 10).

Sentry (Functional Software Inc.) receives error reports and technical diagnostic data from the applications and our servers, limited to what is useful to detect and fix errors in the service. It acts as a processor, for this sole purpose, and is not allowed to use this data for any other purpose.

Apple, Google, Cloudflare, Requesty, Acumbamail, tawk.to and Sentry may process data outside the European Union within their own infrastructures, on the basis of the standard contractual clauses adopted by the European Commission.

6. How long we keep it

Data	Retention period
Account and associated data	As long as the account exists
Sign-in session	24 hours
Sign-in with “remember me”	7 days
Technical access token	10 minutes
Verification or password reset link	24 hours
Two-step verification code	5 minutes
Device inactive for notifications	90 days
Alert after you have read it	90 days
Activity log	12 months
Error reports and diagnostic data (Sentry)	90 days at most
Usage statistics (events), if you consent	12 months
Visits to the presentation site (anonymous count)	12 months
Detailed statistics of the presentation site, if you consent	12 months
Recording of your browsing on the presentation site, if you consent	30 days
Masked session recording (web), if you consent	30 days
Statement submitted for analysis	Not kept: processed in memory for the duration of the request
Preference, progress and send history of the account emails, professional interest indicator, getting-started progress	As long as the account exists
Email list registration	Until you unsubscribe from that list, and at the latest 36 months after your last consent to it

The technical logs of our servers are not kept in a database. Part of them is sent to Sentry to diagnose errors (section 5), for the period stated above.

Deleting your account. You can delete it at any time from your settings, after confirming your password. The following are then permanently erased: your email address, your password, your first name, your last name, your biography, your phone number, your preferred language, your profile picture, your custom subscription logos, your sessions, your sign-in tokens, your linked external accounts, your devices registered for notifications, your preference, the progress and the send history of the account emails, your professional interest indicator and your getting-started progress.

Your subscriptions, wishlists, payment method labels, alerts and notification rules are anonymised. In concrete terms: everything you entered yourself is erased (the subscription name, the billing company, the names of your payment methods, the text of the alerts), and the remaining rows are attached to a random identifier that is kept nowhere. No mapping is recorded, including on our side: the operation is irreversible.

What remains carries no identifying value and serves only for aggregated statistics: amounts, billing frequencies, categories and dates, with no name and no link to a person.

Your activity log is kept until the 12-month term mentioned above expires, for security purposes. It records neither your email address in plain text, nor your IP address, nor your browser: when a sign-in attempt fails, only an unreadable fingerprint of the identifier entered is kept, in order to detect repeated attacks.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability provided for by the GDPR. You may withdraw your consent at any time where the processing is based on it.

To exercise them, write to us at adm@abonea.app. We reply within one month.

You can change your information and delete your account directly from your settings.

Obtaining a copy of your data. Self-service export is announced in your settings as an upcoming feature: it is not available yet. In the meantime, send us your request by email and we will provide your data in a structured, machine-readable format, within the one-month period provided for by the GDPR.

If you consider that your rights are not being respected, you may lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels - www.autoriteprotectiondonnees.be).

8. Security

Passwords are hashed and can never be viewed. Exchanges between your device and our servers are encrypted (HTTPS). Access to data is limited to the people who need it. Two-factor authentication is available in your settings and we recommend that you enable it.

No system is infallible. In the event of a data breach presenting a risk to your rights, we will inform you and the competent authority, in accordance with the GDPR.

9. Cookies

Unless you act otherwise, the ABONEA application sets only the cookies that are strictly necessary for it to work: they keep you signed in and protect forms against fraudulent submissions. They are inaccessible to the page’s JavaScript and are not used to track you.

One functional cookie is added to them: if you reach the sign-up or sign-in page through a link that states your use (personal or professional), that choice is kept for 7 days at most, with no identifier, then applied to your account and deleted.

The support chat comes on top once you are signed in to the web application: our provider tawk.to (section 5) then sets its own cookies, readable by its script, and equivalent data in your browser’s storage, to find your conversation again from one page to the next. On the public pages, it sets nothing and is not contacted.

We use no advertising cookies. The usage statistics described in section 10 set no cookie and write nothing to your device before you consent: in the application, a visitor without an account, or who has not accepted, is never measured. That is why no banner is shown to you there: the consent is a preference of your account, asked at sign-up and changeable at any time in your settings.

On the abonea.app presentation site, a banner asks for your consent. If you accept, a statistics cookie, kept for 12 months at most, and equivalent data in your browser storage make it possible to recognise your browser from one visit to the next (section 10). If you decline, or as long as you have not chosen, no cookie is set; only your refusal is remembered on your device, so that you are not asked again. The “Cookie settings” link, at the bottom of every page of the site, lets you change your mind at any time.

10. Usage statistics

To understand at which step the trial and subscription journey stalls, we measure how the service is used with PostHog (PostHog Inc.), acting as a processor. The data is hosted on its EU Cloud offering, in Frankfurt, within the European Union.

Legal basis: your consent (Article 6(1)(a) GDPR). It is asked through a checkbox, unchecked by default, when you create your account, or through an invitation on your dashboard if your account was created through an external provider. Until you accept, nothing is collected: declining and never answering produce exactly the same result.

What is collected, once you have consented:

An opaque account identifier. Neither your email address, nor your name, nor any other profile data is transmitted.
Journey events, from a closed list. Twelve in total, for example “sign-up completed”, “trial started”, “trial converted” or “subscription purchased”. They carry only properties that are listed in advance too: plan, billing frequency, currency, amount bracket, language, whether a trial is running, where the event came from, a count, how you left the welcome screen (completed, skipped or statement import) and, when you add a subscription from the ABONEA catalog, the catalog service you picked (for example “Netflix”). Never the name you type yourself for a subscription, a category, a payment method, a billing company, an email address or an exact amount: an amount is reduced to a bracket (under 5, 5 to 15, 15 to 50, 50 to 100, over 100).
Pages visited. On the website and in the mobile application.
A session recording, on the website only. It is fully masked: every text is replaced with neutral characters, every input field is blanked, and service logos as well as your profile picture are excluded from the capture. It contains no audio and no image of your screen.

Retention: events are kept for 12 months and session recordings for 30 days, then deleted at PostHog.

Withdrawing consent: at any time, from your settings. Withdrawal stops all collection immediately, on the web and on mobile; data already collected is deleted at the end of the retention periods above.

Visits to the presentation site. The abonea.app site (home page and blog), separate from the application, uses the same tool, at two levels. As long as you have not made a choice in its banner, or if you decline, it only counts visits, with no cookie and without identifying you. For each page viewed, PostHog receives the address of the page, the page you came from, the type of device and browser, the country derived from your IP address and, where it happens, the click on a link leading to the application. Your IP address and your browser signature are only used to compute, at PostHog, an anonymous identifier that changes every day; they are not kept. It is then impossible to recognise you from one day to the next.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in knowing how much the site is visited. This count reads nothing from and writes nothing to your device. This data is kept for 12 months, then deleted at PostHog.

If you accept the site’s statistics cookie, PostHog gives your browser a random identifier, kept in that cookie, which makes it possible to recognise your successive visits. Added to it are your clicks and movements within the pages, display speed measurements and a recording of your browsing on the site, in which everything you type into a form is masked. This identifier is never linked to an ABONEA account. Legal basis: your consent (Article 6(1)(a) GDPR), which you withdraw at any time through the “Cookie settings” link at the bottom of every page of the site; the cookie is then deleted. Events are kept for 12 months and recordings for 30 days, then deleted at PostHog.

11. Minors

ABONEA is not intended for people under 16 and we do not knowingly collect their data. If you become aware that a minor under 16 has given us data, write to us at adm@abonea.app and we will delete it.

12. Changes

We may update this policy. Any substantial change will be notified to you by email or in the application before it takes effect. The date at the top of the page indicates the latest update.

Privacy Policy