Privacy

For your own account details, we are the controller. For the invoice and customer records we handle while working your book, you are the controller and we act on your instructions as your processor. Those records belong to your business and your relationship with your customers; we do not treat them as ours.

Your account. The email address you sign up with, and your plan and billing status.

Your Stripe credentials. Held encrypted in a managed secrets store, never written to our database and never sent back to a browser. Only the last four characters are ever displayed, to anyone.

Records of work done. For each invoice we act on: its identifier, the customer identifier and email held against it in Stripe, the amount, the outcome, and what the bank said. We also keep a running count of how often each invoice and customer has been approached.

We do not hold card numbers, bank details, or any other payment credential. Those never leave Stripe.

Records of work done are kept for as long as your account is open, and for one reason: they are what stops the same customer being approached over and over. An attempt history that vanished after each run would mean a card that has already declined four times looks untouched the next morning. Keeping it is how the limits you set actually hold.

Unlinking your Stripe account deletes the stored credential immediately. Closing your account, or asking us in writing, removes the rest.

We do not sell your data or your customers' data. We do not share it with anyone beyond the infrastructure providers needed to run the service. We do not use it to train models. We never take custody of your money — every payment settles inside your own Stripe account, on your own payout schedule.

Amazon Web Services hosts the service and stores the data described above. Stripe processes the payments themselves, under their own terms with you.

Two analytics services measure how the site and the product are used: PostHog, which records which features are opened and which steps people abandon, and Meta, which tells us whether an advert led to a sign-up. Both are limited on purpose, and both are restricted to the addresses of the pages visited and to events we name ourselves. Neither reads the contents of a screen, so nothing about your customers — no invoice, no amount, no email address of theirs — is ever sent to either one.

PostHog additionally holds your own email address against your account, so that a question about your account can be answered without it being an anonymous identifier. Meta is never given it: Meta's ability to read form fields and log what you click is switched off, and beyond the pages visited it learns only that a sign-up or a subscription happened, never who it was.

Signing in sets the cookies needed to keep you signed in. The analytics services above set their own, which recognise a returning browser and let us count a visit and a sign-up as the same person rather than two.

Your browser's Do Not Track and global privacy control signals are respected where the service supports them, and blocking these cookies does not affect anything Recurback does for you.

You may ask what we hold about you, have it corrected, have it deleted, or have it sent to you in a portable form. Where your own customers exercise those rights against you, we will help you answer them, since we hold the records on your behalf.

Write to privacy@recurback.com and we will respond within 30 days.

Credentials are encrypted at rest with managed keys. Access to the service requires authentication, and each account can only ever reach its own records. No credential is exposed to a browser at any point.

If this notice changes in a way that affects what we hold or how long we hold it, we will tell account holders before it takes effect.