Trialtrap
Menu

Privacy · Updated

What Trialtrap keeps, and for how long

Trialtrap finds the subscriptions you pay for and emails you before they charge. Petabyte d.o.o. in Zagreb, Croatia, runs it. This page lists what Trialtrap stores to do that, why, how long it keeps it, and who else handles it.

What Trialtrap never receives

Your mailbox password, and the text of your emails. Your AI assistant reads your mail through its own mailbox connection, under its provider's own privacy terms, and sends Trialtrap only the billing details listed under Scans below.

Your card details. You pay on Stripe's checkout page, so your card goes to Stripe, not to Trialtrap.

What Trialtrap stores

Where no time is given, Trialtrap keeps it until your account is deleted. To have it deleted, write to reminders@trialtrap.com. It is done by hand within one month, and your watches and usage events go with it. Payment records are the exception, below.

  • Your account. Your email address, a random account ID, when you joined, the date your paid access runs until, your Stripe customer ID, and the secret tokens behind your calendar feed and your email stop link. Also whether you stopped Trialtrap email, whether Resend reported mail to your address as bouncing or marked as spam, and when one-off emails such as a price alert went out, so each goes out once.
  • Your watches. What you confirmed for each charge: the merchant, the amount and currency if you gave them, the charge date and the day later renewals land on, the kind of charge and how often it repeats, how many reminders went out, and the secret token in its answer link. After a decision review, a watch also keeps the verdict, the yearly cost and saving, and what you said about using it. Watches outlast the scan, because the reminders are about them.
  • Scans. For each billing email your assistant finds: the sender's domain, the subject line, the date, the amount and currency, the merchant, the kind of charge, how often it repeats, how it was billed, a trial end date or earlier price where there is one, and a reference to the message. A decision review adds your answers and an optional note of up to 280 characters. All of it is deleted after 24 hours.
  • Payments. For each payment: Stripe's IDs for the checkout, payment, subscription, and invoice, the period it paid for, and any refund or dispute. Kept as long as accounting and tax law requires, even after your account is deleted.
  • Monthly digest, for subscribers. The subscriptions your latest full scan found (merchant, amount, currency, how often, next date, and status) and what each digest listed, so the next one can say what changed. No subject lines or email text. Deleted when your paid access ends.
  • Usage events. One row per step, such as a scan started, a watch set, or a reminder sent, with your account ID and a few small details: never your email address, a merchant name you typed, or an amount. Deleted after 400 days.
  • Sign-in links. Stored only as one-way hashes, with the address they went to, never as the link itself. A link for your assistant expires after 10 minutes. A link to your account page expires after 30 minutes, or after 24 hours when it confirms a reminder from the web form, which holds that reminder until then. An hourly cleanup removes them. Connecting an assistant also stores its sign-in grant, with token values kept only as hashes.
  • Sign-in limits. A count of recent sign-in emails per email address and per IP address, so no one can send too many. The addresses are stored only as hashes. Deleted a day after the last request.
  • Logs. Trialtrap writes a line to Cloudflare's logs when something fails, such as a reminder that could not be sent, and when an assistant connects or starts a decision review. A line written during a request also records the web address requested, without anything after the "?", with the IP address and approximate location the request came from. Kept for up to 7 days.

Deleted data can still be restored from Cloudflare's database backups for up to 30 days.

Why Trialtrap may use it

  • To run the service you signed up for (GDPR Art. 6(1)(b)): your account, sign-in, watches, scans, decision reviews, payments, and the emails that come with them.
  • With your consent (Art. 6(1)(a)): Google Analytics. You can withdraw it at any time, which stops it from then on.
  • For Trialtrap's legitimate interests (Art. 6(1)(f)): usage events, to see which steps work; the one-time line in a reminder about the subscription or the yearly plan, to tell you they exist; and sign-in limits and logs, to keep the service safe and working. You can object to any of these.
  • Because the law requires it (Art. 6(1)(c)): keeping payment records for accounting and tax.

Trialtrap needs your email address to sign you in and send reminders, so it can't open an account without one.

No decision with legal or similarly serious effects on you is made by automated means alone. Jev's verdict on a free option is advice: what you keep is up to you.

Google Analytics, only if you allow it

Google Analytics counts visits to the public pages: the home page, set-up, price increases, the cancel guides, this page, and the reminder form when you are not signed in. It loads only after you choose Allow in the banner at the bottom of the page. Allow and Decline look the same.

With your OK, Google stores the pages you view, the page that sent you, your device, and your approximate location, under a random ID with no link to a Trialtrap account. It keeps them for 14 months; totals, such as visits per page, stay in the reports after that. Ad storage and ad personalization stay off, and so do Google signals. Pages with a secret link or an account in them never load it: sign-in, your account page, reminder answers, email stops, checkout, and any form that shows an email address.

Cookies

  • _ga and _ga_<id>: Google Analytics' cookies, set only after you allow it. They carry the random ID and expire two years after your last visit, or sooner if your browser limits cookies.
  • trialtrap_analytics: remembers your Allow or Decline for 180 days.
  • __Host-trialtrap_web: keeps you signed in to your account page for 30 days. It is encrypted, and nothing about it is stored on the server.
  • __Host-trialtrap_oauth: holds a sign-in from your assistant for the 10 minutes it may take.

The last two are set only when you sign in, which needs them, so they do not ask first.

To withdraw your OK for Google Analytics, choose Cookie settings in the footer of this page, then Decline. Declining deletes the _ga cookies, and Google Analytics stops loading.

Who else handles your data

  • Cloudflare runs Trialtrap: the Worker that serves this site and the assistant tools, its database, and its key-value store. Everything under What Trialtrap stores lives there.
  • Resend sends Trialtrap's email: sign-in links, reminders, price alerts, and the monthly digest. It receives your address and what those emails say, and tells Trialtrap when mail to an address bounces or is marked as spam.
  • Stripe takes payments on its checkout page and runs the billing portal where you switch plans or cancel. Trialtrap sends it your email address and account ID. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.
  • OpenRouter passes requests to Jev, TypeSafe's model that judges whether a free option covers how you use a service. They receive the service name, what you said you use it for, in at most 280 characters, and the free options Trialtrap has on file. No email address or account ID goes with them.
  • Google runs Google Analytics on the public pages, only after you allow it.

Data sent outside the EU

All five companies above handle data in the United States. Each transfer rests on a safeguard the GDPR recognises:

  • Cloudflare, Stripe, and Google are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found protects data adequately. If a certification ends, their data processing terms fall back on the EU's standard contractual clauses.
  • Resend and OpenRouter have the EU's standard contractual clauses in their data processing agreements. Resend is also certified under the Data Privacy Framework.

The certifications are listed at dataprivacyframework.gov. Each company publishes its data processing terms on its site; for a copy, write to reminders@trialtrap.com.

Your rights

You can ask Trialtrap for any of these:

  • Access. What it holds about you, and a copy.
  • Correction of anything wrong or incomplete.
  • Deletion. Payment records stay as long as the law requires.
  • Restriction. Trialtrap keeps your data but stops using it, for example while it checks a correction you asked for.
  • Objection to the uses above that rest on Trialtrap's legitimate interests.
  • Portability. The data you gave Trialtrap, in a machine-readable file you can take elsewhere.

Write to reminders@trialtrap.com, and Trialtrap answers within one month. To withdraw your OK for Google Analytics, use Cookie settings in the footer.

You can also complain to a data protection authority: where you live, where you work, or where you think the breach happened. Petabyte d.o.o.'s authority is Croatia's Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr.

Questions and requests

Petabyte d.o.o. runs Trialtrap and is responsible for your data: the controller, in GDPR terms. Its address is Gradišćanska 26, 10000 Zagreb, Croatia.

Write to reminders@trialtrap.com with any question about this page or your data.

To stop Trialtrap email, use the stop link in any reminder, or Stop all Trialtrap emails on your account page.