Privacy Policy
This Privacy Policy explains how POSEINOVA LLC (“ControlSubs”, “we”, “us”) collects, uses, shares and protects personal data when you visit controlsubs.com or use the ControlSubs application at app.controlsubs.com (together, the “Service”).
1. Who we are
| Data controller | POSEINOVA LLC |
|---|---|
| Registered address | 312 W. 2nd St #3805, Casper, WY 82601, United States |
| EIN | 38-4260075 |
| EU VAT ID | EU372054506 |
| info@controlsubs.com | |
| Phone | (323) 688-4073 |
2. Scope: two different roles
ControlSubs is a business tool. The way we handle personal data depends on whose data it is:
- We are the controller of data about you as a visitor or account holder: your registration details, billing information, support messages and technical data about your use of the Service. This Policy governs that data.
- We are a processor for the content you upload into your workspace — for example the names and email addresses of the employees you assign licences to. Your organisation decides why and how that data is used; we only process it to provide the Service, on your instructions. Those activities are governed by our Data Processing Agreement, available on request at info@controlsubs.com.
3. Data we collect
3.1 Data you give us
- Account data: name, email address, password (stored only as a cryptographic hash), organisation name and country.
- Billing data: billing name, address, country and VAT or tax identification number, plus the subscription plan you hold and your payment history. We never receive or store full card numbers.
- Workspace content: the subscription and licence records you create, including supplier names, prices, renewal dates, categories, and the internal users you assign to each licence.
- Communications: the content of emails, contact forms or support requests you send us.
3.2 Data we collect automatically
- Technical data: IP address, browser type and version, operating system, language, device type and referring URL.
- Usage data: pages viewed, features used, timestamps and error logs.
- Cookies: see section 6.
3.3 Data we do not want
The Service is not designed to hold special categories of data (health, biometrics, political opinions, and similar) and you should not upload it. We do not knowingly collect data from children under 16.
4. Why we use your data, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, providing the Service | Performance of a contract |
| Processing payments and issuing invoices | Performance of a contract; legal obligation |
| Sending service messages (renewal reminders, security notices, changes to terms) | Performance of a contract; legitimate interests |
| Providing customer support | Performance of a contract; legitimate interests |
| Securing the Service, preventing fraud and abuse, keeping audit logs | Legitimate interests |
| Analysing aggregated usage to improve the product | Legitimate interests |
| Marketing emails and newsletters | Consent (withdrawable at any time) |
| Keeping accounting and tax records | Legal obligation |
4.1 Benchmarking and aggregated statistics
We may produce aggregated, anonymised statistics about software usage across our customer base — for example, average spend per category within a professional sector. These statistics are irreversibly aggregated, never identify any individual or any organisation, and are not sold. If we ever intend to publish anything that could identify your organisation, we will ask for your consent first.
5. Who we share data with
We do not sell personal data. We share it only with service providers who process it on our behalf, under contract, and only as needed to run the Service:
| Provider | Purpose | Location |
|---|---|---|
| Railway | Application hosting and database | United States |
| Vercel | Web application hosting | United States / global CDN |
| Cloudflare | DNS, CDN and security | Global |
| Hostinger | Marketing website hosting | European Union |
| Stripe | Payment processing and invoicing | United States / Ireland |
| Resend | Transactional email delivery | United States |
| Google (Workspace) | Business email and productivity | United States / European Union |
We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets — in which case we will notify you before your data becomes subject to a different privacy policy.
An up-to-date list of sub-processors is available at info@controlsubs.com.
6. Cookies
We use only strictly necessary cookies: those that keep you signed in to the application, remember your session, and protect the Service against abuse. These are required for the Service to work and are exempt from consent requirements.
We do not use analytics, advertising or profiling cookies, and we do not track you across other websites. We verify our site with Google Search Console, which reports aggregated search performance and does not place cookies on your device or identify individual visitors.
If we introduce non-essential cookies in the future, we will ask for your consent through a cookie banner before setting them, and update this Policy.
7. International transfers
POSEINOVA LLC is established in the United States, and several of our providers are located there. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum where applicable, or the EU–US Data Privacy Framework where the recipient is certified under it. You can request a copy of the relevant safeguards at info@controlsubs.com.
8. How long we keep data
| Data | Retention period |
|---|---|
| Account and workspace data | For as long as your account is active |
| Data after account closure | Deleted or anonymised within 90 days, unless a longer period is required by law |
| Invoices and accounting records | As required by applicable tax law, generally between 4 and 7 years |
| Security and access logs | 12 months |
| Support correspondence | 24 months from last contact |
| Marketing consent records | Until you withdraw consent, plus proof of withdrawal |
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS), password hashing, strict tenant isolation so that each organisation can only access its own records, role-based access control, and restricted administrative access. No system is completely secure, but if a breach affecting your personal data occurs we will notify the competent supervisory authority and, where the law requires it, you.
10. Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to processing, including profiling and direct marketing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- lodge a complaint with your national data protection authority.
To exercise any of these rights, email info@controlsubs.com. We will respond within one month and may ask you to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
10.1 California residents
If you are a California resident, you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. Submit requests to info@controlsubs.com.
10.2 If your data is in someone else’s workspace
If your employer uses ControlSubs and your details appear as a licence holder, your employer is the controller of that data. Please direct your request to them; if you contact us, we will forward your request to them without undue delay.
11. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
12. Changes to this Policy
We may update this Policy as the Service evolves. The date at the top always reflects the current version. If the changes are material, we will notify you by email or through the application before they take effect.
13. Contact
Questions about this Policy or about how we handle your data:
POSEINOVA LLC
312 W. 2nd St #3805, Casper, WY 82601, United States
info@controlsubs.com · (323) 688-4073