Legal · Privacy
Privacy Policy
This Privacy Policy explains how AutoRetry, Inc. ("AutoRetry", "we", "us") collects, uses, stores, and protects information when you use our payment recovery service at autoretry.com.
Last updated: August 18, 2026
1. Information We Collect
Account Information
When you create an AutoRetry account, we collect your name, email address, and authentication credentials managed by Clerk (our identity provider).
Stripe Integration Data
To provide payment recovery services, we collect and store:
- Stripe API keys (restricted, stored AES-256 encrypted)
- Stripe webhook signing secrets (encrypted at rest)
- Stripe account identifiers for Connect integrations
Subscriber Data (Your Customers)
When Stripe sends us webhook events about failed payments, we process and store limited data about your subscribers (your end-customers):
- Email address
- Customer name (if provided by Stripe)
- Stripe customer ID
- Failed payment amounts, dates, and decline codes
- Email open/click events for sent recovery emails
We never collect or store payment card numbers, CVVs, or full card details. All card processing remains exclusively with Stripe.
Usage and Analytics Data
We use Microsoft Clarity for anonymized session recording and heatmap analytics to improve the product. Clarity may collect browser type, page interactions, and session duration. No personally identifiable information is sent to Clarity.
2. How We Use Your Information
- To provide the payment recovery service — detecting failed payments and dispatching recovery email campaigns on your behalf.
- To authenticate your account and protect access to your dashboard.
- To send system notifications (Slack, Telegram, email) when recovery events occur, per your notification settings.
- To generate anonymized product analytics to improve AutoRetry.
- To respond to support requests and communications.
We do not sell your data or your subscribers' data to third parties. We do not use subscriber email addresses for any purpose other than sending recovery emails on your explicit instruction.
3. Data Storage and Security
All data is stored in a PostgreSQL database hosted on Neon (serverless Postgres). Application infrastructure runs on Vercel. Data is transmitted exclusively over TLS 1.3.
Sensitive credentials (Stripe API keys, webhook secrets) are encrypted at rest using AES-256 before database storage. Decryption keys are stored separately in environment variables, never in the database.
Card update JWT tokens used in recovery emails are signed with HS256 and expire after 90 days.
4. Sub-processors
We use the following third-party services to deliver AutoRetry:
| Sub-processor | Purpose | Data Location |
|---|---|---|
| Vercel | Application hosting and edge runtime | US / EU (configurable) |
| Neon | PostgreSQL database storage | US (AWS us-east-1) |
| Clerk | User authentication and session management | US |
| Resend | Transactional email delivery | US |
| Stripe | Payment data and webhook events | US / EU |
| Microsoft Clarity | Anonymized analytics and session recording | US |
5. Data Retention
- Account data: Retained while your account is active. Deleted within 30 days of account closure on request.
- Subscriber (end-customer) data: Retained for 24 months from the last recovery event, then purged automatically.
- Email event logs: Retained for 12 months.
- Processed webhook events: Retained for 6 months for idempotency, then purged.
6. GDPR — Your Rights (EU/EEA/UK)
If you are located in the EU, EEA, or UK, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:
- Right of Access:Request a copy of the personal data we hold about you.
- Right to Rectification:Request correction of inaccurate personal data.
- Right to Erasure:Request deletion of your personal data ('right to be forgotten').
- Right to Portability:Request your data in a machine-readable format.
- Right to Object:Object to processing of your data for certain purposes.
- Right to Restrict Processing:Request that we limit how we use your data.
To exercise any of these rights, email privacy@pingdunn.com. We will respond within 30 days.
Our lawful basis for processing subscriber data is Legitimate Interest (Art. 6(1)(f) GDPR) — specifically, recovering revenue on behalf of our customers, which constitutes a legitimate business interest. Our customers (the SaaS founders) are the Data Controllers; AutoRetry acts as the Data Processor.
7. Data Breach Notification
In the event of a personal data breach, we will notify affected account holders within 72 hours of becoming aware, as required under GDPR Article 33. Notifications will be sent to the primary email address on your account.
8. Cookies
- Essential cookies: Session management via Clerk. Required for the service to function.
- Analytics cookies: Microsoft Clarity for anonymized product analytics. You may opt out by declining the cookie banner or using your browser settings.
9. Contact Us
For any privacy-related questions, requests, or concerns, email privacy@pingdunn.com.
See also our Data Processing Agreement and Terms of Service.