Privacy Policy

1. What We Collect

When you use RevReclaim, we collect the following information:

• Account information: Email address, name, and password (hashed) when you create an account.
• Billing platform API keys: Read-only restricted keys you provide for scanning (Stripe, Paddle, or Polar). One-time scan keys are processed in memory and never stored. Auto-scan keys are encrypted with AES-256-GCM before storage.
• Scan results: Revenue leak reports generated from your billing data, stored in your account for future reference.
• Usage data: Basic analytics like page views and feature usage to improve the product.

2. How We Handle Your Billing Data

Your billing data security is our top priority:

• Read-only access: We only request read-only API keys from Stripe, Paddle, or Polar. We cannot modify your billing account, create charges, or change subscriptions. This is enforced at the platform level.
• One-time scans: API keys used for manual scans are processed in memory and never stored on any server or database. The key exists for approximately 90 seconds during the scan.
• Auto-scan keys: If you enable automated weekly scans, your API key is encrypted using AES-256-GCM with a derived key before storage. The encryption key is stored separately from the database. You can delete it at any time from your settings.
• Data minimization: We only fetch the billing data needed for leak detection (subscriptions, invoices, customers, coupons, prices). We do not access full credit card numbers, bank accounts, or personal identity documents.
• Customer names: We never fetch or store customer full names from your billing platform. Only customer IDs and masked emails are used.
• Privacy Mode (optional): When enabled, customer emails and IDs are hidden from the dashboard, reports, and exports. Data remains encrypted server-side for recovery action execution.

3. How We Use Your Data

• Generate revenue leak reports for your review
• Store scan history in your dashboard
• Run automated scans on your chosen schedule
• Send scan completion notifications (if enabled)
• Send automated pre-dunning emails for expiring cards (if enabled)
• Deliver webhook notifications to your configured endpoints
• Improve our leak detection algorithms

4. Data Storage & Security

• Database: Data is stored in Supabase (PostgreSQL) with Row Level Security — each user can only access their own data.
• Encryption: API keys are encrypted at rest using AES-256-GCM. All data in transit is encrypted via TLS 1.3.
• Hosting: The application is hosted on Vercel with automatic HTTPS and DDoS protection.
• Access control: Only you can access your reports and settings. Our team does not access customer Stripe data.

5. Data Sharing & Sub-processors

We do not sell, rent, or share your personal data or billing data with third parties, except for the sub-processors listed below that are essential to providing the Service:

All sub-processors are bound by data processing agreements. We will notify registered users via email at least 14 days before adding new sub-processors. We may also share data if required by law, court order, or government request.

6. Data Retention & Deletion

• Scan reports are retained as long as your account is active.
• You can delete individual reports from your dashboard at any time.
• You can delete your auto-scan configuration (including the encrypted API key) at any time.
• To delete your entire account and all associated data, contact us at the email below.
• Upon account deletion, all data is permanently removed within 30 days.

7. Breach Notification

In the event of a confirmed data breach affecting your personal data or API keys, we will:

• Notify affected users via email within 72 hours of confirming the breach, in compliance with GDPR requirements.
• Provide details about the nature of the breach, the categories of data affected, and the approximate number of users impacted.
• Describe the measures taken to address and mitigate the breach.
• Report to relevant supervisory authorities as required by applicable law.
• Provide guidance on protective steps, including instructions for revoking API keys on your billing platform.

8. International Data Processing

RevReclaim is operated from Israel. Our sub-processors may process data in the United States and the European Union. If you are located in the European Economic Area (EEA) or the United Kingdom, your data may be transferred to and processed in countries outside your jurisdiction.

We rely on Standard Contractual Clauses (SCCs) and our sub-processors' certifications (including SOC 2) to ensure that your data is protected to the standards required by GDPR. If you are subject to GDPR and require a Data Processing Agreement (DPA), please contact us at the email below and we will provide one.

9. Cookies

We use essential cookies only — for authentication sessions and security. We do not use advertising cookies or third-party tracking cookies.

10. Your Rights

You have the right to:

• Access your stored data
• Export your scan reports
• Delete your data and account
• Withdraw consent for automated scans at any time

11. Changes

We may update this policy from time to time. Material changes will be communicated via email to registered users. Continued use of the service after changes constitutes acceptance.

12. Contact

For privacy-related questions or data deletion requests, contact us at revreclaim@gmail.com