Section 1: Who we are and what this policy covers
This Privacy Policy describes how OpenSubs (“OpenSubs,” “we,” “us”) collects, uses, and shares information when you visit www.opensubs.com and its subdomains (the “Site”), contact us, or purchase and use the OpenSubs Insider Membership (the “Membership”). OpenSubs is operated from the United States and is the controller of the personal information described here. We have not appointed a data protection officer. Privacy questions and requests go to opensubsteam@gmail.com.
This policy does not cover the OpenSubs software itself once it is running on your infrastructure. section 2 explains why. The rules for using the Site and the Membership are in our Terms of Service.
Section 2: The software you run is not our data
The OpenSubs software is installed and runs on infrastructure you own or control, as your own Shopify app, connected to your own email, messaging, analytics, and other tools. It does not phone home. It contains no license check, telemetry, crash reporting, or other mechanism that sends information to OpenSubs. We do not receive, store, access, or process your store data, your orders, your subscription contracts, your customers’ personal data, or your subscribers’ payment details, and we have no technical means of doing so.
For all of that data, you are the controller under the GDPR and UK GDPR, and the business under U.S. state privacy laws. OpenSubs is neither a controller nor a processor of it. The hosting, database, email, and other providers you connect to your instance are your providers, under your agreements with them, not ours. Your obligations to your customers, including privacy notices, consents, rights requests, security, and breach notification, are yours.
If a future release of the software ever included an optional feature that sends information to OpenSubs, we would say so plainly in the release notes and update this policy before you could turn it on.
Section 3: What we collect and why
We collect information in a small number of situations. For visitors in the EU and UK, the legal basis for each is noted.
- When you visit the Site. Our hosting provider records the technical information any web server sees: IP address, browser and device type, pages requested, referring URL, and timestamps. We use it to deliver the Site, keep it secure, and count visits from the logs. Basis: our legitimate interest in running a working, secure website.
- When your browser loads our fonts. The Site loads typefaces from Adobe Fonts and Google Fonts. To deliver a font file, those services receive your IP address and the request details. Neither sets cookies for this purpose. Basis: our legitimate interest in presenting the Site as designed.
- When analytics and similar tools run. We use, or may add, website analytics, session and performance measurement, and advertising or conversion tags on the Site. These tools use cookies and similar technologies to collect information such as pages viewed, time on page, clicks, approximate location, device and browser details, referring site, and an identifier for your browser. We use this to understand how the Site is used, improve it, and measure and run marketing for OpenSubs. section 4 explains the categories and your choices. Basis: your consent where the law requires it for cookies, and otherwise our legitimate interest in understanding and promoting the Site.
- When you book a demo or contact us. We collect what you submit, typically your name, email address, company, store URL, and message. Demo requests currently go through a Typeform form. We use this information to respond to you and to follow up on your request. Basis: steps taken at your request before entering a contract, and our legitimate interest in responding to enquiries.
- When you purchase a Membership. We collect the details needed to set up and bill the Membership: your name, email address, company, Shopify store URL, billing address, the usernames you nominate for repository access, and your payment status. Payment card details are entered directly with our payment processor and never reach us; we see only what the processor tells us about the status of a payment. Basis: performance of our contract with you, and our legal obligations to keep tax and accounting records.
- When you use repository access. The service that hosts the software repository records which nominated accounts have access and when they download or interact with it, under that service’s own privacy policy. We use these records to manage access and to enforce the Terms of Service. Basis: performance of our contract with you.
- When we email you about your Membership. We send renewal reminders, release announcements, and other messages needed to run the Membership. We may also send occasional product news, which you can opt out of at any time using the link in the email. Basis: performance of our contract with you, and our legitimate interest in keeping Members informed about a product they have bought.
What we do not collect. We do not collect sensitive personal information, and we do not use automated decision-making that produces legal or similarly significant effects about you. We do not buy information about you from data brokers.
We may also use any of the information above to detect, prevent, and address security or abuse issues, to comply with the law, and to establish, exercise, or defend legal claims.
Section 4: Cookies and similar technologies
We use cookies, pixels, local storage, and similar technologies on the Site, and we allow some providers to set them. They fall into these categories:
- Essential. Needed for the Site to work, for example security, load balancing, remembering your cookie choices, and running the Book a Demo form (a Typeform embed that loads only when you open it and may then set Typeform cookies or local storage under Typeform’s privacy policy).
- Analytics and performance. Tell us which pages are visited, how people move through the Site, and how well it performs, so we can improve it.
- Marketing. Advertising and conversion tags that measure whether our marketing works and may be used to show you OpenSubs ads on other sites.
Where the law requires consent for non-essential cookies (for example in the EU and UK), we ask for it through a cookie notice before setting them, and you can change your choice at any time through that notice or the cookie settings link on the Site. Your browser also lets you block or delete cookies and local storage at any time; blocking some cookies may affect how the Site works. Font files come from Adobe Fonts and Google Fonts, which receive your IP address to deliver them and set no cookies for that purpose.
We treat a Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your information and of targeted advertising, and we honor it for the browser that sends it.
Section 5: Who we share information with
Providers that process information for us, on our instructions, to run the Site and the Membership:
- Vercel hosts and delivers the Site and holds its server logs. See Vercel’s privacy notice.
- Typeform runs the Book a Demo form. See Typeform’s privacy policy.
- A payment processor handles Membership payments and holds your card details under its own privacy policy. We name the processor on your Order and on any payment page you use.
- A source-code hosting service (such as GitHub) hosts the software repository and records access to it, under its own privacy policy.
- Google (Gmail) holds our email correspondence with you, and an email delivery service may send Membership emails on our behalf. See Google’s privacy policy.
- Analytics and advertising providers (for example Google Analytics, Meta, or similar services) that measure Site usage and marketing performance through the cookies described in section 4. Some of these providers use the information for their own purposes as well, under their own privacy policies.
Services your browser contacts directly, under their own policies rather than on our instructions: Adobe Fonts and Google Fonts, which receive your IP address to deliver the Site’s typefaces. See Adobe and Google.
We may also disclose information if the law requires it, to protect the rights, safety, or property of OpenSubs, our Members, or others, in connection with a merger, financing, or sale of our business or assets, or at your direction.
We do not sell personal information for money. Using advertising cookies and tags may count as “sharing” personal information for cross-context behavioral advertising, or as “targeted advertising,” under some U.S. state privacy laws. You can opt out through the cookie settings on the Site, by sending a Global Privacy Control signal, or by emailing opensubsteam@gmail.com.
Section 6: How long we keep information
We keep information for as long as the purpose it was collected for requires, and then delete or anonymize it. In practice:
- Server logs are kept by our hosting provider for its standard retention window, which is less than thirty days, and then discarded.
- Demo requests and enquiries are kept for twelve months after our last exchange with you, unless they lead to a Membership.
- Membership and billing records are kept for the life of the Membership and for seven years afterwards, to meet tax and accounting obligations and to handle any dispute.
- Repository access records are kept for the life of the Membership and twelve months afterwards.
- Email correspondence is kept for three years after our last exchange on the matter, and then deleted.
- Product-news mailing list entries are kept until you opt out.
- Analytics and cookie data is kept for the period set by each tool, at most twenty-six months, and cookie lifetimes are shown in the cookie notice.
We may keep information longer where the law requires it or where it is needed for a legal claim.
Section 7: Security
We use reputable providers with published security programs, TLS encryption for information in transit, two-factor authentication on our accounts, and access limited to the people who run OpenSubs. No system is perfectly secure, and we cannot guarantee the security of information. If a breach affecting your information creates a risk to you, we will notify you and any regulator the law requires, within the time the law sets.
Section 8: International transfers
We operate from the United States, so information you give us is stored and processed there and wherever our providers operate. Those countries may have data-protection rules different from your own. Where our providers move information about EU or UK residents outside those regions, they rely on recognized safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. You can ask us for details of the safeguards that apply to your information.
Section 9: Your rights and choices
Everyone. You can ask us to tell you what information we hold about you, to correct it, to delete it, or to give you a copy in a portable form. You can object to or ask us to restrict certain processing, and you can withdraw consent where we rely on it. You can opt out of product news at any time. To make a request, email opensubsteam@gmail.com. We may ask you to verify your identity, and we will respond within one month, or within the shorter period your local law sets. We will not discriminate against you for exercising a right.
EU and UK residents. The rights above are the rights the GDPR and UK GDPR give you. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue. You can also complain to the data protection authority in your country, or to the UK Information Commissioner’s Office, though we would welcome the chance to address your concern first. Providing the information described in section 3 for a Membership is a contractual requirement; without it we cannot provide the Membership.
Residents of California and other U.S. states. In the past twelve months we have collected the following categories of personal information: identifiers (name, email address, company, store URL, usernames), customer records (billing address), commercial information (Membership and payment status), internet activity (server logs, repository access records, and Site usage collected through cookies and analytics), and approximate location derived from your IP address. We collect them from you, from your browser, from our analytics and advertising providers, and from our payment processor and code-hosting service. We collect them for the purposes in section 3, disclose them to the providers in section 5, and keep them for the periods in section 6. We do not sell personal information for money. Advertising cookies may amount to “sharing” or targeted advertising under your state’s law; you can opt out through the cookie settings on the Site or a Global Privacy Control signal, which we honor. You can exercise the rights above, including the right to know, correct, delete, and opt out, by email, and you may use an authorized agent to do so.
Section 10: Children
The Site and the Membership are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under eighteen. If you believe a child has given us information, contact us and we will delete it.
Section 11: Changes to this policy
We may update this policy from time to time. We will post the updated policy on the Site with a new “Last updated” date and, for material changes, email Members at least thirty days before the changes take effect.
Section 12: Contact
Questions, requests, and complaints about privacy: opensubsteam@gmail.com.