Privacy Policy

1. Defined terms

Capitalized words have the meaning defined below wherever they appear in this policy.

Data controller

After Clinic Solutions Limited (C 116428), publisher of https://www.bank-fees.com, who determines the purposes and means of the processing described here.

Subscriber

Anyone with an account on bank-fees.com, on free trial or on a monthly plan.

Operation

Each of the five acts that BankFees performs for a Subscriber: Detection, Optimization, Claiming, Cancellation, Proof.

Detection

The identification of recurring direct debits and active subscriptions associated with a Subscriber.

Optimization

Comparison of a detected debit with alternatives and alert when the Subscriber is overpaying.

Claim

The preparation and filing of a refund request for an amount the merchant owes the Subscriber.

Cancellation

The cessation of a subscription detected in the Subscriber's name, by electronic registered mail if the merchant requires it.

Proof

The certified and timestamped recording of a Cancellation or Claim, downloadable from the account.

Processor

A provider named in clause 10, processing the Subscriber's data on the basis of written instructions from the Data Controller and on no other basis.

2. Data Controller and Contact Information

https://www.bank-fees.com is published by After Clinic Solutions Limited (C 116428), with registered office at , VAT number MT33128134. It is the Data Controller for everything stated in clauses 4 through 8.

• Questions about data protection and exercising rights: [email protected].
• One ongoing operation, account, or send: [email protected].
• Accounting documents and invoice copies: [email protected].

3. Applicable instruments

1. Regulation (EU) 2016/679, GDPR, for Subscribers located in the European Union.
2. Law No. 78-17 as amended, French data protection law, for Subscribers in France.
3. The Data Protection Law (PDPL) as it applies in Malta, the place of registration of the data controller.

4. Detection: Data Collected Before and During Analysis

No data is collected unless an Operation requires it. Detection relies on five datasets:

• Identification: first name, last name, postal address, email address, phone number, country.
• Account: username, password stored in hashed form, subscription history, issued invoices.
• Payment: the card number and bank identifiers are entered in and kept by Stripe. The Data Controller receives only a token and status, and never sees the card number.
• Direct debit records: merchant, amount, currency, date and frequency of each identified recurring payment.
• Technical: IP address, device type, browser, server logs and cookies listed in clause 12.

5. Optimization and Claim: data added afterward

Optimization reuses the debit records from clause 4 and adds the plan level, options, and usage the Subscriber declares. No additional identity data is requested.

A Claim adds the claimed amount, merchant reference, disputed dates and any supporting evidence uploaded.

Claim and Cancellation letters are written with the help of an AI text generation interface, which retains no personal data once the draft is returned.

6. Cancellation and Proof: data leaving the platform and data retained

• Documents downloaded by the Subscriber and templates created in the account.
• Sender and Recipient Postal Addresses, Transmitted to the Printing and Postal Delivery Partner for Delivery.
• History of shipments and tracking events returned by the postal operator.
• The certificate and timestamp forming the Proof, retained per clause 8.

7. Purposes and Legal Bases

8. Data Retention Periods

Files and documents provided by the Subscriber are automatically deleted at the end of the subscription or account closure.

9. Hosting, backups, and transfers outside the Union

Data resides on the secure servers of OVHcloud (OVH SAS)., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (https://www.ovhcloud.com), within the European Union, in Lithuania and the Netherlands.

Backups and part of technical administration are performed from Malta.

When data leaves the Union for support or technical reasons, the Data Controller relies on the European Commission's Standard Contractual Clauses under Article 46 of the GDPR and on equivalent safeguards required by PDPL, so that the transfer does not weaken protection.

10. Recipients and processors

Personal data is neither sold nor rented. Disclosure is limited to the recipients below for the task indicated against each.

• Stripe Payments Europe Ltd.: processing card payments.
• OVHcloud (OVH SAS).: hosting and backups.
• Google LLC: audience measurement via Google Analytics 4.
• Postal operators and printing partners: production and delivery of registered letters.
• An AI text generation API (OpenAI): drafting assistance, with no personal data retained after processing.
• Support, routing, and other technical suppliers under contract.
• Administrative or judicial authorities, when the law requires disclosure.

Each Processor is bound in writing to comply with confidentiality and security obligations of clause 11.

We use Stripe for payment services, analytics, and other business services. Stripe collects identifying information from devices connecting to its services. Stripe uses this information to operate and improve the services it provides us, including for fraud detection. You can learn more about Stripe and review its privacy policy at https://stripe.com/privacy.

11. Security Measures

• SSL/TLS encryption of traffic to and from the platform.
• Passwords stored only as hashes.
• Firewall and Retention of Access Logs.
• Separation of production from other environments.
• Access Granted by Role, Limited to Named Staff.
• Internal audits against recognized international standards.

12. Cookies

• Technical cookies, without which the Service does not function.
• Analytical cookies (Google Analytics 4), used to measure audience.
• Functional cookies that record language and display preferences.

Cookies are managed via the consent banner or browser settings. Refusing technical cookies makes Operations unusable.

13. Subscriber rights under GDPR and PDPL

1. Access to retained data.
2. Correction of inaccurate data.
3. Deletion, the right to be forgotten.
4. Limitation of processing.
5. Opposition to Processing.
6. Portability: export data in reusable form.
7. Post-mortem directives, European Union only.

Requests should be addressed to [email protected] and will be processed within 30 days maximum. An ID document may be requested first if the Data Controller cannot otherwise confirm who is requesting.

14. Claims and Revisions

A Subscriber in the European Union may also file a complaint with the supervisory authority in their own country.

This policy may be revised. The version that applies is the one published on bank-fees.com the day it is read. Substantial changes are announced by email or in the client account.