Privacy Policy

1. Overview & Our Privacy Philosophy

At Reviaid (reviaid.com), we treat data privacy as a fundamental engineering requirement. We are committed to transparency, data minimization, and compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and global data protection laws.

2. The Data We Process (and What We NEVER Touch)

To perform automated dunning and revenue recovery, we process only the minimal metadata delivered by your payment processor’s webhooks:

• Webhook Metadata: Stripe Event IDs, Customer ID tokens (e.g. cus_12345), Invoice IDs (in_12345), and failure error reason codes (e.g., insufficient_funds, expired_card).
• Customer Contact Details: Customer email addresses and names solely for dispatching billing notifications.
• Usage Logs: Anonymized delivery timestamps, open rates, and click metrics to verify recovery outcomes.

3. Purpose of Processing

We process this data exclusively to:

• Deliver transactional dunning notifications regarding failed subscription charges;
• Coordinate optimal retry timing across our asynchronous queues;
• Calculate performance fees based on successfully recovered subscriptions;
• Provide you with audit logs and recovery analytics within your dashboard.

We will never sell, rent, or monetize your customers' contact information to third parties or advertising networks.

4. Third-Party Subprocessors

We rely on carefully vetted infrastructure providers who adhere to strict data security standards:

• Cloudflare Edge: Edge runtime computing and global CDN security.
• Stripe: Payment gateway tokens and customer portal verification.
• Transactional Email Infrastructure: Dedicated deliverability matrix with strict cryptographic DKIM/DMARC routing.
• Upstash / Trigger.dev: Encrypted distributed asynchronous queue orchestration.

5. Data Retention & The Right to be Forgotten

We retain invoice failure logs for 90 days for audit and billing dispute reconciliation. Following this window, detailed logs are automatically purged or anonymized.

Under GDPR and CCPA, you and your customers have the right to request access, rectification, or complete deletion of data. To trigger an immediate data purge, simply email us or submit an API deletion request.

6. Security Measures

All network communication with Reviaid is encrypted in transit using TLS 1.3. All webhook payloads are cryptographically verified via HMAC SHA-256 signatures before being queued. Stored operational data is encrypted at rest using AES-256.

7. Contact our Privacy Officer

For privacy inquiries, GDPR data requests, or security audit questions, please contact our Data Protection team at privacy@reviaid.com.