Privacy Policy

Last updated: March 22, 2026

1. Information We Collect

When you use PaymentRescue, we collect:

Account Information: Name, email address, and company name when you create an account.
Stripe Data: When you connect your Stripe account via OAuth, we access invoice data, customer emails, and payment failure events. We never access or store full credit card numbers.
Usage Data: Pages visited, features used, and interaction patterns to improve the service.
Device Information: Browser type, IP address, and device type for security and analytics.

2. How We Use Your Information

To provide the failed payment recovery service (detecting failures, sending recovery emails).
To display your dashboard metrics and analytics.
To process your subscription payments via Stripe.
To send transactional emails (account notifications, recovery reports).
To improve the service and develop new features.

3. Data Processing (GDPR)

Under GDPR, PaymentRescue acts as a Data Processor for the customer data we access via Stripe Connect. You (our customer) are the Data Controller. We process data only as instructed by you and in accordance with our Data Processing Agreement (DPA).

Legal bases for processing: contract performance (providing the service), legitimate interest (improving the service), and consent (analytics cookies).

4. Data Sharing

These are every vendor that processes data on our behalf, what each one is for, and where it happens. The list is generated from the code, so it cannot fall out of step with what the product actually does — the previous hand-written version named four of them and omitted four.

Vendor	What for	What it sees	Where
Vercel	Application hosting and page delivery	IP address and request metadata, in server logs	EU (deploy region) and United States
Upstash	Database holding accounts, keys and product data	Email, hashed password, session token, failed-payment records and recovery state	EU
Stripe	Payments and subscription management	Email, billing and payment details. Card numbers never touch our servers	EU and United States
Brevo	Transactional email (welcome, API key, alerts)	Email address and message content	EU (France)
Resend	Transactional email, secondary delivery path	Email address and message content	EU and United States
Sentry	Application error reporting	Technical error details and browsing context. Configured with sendDefaultPii disabled, so we do not send identifying data	EU (.de ingestion host)
Vercel BotID	Bot protection on public forms	Technical browser signals, no personal identifier	EU and United States
PostHog	Product analytics on how features are used	Pseudonymous usage events. Loaded only with your consent	EU (eu.i.posthog.com)
Google Analytics 4	Aggregate visit statistics	Cookie identifier and browsing data — only after you consent. Without consent it writes nothing to your device	United States
Vercel Analytics and Speed Insights	Page performance metrics	No cookies, no persistent identifier	EU and United States

We never sell your data to third parties.

5. Data Retention

We retain your data for as long as your account is active. When you delete your account, we remove all personal data within 30 days. Anonymized analytics data may be retained for statistical purposes.

6. Your Rights

You have the right to:

Access your personal data.
Rectify inaccurate data.
Delete your data ("right to be forgotten").
Export your data in a portable format.
Object to processing.
Withdraw consent at any time.

7. Cookies

We use:

Essential cookies: Session management and authentication.
Analytics cookies: Google Analytics 4 (with consent).

You can manage cookie preferences via the cookie consent banner.

8. Security

We implement industry-standard security measures including TLS encryption, secure session management, rate limiting, and regular security audits. We never store credit card numbers — all payment data is handled by Stripe.

9. Contact

For privacy-related questions, contact us at: privacy@paymentrescue.dev