Privacy Policy

The service “Subtraq” is published by GAM Communication LLC, a single-member limited liability company formed in the State of Wyoming, United States, filing number 2026-001871449, address 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States.

Contact for data questions: contact@subtraq.co.

The publisher is established outside the European Union — and the GDPR still applies. It applies as soon as a service is offered to people located in the Union, whatever the company’s country (Article 3(2) GDPR). You therefore have exactly the same rights as with a European company, and we handle them the same way.

Where to write, and to whom — as the publisher is established in the United States, it appoints a representative in the European Union under Article 27 GDPR; their name and address will be published here as soon as the appointment is made. Until then, and just as much afterwards, the address above remains the shortest route: it is read by the publisher itself, and no request about your data is delayed by this point. You may also contact your country’s supervisory authority directly (section 9).

This policy describes what data we process, why, with whom it flows, how long we keep it, and your rights under the GDPR and French data protection law.

Subtraq processes personal data in two distinct contexts with two different legal qualifications under the GDPR.

We explicitly list what we have chosen not to collect. These are deliberate design decisions, not technical limitations.

• IP addresses are never stored. They are read in memory only to determine country and detect bots, then immediately discarded. No IP is ever written to the database.
• No device fingerprinting. We do not combine browser characteristics to create persistent identifiers. This is forbidden by the product design, not just discouraged.
• No cross-device tracking beyond what you explicitly identify via identify().
• No third-party cookies. The SDK uses the client domain’s localStorage.
• The full referrer URL is never stored. Only the hostname is kept (e.g. instagram.com, not instagram.com/p/private-identifier…). The full path can contain personal data; we don’t take it.

The publisher itself. Your data stays stored in Germany, at Hetzner, and no copy is sent to the United States. When we look at that data to run the service and answer you, we are looking at our own database: the same company collected it and reads it. The GDPR reserves the notion of a “transfer outside the Union” for cases where data moves from one company to another company located outside the Union (European Data Protection Board, Guidelines 05/2021). That is not what happens here, so there is no transfer safeguard to put in place for your account data.

What protects this data is a set of concrete measures rather than a contract: all communications encrypted, a database that is not exposed to the internet, server access restricted to a single person through a dedicated key, encrypted backups, and a design rule that limits the damage in advance — we never write down your IP address.

The clicks from your campaigns are different: your agency entrusts them to us, two separate companies are involved, and that is indeed a transfer under the GDPR. It is governed by the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (controller-to-processor module), which form part of the data processing agreement signed with your agency. That document is available here — it can be signed as is — and on request at contact@subtraq.co.

Cloudflare processes each HTTP request at the nearest point of presence, which may be outside the European Union. Data transmitted to Cloudflare is limited to what is present in the standard HTTP request (headers, link URL). The link directory replicated in Cloudflare KV contains no personally identifiable data (no email, no IP).

Stripe transfers billing data between the EU and the US under standard contractual clauses (SCCs) approved by the European Commission.

Google: if Google OAuth is enabled, authentication data flows to Google servers. See Google’s privacy policy for the applicable framework.

For data for which GAM Communication LLC acts as data controller (your account data), you have the rights of access, rectification, erasure, restriction, objection and portability.

To exercise these rights: contact@subtraq.co — we respond within one month.

You can delete your account and all associated data yourself from your settings.

If you believe your rights are not being respected, you can lodge a complaint with the supervisory authority of the country where you live. In France, that is the CNIL (www.cnil.fr). The publisher being established in the United States does not take that remedy away from you.

For click data (Subtraq as processor): rights are exercised with the agency data controller, not directly with Subtraq.

Every click is analysed on receipt. Bots are identified by their User-Agent (crawlers, headless browsers, SEO tools, monitoring tools, programmable HTTP clients) or by HTTP method (a HEAD request is never a real human click).

We never delete bot clicks. We record and label them (flag isBot = true). Dashboards show human clicks by default, with a toggle to show bots. The full list of detection rules is published in our documentation. No silent filtering. Bot clicks do not count towards the monthly quota.

• All communications are encrypted in transit (HTTPS/TLS).
• Sessions are stored in httpOnly cookies, inaccessible from JavaScript.
• API keys are never stored in plain text — only their SHA-256 hash is kept.
• The database is dedicated, not publicly exposed, with encrypted daily backups.
• Server access is restricted by SSH with a dedicated key.

In the event of a data breach likely to result in a high risk to your rights, you would be notified as soon as possible, in accordance with Article 34 of the GDPR.

Any material change to this policy will be notified by email or in the application before it takes effect.