Privacy policy
SubSweep is operated by Qadan Analysis Consulting (ABN 20655113670) ("SubSweep", "we", "us"). We are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles, and, for bank data obtained through open banking, by the Consumer Data Right rules (see our separate CDR policy).
The short version: we analyse your transactions to find recurring charges, we keep only the results, and we never sell or share your data with advertisers.
1. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address and a hashed password | You, when you create an account | To log you in and send account emails |
| Bank transactions you upload as a CSV file | You | Processed in memory to detect recurring charges. Never written to disk. |
| Bank transactions from a connected bank | Basiq, with your explicit consent | Same purpose. Held in memory for your session only. See the CDR policy. |
| Your analysis results (merchant names, amounts, cadence, totals) | Derived by us from the data above | Saved to your account so your dashboard is there when you return and so monthly monitoring can spot changes |
| Subscription and payment status | Stripe | To know whether you are on the free or Pro plan. We never see or store your card number. |
| Basic technical data (IP address, browser, pages viewed) | Your browser | Security, rate limiting and fixing errors |
2. What we do not do
- We do not store raw transactions or statements. Uploads and bank data are processed in memory and discarded when your session ends.
- We do not sell, rent or share personal information with advertisers or data brokers.
- We do not use your data to train models or for any purpose other than running SubSweep for you.
- We do not provide financial product advice. SubSweep helps you review your own spending on subscriptions and does not recommend financial products.
3. Who we share data with
Only the service providers needed to run SubSweep, each limited to its role:
Basiq Pty Ltd (Australia) — accredited data recipient that retrieves your bank transactions under the Consumer Data Right when you connect a bank. Basiq's own privacy and CDR policies apply to its handling of your data.
Stripe — processes payments for SubSweep Pro. Card details are entered on Stripe's pages and never reach our servers.
Resend — sends account emails (verification, password reset, monthly monitoring).
Railway — hosts the application and database. Servers may be located outside Australia; we protect data in transit with TLS and at rest with access controls.
We may also disclose information where the law requires it.
4. Security
All traffic is encrypted with HTTPS. Passwords are stored as salted scrypt hashes. Sessions use signed, HTTP-only cookies. Access to production systems is limited to the people who operate the service. No system is perfectly secure, so please use a unique password.
5. How long we keep data
- Raw transaction data: not kept. Discarded from memory at the end of your session or when you start over.
- Analysis results and account details: for as long as your account exists.
- Anonymous visitors: nothing is kept after the session ends.
6. Your rights
You can access or correct your account details in the app. To delete your account and all associated data, tap your email address in the app and choose Delete my account — deletion is immediate and permanent, and any bank connection is revoked first. Full instructions are on the account deletion page. If you cannot log in, email hello@subsweep.com.au from your account address and we will confirm deletion within 10 business days. You can also turn off monthly monitoring at any time from the dashboard or the unsubscribe link in any monitoring email.
7. Cookies
We use only the cookies needed to keep you logged in and to keep anonymous sessions separate. We do not use advertising or cross-site tracking cookies.
8. Complaints
If you have a concern about how we handle your information, email hello@subsweep.com.au and we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes
We will post any changes to this policy on this page and update the effective date. Material changes will also be emailed to account holders.