Privacy policy
Last updated October 30, 2026
This policy explains what personal information Subrecipient Watch (run by Josh Yaspan, "we") collects, why, and what you can do about it. Short version: we collect only what's needed to run the service, we don't sell or share your data for advertising, and there are no ad or tracking cookies.
What we collect
- Account details: your email address, organization name and password. The password is stored only as a secure, one-way hash; we can't read it.
- What you put in the app: the organizations, identifiers and programs you list, the names you go by, the management decisions and notes you record, and the results of your checks.
- Billing: if you subscribe, Paddle, our reseller and Merchant of Record, collects your payment and billing details. We receive and keep only your plan, billing period, subscription status and Paddle customer and subscription IDs, not your card number.
- Technical data: your IP address and the pages and API calls you request, in server logs used for security and fixing problems, and a usage count per account for rate limits.
The clearinghouse's files contain the names, phone numbers and email addresses of people at audited organizations and audit firms. The Subrecipient Watch service doesn't load or show those. Separately, we may use the contact listed on an organization's public audit filing to tell that organization about Subrecipient Watch, and we stop if asked.
How we use it
- To run the service: sign you in, run your checks and keep your records.
- To bill you through Paddle and manage your plan.
- To contact you about your account, billing and important changes.
- To keep the service secure, prevent abuse and fix problems.
We don't sell your personal information, share it for advertising, or use your lists for anything except running the service for you.
Cookies
We use one cookie, saw_session, which keeps you signed in. It's essential, so there's no cookie banner,
and there are no analytics, advertising or third-party tracking cookies. When you pay, our checkout page loads Paddle's
checkout, which may use its own cookies to process the payment securely.
Who else handles data
- Paddle sells our subscriptions as Merchant of Record and processes payments (Paddle's privacy policy).
- The company that carries traffic to the site or hosts it handles IP addresses and requests.
- When we check an organization, its identifier is sent to the Federal Audit Clearinghouse's public API, without your name or your account.
We may also disclose information if the law requires it, or to a buyer if the service is ever sold, in which case this policy continues to apply to your data. Your data is stored in the United States.
How long we keep it
- Account data, lists and records: while your account is open. Records are kept as evidence for your own auditors, so we don't delete them on our own.
- After you ask us to delete your account: removed within 30 days, and from backups within a further 14 days. Billing records may be kept longer where tax law requires.
- Server logs: up to 30 days.
Your choices and rights
You can ask us to access, correct, export or delete your personal information by emailing [email protected]. We'll answer within 30 days and won't treat you differently for asking. Depending on where you live, you may have further rights under local law; contact us and we'll honor them.
Security
Connections are encrypted (HTTPS), passwords and keys are stored only as hashes and sign-in attempts are rate-limited. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.
Children
Subrecipient Watch is a business tool and isn't meant for anyone under 18.
Changes
If we change this policy in a significant way, we'll tell you by email or in the app before it takes effect.