Legal
Privacy Policy
1. Who we are
PayCanary Ltd. ("PayCanary", "we", "us") is a company registered in England and Wales (company number: [COMPANY_NUMBER_TBC]) with registered office at [REGISTERED_ADDRESS_TBC]. We provide Stripe risk monitoring, account health diagnostics, and freeze recovery advisory services. We are the data controller for your personal data. This policy explains how we handle your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. PayCanary is not required to appoint a Data Protection Officer under Article 37 UK GDPR because our core activities do not consist of large-scale systematic monitoring or large-scale processing of special-category data. Privacy questions should be directed to privacy@paycanary.io.
2. What we collect
Free Stripe Health Check (no account required)
When you run the free diagnostic, we collect only the four metrics you enter: dispute rate, refund rate, volume change, and keyword flag count. This data is processed in real-time to generate your risk score and is not permanently stored unless you provide your email.
Email capture
If you choose to unlock your detailed risk breakdown, we collect your email address. We use this to deliver your results and, with your consent, to send risk monitoring insights.
Monitoring subscribers
Subscribers provide additional information including email, billing details (processed by Paddle, our Merchant of Record — we never see your full card number), and the Stripe metrics submitted for ongoing monitoring.
Stripe Connect data (Respond / Resolve / Enterprise)
If you connect your Stripe account via OAuth, we access your transaction history, dispute records, refund history, payout data, and account status in read-only mode. Watch tier users run this scan manually at most once every 7 days. Respond and Resolve tiers poll daily for continuous monitoring. Data is mirrored to our Transaction Vault to provide monitoring, credibility reports, and crisis evidence. We act as a data processor for this data on your behalf. We never create charges, modify your account, or move funds. You can revoke OAuth access at any time from your dashboard or directly in your Stripe account settings.
Crisis response
Crisis intake conversations are stored for the duration of your case and for 7 years after case closure for legal protection purposes. Conversations are encrypted in transit and at rest.
3. How we use your data
We use your data only to:
- Calculate and deliver your Stripe risk score
- Provide monitoring alerts when your metrics approach freeze thresholds
- Deliver crisis response action plans
- Send risk insights and product updates (only if you opted in)
- Improve our scoring model accuracy
We do not sell your data to third parties. We do not use your data for advertising. We do not use your data to train AI or machine learning models — neither our own nor any third party's (Anthropic's standard API terms prohibit training on API inputs by default). We share your data only with the subprocessors listed at paycanary.io/legal/subprocessors, which is kept current and updated within 30 days of any change.
4. Data retention
You can request deletion of your data at any time by emailing privacy@paycanary.io.
5a. International data transfers
Several of our subprocessors are located outside the UK, primarily in the United States (Supabase, Vercel, Anthropic, Stripe, Sentry, Upstash, Resend) and the European Economic Area (MailerLite — Ireland). Transfers to US subprocessors are governed by the UK International Data Transfer Addendum (UK IDTA) to the EU Standard Contractual Clauses, in line with the ICO's 2022 guidance. We have conducted a Transfer Risk Assessment (TRA) for each US subprocessor and concluded that the UK IDTA together with the subprocessor's standard security commitments provides a level of protection essentially equivalent to that required by the UK GDPR. Transfers to the EEA (MailerLite) do not require a transfer mechanism because the UK recognises the EEA as providing adequate data protection. A copy of our Transfer Risk Assessments is available on request at privacy@paycanary.io.
5b. Data security
We implement appropriate technical and organisational measures to protect your data, including: TLS 1.3 encryption in transit, encryption at rest for all database records, role-based access control, and regular security reviews. In the event of a data breach affecting your personal data, we will notify the ICO within 72 hours and notify you without undue delay.
6. Your rights
Under UK GDPR, you have the right to: access your data, correct inaccurate data, delete your data (except crisis case records retained for legal purposes), export your data in a portable format, object to processing, restrict processing, and withdraw consent for marketing communications. Contact privacy@paycanary.io for any requests. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
6a. Automated processing and your right to human review
Some features of the Service involve automated processing of your data: the risk score calculation, the fight-or-fold dispute recommendation, the severity classification for crisis cases, and the policy change classification system. These are informational tools that help you make your own business decisions — they do not produce binding legal effects and PayCanary does not act on them automatically in ways that affect you without your instruction. To the extent any automated output could be considered to significantly affect you under Article 22 UK GDPR, you have the following rights: (a) to obtain human intervention in the decision; (b) to express your point of view on the decision and the factors that produced it; (c) to contest the decision and request that a PayCanary team member review it and make corrections we determine to be appropriate; (d) to be informed, on request, of the logic involved in the automated processing and the significance and envisaged consequences of the processing for you. To exercise these rights, contact privacy@paycanary.io or use the “Request human review” option in your dashboard and describe the specific automated output you want reviewed. We will acknowledge your request within 72 hours and complete the human review within 30 days. While the review is in progress you may disregard the automated output without penalty or loss of service. The PayCanary team member conducting the review will have authority to override the automated output, correct any input errors, and provide a written explanation of the conclusion.
6b. Marketing and email preferences
We send two categories of email: service emails (alerts, crisis updates, weekly digests, billing notifications) which are part of the product and cannot be disabled while you have an active account; and marketing emails (product news, insights, industry reports) which require your specific opt-in consent. At account signup we ask you to separately opt in to marketing emails via an explicit unticked checkbox. Your choice is recorded in your user profile and timestamped. You can change your marketing preference at any time from your dashboard settings or via the unsubscribe link in any marketing email; changes take effect within 48 hours. Opting out of marketing does not affect service emails. Where you have opted in to marketing, we may also contact you about similar PayCanary products under the ‘soft opt-in’ exemption in Regulation 22 PECR, which permits product announcements materially similar to the service you subscribed to.
6c. Age restriction
The Service is intended for business users and is not directed to individuals under 18 years of age. If you are under 18, do not use the Service. If we become aware that we have collected personal data from a person under 18 without appropriate consent, we will delete that data.
7. Changes to this policy
We will notify subscribers by email before making material changes to this policy. The "last updated" date at the top reflects the most recent revision.
8. Contact
For privacy questions or data requests: privacy@paycanary.io