Privacy Policy

When you sign up for PaidGuard, we collect:

• Account data: your email address and password (hashed).
• Stripe data: when you connect your Stripe account, we receive subscription, invoice, and customer data through OAuth. We never see or store raw card numbers—Stripe handles all PCI compliance.
• Usage data: pages visited, clicks, errors — via Vercel Analytics, which is aggregated and sets no cookies. If you accept the cookie banner, we also load the Meta Pixel to measure our own advertising.
• Email data: dunning emails we send on your behalf (recipient, subject, body, send timestamp).

• Card numbers, CVVs, or expiry dates (Stripe handles this; we never see it).
• Bank account or routing numbers.
• Government IDs, SSNs, or other PII.
• Anything from your end customers except what Stripe returns via webhooks.

We use your data only to operate PaidGuard—retry failed payments, send dunning emails, show analytics, and improve the product. We do not sell, rent, or share your data with third parties for advertising.

Subprocessors we use:

• Stripe — payment processing (PCI-compliant).
• Resend — transactional email delivery.
• Neon — managed Postgres database (encrypted at rest).
• Vercel — application hosting.
• Cloudflare — DNS and edge routing.
• Vercel Analytics — aggregated, cookieless traffic measurement for our own site.
• Meta Platforms — advertising measurement via the Meta Pixel, loaded only after you accept the cookie banner.

You have the right to:

• Access your data — request a full export anytime.
• Delete your data — request account deletion via hello@paidguard.io.
• Correct inaccurate data — email us to fix it.
• Port your data — we can provide a JSON export.

Your customers (the people whose cards we help you retry) have the same rights. Forward their request to privacy@paidguard.io and we will action it within 30 days.

We keep your account data while your account is active. After deletion, all data is permanently erased within 30 days. Anonymized aggregate metrics (recovery rates, time-to-recovery ranges) may be retained indefinitely.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We use Stripe OAuth with read-only scopes—we cannot charge, refund, or modify your Stripe account. Our database is hosted on Neon, which is SOC2 Type II certified.

Two essential cookies: auth_token keeps you signed in, and user_email lets the page show you as logged in. Neither is used for tracking.

If you accept the cookie banner, we load the Meta Pixel, which sets third-party cookies for advertising measurement. If you decline, it is never loaded and no third-party cookie is set. Vercel Analytics measures traffic without cookies.

Privacy questions: privacy@paidguard.io

Postal address: Services YC, Québec, Canada.