Privacy Policy

NovelaSubscollects the minimum needed to run a membership streaming service. We do not sell your data, and we don't use advertising or analytics trackers.

Who is responsible

NovelaSubs is the data controller. For anything in this policy, or to exercise any of the rights below, email support@novelasubs.com.

What we collect, and why

• Account data — your email address, display name, and a hashed password. Needed to give you an account and to contact you about it. Basis: performing our contract with you.
• Membership data — your tier, subscription status, renewal date, and an identifier linking you to your Stripe customer record. Needed to bill you and to know what you can watch. Basis: performing our contract.
• Watch data— which episodes you've watched and how far through you are, so playback resumes and finished episodes drop off your list. Basis: performing our contract.
• Technical and security logs — request logs, and rate-limiting records which include your IP address, used to keep the service available and to stop abuse such as password guessing. Basis: our legitimate interest in a secure service.

We never receive your full card number. Card details go directly to Stripe, and we only ever see the last four digits and expiry that Stripe shows us.

Who processes it for us

We rely on a small number of specialist providers to run the service. Each acts on our instructions, handles only what its job needs, and may not use your data for anything of its own:

• Payments— handled by Stripe, who process your card, store your payment details, send your receipts, and run the billing portal you reach from your account page. We name them because you'll deal with them directly and their emails will arrive from their own address.
• Database and accounts — a managed database and authentication provider holds your account, membership and watch records. This data is stored in the European Union.
• Hosting and network — an application hosting provider and a network provider serve the site and keep short-lived request logs.
• Video delivery — a specialist video platform stores and streams the episodes.
• Email— an email delivery provider sends account messages such as verification and password reset, and forwards replies to our support address. It also sends announcements when new episodes go up; you can turn those off in your account settings or from the unsubscribe link in any of them, and you'll still get anything about your membership or payments.
• Error monitoring — when something breaks, a diagnostics provider in the European Union receives the error, the page it happened on, and your browser and operating system version, so we can find and fix it. It is deliberately configured not to receive your IP address, your cookies, or your session, and it does not record or replay what you do on the site.

Some operate outside your country, including in the United States. Where data leaves the EEA or UK, it's transferred under the safeguards those providers have in place, such as the European Commission's standard contractual clauses.

How long we keep it

• Account, membership and watch data: while your account exists, and deleted when you delete it.
• Payment and invoice records: retained by Stripe for as long as tax and accounting rules require, typically several years. These survive account deletion because we're legally required to keep them.
• Technical and security records: up to 90 days. This covers sign-in and account-change history, playback events, and the record of payment events Stripe sends us. Rate-limiting records, which include your IP address, are kept for one day.
• Records of administrative actions on the site are kept indefinitely, as an audit trail. These name the account acted on where relevant.

Your rights

Depending on where you live, you have some or all of these rights. We answer within 30 days and don't charge for it.

• See a copy of the data we hold about you.
• Correct anything wrong — you can edit your display name yourself from your account page.
• Delete your account and data — see account deletion.
• Receive your data in a portable, machine-readable form.
• Ask us to restrict processing, or object to processing we base on legitimate interests.
• Complain to your local data protection authority if you think we've got it wrong. We'd appreciate the chance to fix it first.

Cookies

Only what's needed to keep you signed in and to keep the site secure. No advertising cookies, no third-party analytics, no cross-site tracking — so there's no consent banner, because there's nothing to consent to.

Children

The service isn't intended for children under 13, and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.

Security

Traffic is encrypted in transit, passwords are hashed, and access to member data is restricted at the database level so one member can never see another's. No system is perfectly secure, but if a breach ever affects your data we'll tell you and the relevant authority as the law requires.

Changes

If we change this policy materially, we'll email you. The current version always lives on this page.