Privacy policy
Effective 11 September 2026. This explains how ExpiryTracker processes personal data when you use this service.
Who is responsible?
MobX GmbH, Siemensstr. 2, 53121 Bonn, Germany is the controller for account, billing and service administration data. Contact contact@mobx.app for privacy questions or rights requests.
What we collect and why
We process your email, optional company name, expiry records, notes and renewal history to provide the service under Article 6(1)(b) GDPR. We process billing identifiers and transaction information for payments and legal accounting obligations under Articles 6(1)(b) and 6(1)(c). IP-derived rate-limit hashes, technical logs and session identifiers help prevent abuse and operate the service under Article 6(1)(f), our legitimate interest in a secure and reliable service. Do not put sensitive personal data or special-category data in record notes.
Sign-in and reminders
We send one-time sign-in links and the reminders you enable. We do not send marketing emails. Sign-in links expire after 15 minutes. The secure session cookie is necessary for the service and expires after 30 days. We do not use advertising cookies or third-party analytics.
Hosting and payments
Amazon Web Services hosts application data in Frankfurt (eu-central-1) and processes transactional email. CloudFront delivers the website globally. Stripe processes payments; we do not store card details. AWS and Stripe may process some data outside the EEA under their applicable contractual safeguards, including standard contractual clauses where required. See aws.amazon.com/privacy and stripe.com/privacy for their practices.
Retention and deletion
Records and history remain while your account exists. Delete individual records or delete your account in Settings. Reminder delivery logs are retained for up to 400 days; application logs for 14 days. Expired session and rate-limit records are removed automatically; AWS TTL deletion can be delayed. Database recovery backups can retain deleted data for up to 35 days. Payment records required by tax and accounting law are retained for the applicable legal period.
Your rights
You can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Download your account data and delete your account in Settings, or contact contact@mobx.app. You may complain to a data protection supervisory authority, including the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (ldi.nrw.de).
Business records and changes
You are responsible for having a lawful basis to enter personal information about others. For processor terms applicable to your business records, contact contact@mobx.app before adding employee or client personal data requiring a data processing agreement. We do not make automated decisions with legal or similarly significant effects. Material policy changes will be communicated through the service.