Privacy Policy

1. Who is responsible

The controller is an individual entrepreneur (auto-entrepreneur) based in France. For anything concerning your data, write to privacy@chargebackreply.com.

2. What we store — and what we deliberately do not

We store, for as long as your account exists:

— your identity from Google sign-in: email address, name, and the account identifier; — your subscription status and the identifier Stripe uses for your customer record.

We do NOT store:

— the details of your dispute (order number, amounts, dates, your customer's name, email or address); — the files and screenshots you attach; — the letters and PDF packages generated.

Your case lives in your browser for the length of your session. It is sent to our server only for the moment it takes to draft the letter or build the PDF, and is discarded once the response is returned. Nothing is written to a database and nothing is kept on disk. Close the tab and it is gone — which also means we cannot recover a case for you.

We never see your card number: Stripe handles payment and we receive only the result.

3. Why, and on what legal basis

— To provide the service you asked for (drafting a letter, building a PDF, managing your subscription): performance of our contract with you. — To keep an account secure and to prevent abuse of a paid, metered service: our legitimate interest. — To meet accounting and tax obligations on payments: legal obligation.

We do not use your data for advertising, we do not sell it, and we do not profile you.

4. Who else processes it

— Supabase — account and authentication. Your data is held in the European Union (Stockholm). — Anthropic (United States) — drafts the letter. The facts you entered are sent for the time it takes to generate; they are not used to train models. Your attached files are never sent: the model is told only that an exhibit exists, never its contents. — Stripe — payment and subscription. — Netlify — hosting. — Google — only if you sign in with Google, for the sign-in itself.

Each acts under contract and may use the data only to provide its service to us.

5. Transfers outside the EU

Generation involves Anthropic, and hosting and payment involve providers established in the United States. These transfers rest on the European Commission's standard contractual clauses or an equivalent mechanism. Because case details are transmitted transiently and never stored, the volume of personal data leaving the EU is limited to what a single generation requires.

6. How long we keep it

— Account data: for as long as your account exists, then deleted within 30 days of closure. — Subscription and billing records: for the period required by accounting law (10 years in France), which we cannot shorten. — Case data: not retained (see section 2).

7. Your rights

You may request access to your data, its correction, its deletion, a portable copy, or restriction of its processing; and you may object to processing based on our legitimate interest. Write to privacy@chargebackreply.com; we answer within one month.

You may also lodge a complaint with your data protection authority — in France, the CNIL (cnil.fr).

Note that we can only act on data we hold: since your cases are not stored, there is nothing for us to export or erase there.

8. Cookies

We use only what the service needs to work: a session cookie to keep you signed in, and the cookies Stripe requires for payment security. No advertising cookie, no third-party tracker, and therefore no consent banner — strictly necessary cookies do not require one.

9. Your own customers' data

The dispute details you enter contain personal data belonging to your customer. For that data you are the controller and we act only as your processor, on your instructions, for the moment of generation.

Enter only what the dispute requires. It is unnecessary — and unwise — to paste a full customer record when the bank is deciding a single transaction.

10. Changes

We may update this policy. Substantive changes are announced by email to account holders. The date at the top always reflects the current version.