Privacy Policy

This Privacy Policy explains how tarofu Studio (“Recoverly”, “we”) handles information in connection with the Recoverly service. We are based in Japan.

1. Information we collect

• Account data: your email address and the organization created for you when you sign up.
• Connected Stripe data: when you connect Stripe, we receive an encrypted access token and read invoice and payment data needed to recover failed payments — such as failed invoice amounts, failure reasons, and the email and name of the affected customer.
• We never store card numbers or CVC. All card data stays with Stripe; we only handle the metadata required to detect failed payments and notify the customers you approve.
• Usage and technical data: standard logs needed to operate and secure the Service.

2. How we use information

• To detect failed payments and other revenue leaks on your connected account.
• To send payment-update emails (each with an unsubscribe link) to your customers, only for cases you have approved.
• To show your dashboard, metrics, and recovery activity.
• To operate, secure, support, and bill for the Service.

3. Roles: you are the controller of your customers’ data

For data about your end customers, you act as the data controller and Recoverly acts as a processor on your behalf. You are responsible for having a lawful basis to process that data and to contact those customers.

4. Service providers (sub-processors)

We rely on the following providers to run the Service:

• Stripe — payments, Connect, and card data (card data never reaches us).
• Supabase — database and authentication.
• Vercel — application hosting and scheduled jobs.
• Resend — delivery of payment-update emails.
• PostHog— privacy-focused product analytics (aggregate usage of our own app; never your customers’ personal or payment data).
• Anthropic — AI used to help generate support and message content.

5. Security

Connected Stripe access tokens are encrypted at rest. Data is isolated per tenant using row-level security so that one customer cannot access another’s data. We restrict internal access to what is needed to operate the Service.

6. Data retention

We keep data for as long as your account is active and as needed to provide the Service. If you disconnect Stripe or close your account, we stop accessing your Stripe account and delete or anonymize data when it is no longer needed, subject to legal requirements.

7. Your rights

Depending on your location, you may have rights to access, correct, or delete your personal data. To make a request, contact us at support@payrecoverly.com. For requests about an end customer’s data, the relevant merchant (controller) should contact us.

8. Cookies

We use cookies necessary to keep you signed in and to operate the Service, plus product analytics (PostHog) that uses cookies or local storage to understand aggregate usage of our own app. Analytics never includes your customers’ personal or payment data, and we do not use cookies for advertising.

9. Children

The Service is for businesses and is not directed to children.

10. Changes

We may update this policy. Material changes will be reflected by the date above and, where appropriate, communicated to you.

11. Contact

Privacy questions? Email support@payrecoverly.com.