Privacy policy

Last updated 1 September 2026

Residuals is the controller of the personal data described here. This policy covers Residuals — the app, the email it sends and the marketing site.

What we collect

Account data — your email address, your authentication records, and the name and picture Google gives us if you sign in with Google.
Profile settings — display name, business name, currency, timezone, country, default payment terms and default renewal percentage.
Business records you enter — brands and their contact names and emails, deals and line items, license windows, invoices, and the alerts generated from them.
Billing data — your plan, subscription status and the customer and subscription identifiers from Stripe. Card numbers are handled by Stripe and never reach our systems.
Email log — the recipient, template and outcome of each message we send for you, so nothing is sent twice and failures can be retried.
Technical data — IP address, browser type and error diagnostics in short-lived server logs, used to keep the service running and secure.

We do not ask for special-category data and Residuals has no advertising or cross-site tracking.

Why we use it, and on what basis

To provide the service — storing your records, calculating license status, producing invoices. Basis: performance of our contract with you.
To send the alerts and reminders you switch on, and renewal email you ask us to send. Basis: performance of our contract, and your settings as consent where consent is required.
To take payment and manage your plan. Basis: contract and legal obligation for tax records.
To keep the service secure and reliable, investigate abuse and fix faults. Basis: our legitimate interests.
To answer your support messages. Basis: legitimate interests.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your content to train machine-learning models.

Who can see your records

Only you and the processors listed below. Every row in our database is tied to an owning account, and database-level access rules restrict each row to that owner. Invoices are never published to public links. Our staff access production data only when needed to fix a fault or answer your request.

Residuals is run by a single operator, who can access account data to provide support or fix a fault. Every such access is logged, with the reason recorded.

Processors we use

Supabase

Database, authentication and hosting of your account records

Account email, profile settings, brands, deals, licenses, invoices, alerts

Cloudflare

Serving the app and protecting it from abuse

IP address and request metadata, in short-lived logs

Resend

Delivering alert, renewal and reminder email

Recipient email address and the contents of that message

Stripe

Taking payment and managing subscriptions

Billing email, payment details (held by Stripe, never by us), subscription status

These providers process data on our instructions under data-processing terms. Some are based in the United States; where data leaves your region we rely on the transfer mechanisms those providers offer, such as standard contractual clauses.

Email we send on your behalf

Renewal and reminder email goes only to a contact address you saved yourself, is sent from notify.residuals.dev, and identifies you as the sender with your address as the reply-to. Each send is logged before it goes out, capped per account per day, and never repeated for the same event. You can turn email alerts off in settings at any time; the in-app alerts continue.

What we never do

We never scrape, fetch or automate Meta, TikTok or any other advertising platform on your behalf. The “check the ads” buttons build an ordinary search link that opens in your own browser, and those platforms do not learn anything about you from us.

How long we keep it

Your records: for as long as your account exists.
After you delete your account: removed within 30 days, apart from billing and tax records we must keep for up to seven years.
Email log entries: 24 months.
Technical and security logs: up to 90 days.

Your rights

Depending on where you live, you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests — and you can withdraw consent for email at any time in settings. Most of this you can do yourself in the app: every brand, deal, license and invoice is editable and deletable. For anything else, email privacy@residuals.dev and we will respond within 30 days. We will not treat you differently for exercising a right. If you are in the EEA or UK you may also complain to your local data protection authority.

Security

Data is encrypted in transit and at rest by our hosting provider. Access to production systems is limited and authenticated, secrets are held in a managed store rather than in our code, and every database table denies access by default. No system is perfectly secure, so if a breach affects your data we will tell you and the relevant regulator as required by law.

Children

Residuals is for people aged 18 and over. We do not knowingly collect data from children; if we learn we have, we delete it.

Cookies

Residuals uses only the browser storage needed to sign you in, remember a sign-in attempt and remember your theme. See the cookie policy for the full list.

Changes to this policy

We will update this page when our practices change and, for material changes, email you or show a notice in the app before they take effect.

Contact

Residuals — privacy@residuals.dev for privacy requests, support@residuals.dev for anything else.