Privacy Policy

1. Introduction

At SubStash, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

We are committed to transparency and protecting your personal data. By using SubStash, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Personal Information

When you purchase our services, we collect:

• Name: To personalize verification and customer support
• WhatsApp Number: For order communication and support
• Payment Information: Transaction details and amount paid
• Service Preferences: Which subscriptions you purchase

2.2 Automatically Collected Information

When you visit our website, we may automatically collect:

• Device Information: Browser type, operating system, device type
• Usage Data: Pages viewed, time spent, interaction patterns
• IP Address: For security and analytics purposes
• Cookies: To enhance user experience (see Section 7)

2.3 Third-Party Information

We do NOT collect sensitive information such as:

• Credit/debit card numbers (payments handled via secure third-party processors)
• National ID or passport numbers
• Biometric data
• Religious or political affiliations

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Delivery

• Process and fulfill your subscription orders
• Generate permanent verification URLs
• Provide customer support via WhatsApp
• Send service updates and notifications

3.2 Business Operations

• Improve our website and services
• Analyze user behavior and preferences
• Prevent fraud and ensure security
• Comply with legal obligations

3.3 Marketing (With Consent)

• Send promotional offers for new services
• Share updates about discounts and deals
• Provide personalized recommendations

Note: You can opt out of marketing communications at any time by contacting us on WhatsApp.

4. How We Share Your Information

We respect your privacy and do NOT sell your personal data. We only share information in these cases:

4.1 Service Providers

We may share data with trusted third parties who help us operate:

• Hosting Providers: To store our website and database (e.g., Vercel, database providers)
• Payment Processors: To handle secure transactions
• Analytics Tools: To understand website usage (e.g., Vercel Analytics)

These partners are contractually obligated to protect your data.

4.2 Legal Requirements

We may disclose your information if required by:

• Court orders or legal processes
• Government authorities investigating crimes
• Protection of our rights, property, or safety

4.3 Business Transfers

If SubStash is acquired, merged, or undergoes restructuring, your data may be transferred to the new entity. We will notify you of any such changes.

4.4 With Your Consent

We will never share your information for purposes not covered in this policy without your explicit consent.

5. Data Security

We implement industry-standard security measures to protect your information:

5.1 Technical Safeguards

• Encryption: All data transmitted via HTTPS/SSL encryption
• Secure Databases: Data stored in encrypted databases with restricted access
• Authentication: Admin access protected by strong passwords and session management
• Regular Backups: To prevent data loss

5.2 Organizational Safeguards

• Limited employee access to personal data (need-to-know basis)
• Regular security audits and vulnerability assessments
• Incident response procedures for data breaches

5.3 Your Responsibility

Important: Keep your verification URLs private if they contain sensitive information. While designed to be shareable, you control who sees them.

6. Data Retention

We retain your information for different periods based on its purpose:

6.1 Verification Records

• Duration: Permanent (indefinitely)
• Reason: To maintain proof-of-purchase for transparency
• Data: Name (partially masked), service type, plan, dates, verification ID

6.2 Contact Information

• Duration: Until subscription expiration + 1 year
• Reason: For customer support and renewal reminders
• Deletion: Automatically purged after retention period

6.3 Analytics Data

• Duration: 12 months
• Reason: To improve services
• Anonymization: Aggregated after 3 months

6.4 Legal Obligations

We may retain data longer if required by law (e.g., tax records for 7 years).

7. Cookies & Tracking Technologies

We use cookies to enhance your experience:

7.1 Essential Cookies

• Session Management: To keep you logged in (admin panel)
• Security: To prevent CSRF attacks

These cookies are necessary and cannot be disabled.

7.2 Analytics Cookies

• Vercel Analytics: To understand website usage
• Performance Monitoring: To identify and fix issues

These cookies do NOT track personal identity.

7.3 Managing Cookies

You can disable cookies in your browser settings, but this may affect website functionality. Most browsers allow you to:

• Block all cookies
• Accept only first-party cookies
• Clear cookies on exit

8. Your Privacy Rights

You have the following rights regarding your personal data:

8.1 Access & Portability

• Right to Access: Request a copy of your personal data
• Data Portability: Receive your data in a structured format (JSON/CSV)

8.2 Correction & Deletion

• Right to Rectification: Correct inaccurate information
• Right to Erasure: Request deletion of your data (with exceptions for legal/verification purposes)

8.3 Control & Objection

• Opt-Out of Marketing: Unsubscribe from promotional messages
• Restrict Processing: Limit how we use your data
• Object to Processing: Refuse data processing for certain purposes

8.4 How to Exercise Your Rights

To exercise any of these rights, contact us via WhatsApp at +92 324 8590699. We will respond within 30 days.

9. Third-Party Services

Our website may contain links to third-party services (ChatGPT, Perplexity, GitHub, etc.). We are NOT responsible for the privacy practices of these external sites.

When you click on these links, you leave our website and are subject to their privacy policies. We encourage you to review their terms before sharing personal information.

10. Children's Privacy

SubStash services are intended for users aged 18 and above. We do NOT knowingly collect information from minors under 18 years old.

If you are a parent/guardian and believe your child has provided us with personal information, please contact us immediately. We will delete such data promptly.

11. International Data Transfers

Your data may be transferred to and stored on servers located outside Pakistan (e.g., cloud providers in the US/EU). We ensure these transfers comply with applicable data protection laws.

By using SubStash, you consent to the transfer of your information to countries that may have different data protection standards than your country of residence.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The "Last Updated" date at the top will indicate when changes were made.

Material changes will be communicated via:

• Website notification banner
• WhatsApp message to active customers
• Email (if provided)

Your continued use of SubStash after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data:

• WhatsApp Support: +92 324 8590699
• Website: https://substash.com
• Response Time: Within 24-48 hours

We are committed to resolving your privacy concerns promptly and transparently.