Privacy Policy

Last updated: October 9, 2026

1. Overview

Rebounce ("we", "us", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights. Rebounce is a B2B payment recovery service. We process data on behalf of our customers (SaaS businesses) to recover their failed payments.

2. Data We Collect

From you (our customer):

  • Email address and company name (account registration)
  • Connection credentials for Stripe, Paddle or Square (encrypted at rest)
  • IP address and browser user agent when you sign up or delete your account (abuse prevention and audit record)
  • Billing information (processed by Stripe, not stored by us)
  • Custom email templates and branding preferences

From your customers (end users):

  • Email address and name (from Stripe, Paddle or Square invoice data)
  • Phone number, only when you add one so we can send SMS or WhatsApp reminders
  • Failed payment details: amount, currency, failure reason
  • Subscription and invoice IDs (Stripe references)
  • Payment recovery status and dunning interaction history

We do NOT collect or store:

  • Credit card numbers or security codes. Cards are typed into fields hosted by Stripe, Square or Paddle and never reach our servers. We keep only the last 4 digits, brand and expiry date to show you which card was updated.
  • Bank account details
  • Social security numbers or government IDs

3. How We Use Data

  • Detect and classify failed payments via Stripe webhooks
  • Send dunning email sequences to recover failed payments
  • Retry failed charges at optimal times via Stripe API
  • Display recovery analytics in your dashboard
  • Process your Rebounce subscription billing

4. Data Security

  • Stripe, Paddle and Square credentials encrypted at rest using AES-256-GCM
  • Encryption keys derived via scrypt from an application secret
  • Payment update links are signed and expire after 72 hours (card-expiry reminder links: 30 days)
  • All data transmitted over HTTPS/TLS
  • Each account's data is isolated with database Row Level Security
  • Webhook endpoints verify each provider's cryptographic signature
  • Rate limiting on sign-in, password reset, payment pages and other sensitive public endpoints
  • Optional two-step verification (authenticator app) for your account

5. Third-Party Services

We share data with the following services, only as necessary to operate:

  • Stripe: payment processing, account connection and our own billing
  • Paddle and Square: only if you connect them as your billing provider
  • Supabase: database hosting (PostgreSQL, AWS us-west-2)
  • Vercel: application hosting and cookieless page analytics
  • Inngest: background job orchestration
  • Resend: email delivery
  • Twilio: SMS and WhatsApp delivery, only on plans and accounts that use them
  • PostHog: product analytics and session replay on our website and dashboard (typed input and dashboard text are masked; not active on your customers' payment pages)
  • Reddit: ad measurement on our marketing pages. When you sign up, start a subscription or run a free audit, we send Reddit a hashed (not readable) email, your IP address and browser user agent to measure our ads
  • Cloudflare: DNS and forwarding of email sent to our addresses
  • Google Fonts: web fonts (your browser requests them from Google)
  • Google and GitHub: only if you choose to sign in with them

6. Data Retention

We retain your data for the duration of your account. Failed payment records and dunning logs are kept while your account is active. When you delete your account, we permanently delete your organization data, encrypted credentials, failed payment records and message history within 30 days. We keep a record that the account was deleted and when, without personal data. Free audit reports are deleted after 90 days. Anonymized aggregate statistics may be retained.

7. Your Rights

You have the right to:

  • Access your data (available via the dashboard)
  • Disconnect your Stripe account at any time
  • Delete your account and all associated data
  • Request a data export by contacting us

If you are in the EU/EEA, you also have rights under GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

8. Cookies

We use essential cookies for your sign-in session. On our marketing pages we also use PostHog (product analytics) and the Reddit pixel (ad measurement), which set their own cookies. Our dashboard uses PostHog with page text masked. Pages that your customers see (payment, cancellation and unsubscribe pages) run neither of them.

9. Changes

We may update this policy from time to time. We will notify you of material changes via email. The "last updated" date above indicates when this policy was last revised.

10. Contact

For privacy-related questions, contact us at hello@rebounce.dev. To report a security issue, write to security@rebounce.dev or see our Security page.

Privacy Policy | Rebounce