Privacy Policy & GDPR

1. Who we are

Klaxo is a personal subscription management service operated by Edimilton Gomes Reis, a sole trader established in Portugal, acting as data controller. For any privacy-related matter, including a request for our full postal address, contact us at privacy@klaxo.app.

2. What data we collect

• Account data: name, email address, and (for password accounts) a bcrypt-hashed password.
• Subscription data: service names, amounts, currencies, billing cycles, and renewal dates that you enter manually.
• Billing data: your Stripe customer ID and subscription ID. We never store full card numbers — Stripe handles all payment data.
• Usage analytics: anonymous, cookieless page-view data via Plausible. No personal identifiers, no cross-site tracking.
• Analytics & marketing cookies (with consent): if you accept them in the cookie banner, Google Analytics (GA4) and the Meta Pixel set cookies to measure site usage and ad performance. These load only after you consent and can be withdrawn at any time — see Section 9.

3. Why we collect it (legal bases)

• Contract performance (Art. 6(1)(b) GDPR): to provide the Klaxo service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR): to detect abuse and improve the service using aggregated, anonymous analytics.
• Consent (Art. 6(1)(a) GDPR): for optional email alerts (disable anytime in Settings) and for analytics/marketing cookies (GA4, Meta Pixel) — these only load after you accept them in the cookie banner.

4. How we use your data

• To display your subscription dashboard and calculate spending totals in EUR.
• To send renewal alert emails and monthly summary emails (opt-out available in Settings).
• To process payments via Stripe.
• We never sell your data or share it with advertisers.

5. Sub-processors

6. International data transfers

The vast majority of your data is processed and stored within the EU/EEA. Where a sub-processor is based outside the EU/EEA — currently Google Analytics (GA4) and the Meta Pixel, both of which may involve a transfer of data to the United States — that transfer is safeguarded under the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. Both of these tools load only after you give explicit consent in the cookie banner (see Section 9).

7. Data retention

Your data is retained for as long as your account is active. When you delete your account (Settings → Delete account), all personal data is permanently removed from our database within 30 days. Anonymised analytics data is retained indefinitely.

8. Your rights under GDPR

As a data subject in the EU/EEA you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (available directly in Settings).
• Erasure — delete your account and all associated data.
• Portability — export your subscriptions as CSV (Pro feature).
• Objection / Restriction — object to or restrict certain processing.
• Withdraw consent — disable email alerts at any time in Settings.
• Lodge a complaint — with a supervisory authority, namely the CNPD in Portugal (cnpd.pt) or the data protection authority of your country of residence; for UK residents, the ICO (ico.org.uk).

To exercise any of these rights, email privacy@klaxo.app. We will respond within 30 days.

9. Cookies

Klaxo uses a single session cookie required for authentication. Plausible analytics is cookieless and always on. Google Analytics (GA4) and the Meta Pixel are off by default and only load after you accept analytics or marketing cookies in the cookie banner — you can accept, reject, or customize your choice at any time, and withdraw it just as easily.

10. Security

All data is encrypted in transit (TLS 1.3) and at rest. Passwords are hashed with bcrypt (12 rounds). We conduct periodic security reviews.

11. Contact

For privacy and GDPR enquiries: privacy@klaxo.app
For general support: support@klaxo.app
Website: www.klaxo.app