Renewvane Start free trial

Data Processing Addendum

For renewvane.com and the Renewvane service. Questions: hello@renewvane.com.

Effective date: October 26, 2026
Version: 1.0

This Data Processing Addendum ("Addendum") forms part of the Terms of Service between Juelia Kinney ("Renewvane", "we") and the Customer ("you"). It applies automatically when you accept the Terms. If it conflicts with the Terms about Subscriber Data, this Addendum controls.

1. Definitions

  • "Subscriber Data" means personal information about your subscribers that we receive from your Stripe account through the key you provide, or that your subscribers send us, while providing the service.
  • "Privacy Laws" means the privacy and data security laws of the United States and its states that apply to the processing of Subscriber Data, including, where it applies to you, the California Consumer Privacy Act as amended ("CCPA").
  • "Subprocessor" means a third party we engage that processes Subscriber Data for us.
  • "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Subscriber Data.
  • Terms such as "business", "service provider", "sell", "share", "business purpose" and "consumer" have the meanings given in the CCPA.

2. Roles

You are the business (controller) for Subscriber Data. We are your service provider (processor). You are responsible for having a lawful basis and giving any notices required for us to process Subscriber Data for you, including telling subscribers that you use service providers to send billing messages.

3. Business purposes and your instructions

3.1 We process Subscriber Data only for these limited and specified business purposes, which make up your documented instructions:

  1. preparing the leak audit of your Stripe account;
  2. sending payment reminder emails about failed invoices to your subscribers on your behalf, and stopping them when the invoice is paid or closed;
  3. randomly assigning failed invoices to an emailed group or a holdout group that receives no emails;
  4. honoring unsubscribe requests and suppressing addresses that bounce or complain;
  5. measuring incremental recovery and preparing your monthly Proof Report;
  6. keeping the service secure, preventing fraud and abuse, and fixing errors; and
  7. complying with law.

3.2 Your settings in the app (for example the holdout share, sender name, reply address, quiet hours and daily limit) and your written instructions to hello@renewvane.com are further instructions. We will tell you if we believe an instruction breaks Privacy Laws, and we may decline to follow it.

4. Service provider commitments

We will not:

  1. sell or share Subscriber Data;
  2. retain, use or disclose Subscriber Data for any purpose other than the business purposes in Section 3, including any commercial purpose, or outside the direct business relationship between you and us;
  3. combine Subscriber Data with personal information we receive from or on behalf of anyone else, or collect from our own interactions with a person, except as the CCPA permits for a service provider. You instruct and authorize us to keep a shared list of keyed, one way codes made from email addresses that hard bounced or complained, so that no Renewvane customer sends to them again; this list holds no addresses, names or other details; or
  4. use Subscriber Data for advertising, profiling, or training artificial intelligence models.

We will:

  1. comply with the obligations that apply to us as a service provider under Privacy Laws and give Subscriber Data the same level of privacy protection the CCPA requires of you;
  2. notify you within 5 business days if we determine we can no longer meet our obligations under Privacy Laws or this Addendum;
  3. let you take reasonable and appropriate steps to ensure we use Subscriber Data in a manner consistent with your obligations, and to stop and remedy any unauthorized use, including by disconnecting, which stops all processing at once (Section 9); and
  4. we certify that we understand and will comply with the restrictions in this Section 4.

5. Confidentiality and personnel

Only the owner of Renewvane, and any contractor we later engage who needs it, may access Subscriber Data, and each such person is bound by a duty of confidentiality. Our administrator view shows invoice identifiers and amounts, never subscriber email addresses.

6. Security

We maintain the technical and organizational measures described in Annex 2, appropriate to the risk. We may update them as long as the overall level of protection does not decrease.

7. Subprocessors

7.1 You authorize the Subprocessors listed in our Privacy Policy: Cloudflare (DNS, website, network protection and encrypted backups), Fly.io (application hosting and database), Postmark (email sending), and Zoho (our support inbox, only for messages subscribers send us directly). Stripe is not our Subprocessor for Subscriber Data: it is your own provider, and we read Subscriber Data from it with your key.

7.2 Each Subprocessor is bound by written terms that protect Subscriber Data at least as much as this Addendum requires for its part of the work. We remain responsible for our Subprocessors.

7.3 We will email you at least 30 days before adding or replacing a Subprocessor that processes Subscriber Data. If you object on reasonable data protection grounds, you may disconnect and cancel your plan before the change takes effect, and we will refund any prepaid fees for the period after cancellation.

8. Assistance

8.1 Subscriber requests. If we receive a request from a subscriber about Subscriber Data, we will not answer it ourselves except to say we have passed it on; we will forward it to you within 5 business days. Because we keep very little Subscriber Data and delete most of it quickly, you can usually answer from your own Stripe account; where you need our help (for example, to confirm what we hold or to delete records for a specific invoice), we will help within 10 business days.

8.2 Other help. We will give you information reasonably needed for you to meet your obligations under Privacy Laws, including for risk assessments and responses to regulators.

9. Security Incidents

9.1 We will notify you without undue delay, and in any case within 72 hours, after we confirm a Security Incident affecting your Subscriber Data. We will tell you what we know about what happened, the data and subscribers affected, the likely consequences, and the steps we are taking, and we will update you as we learn more.

9.2 We will take reasonable steps to contain and fix the incident and to reduce harm, including telling you to roll your Stripe restricted key when a key may have been exposed.

9.3 Unless the law requires otherwise, you decide whether and how to notify your subscribers and regulators. We will not notify them on your behalf without your approval, except where the law requires us to.

10. Deletion and return

10.1 During the service, Subscriber Data is deleted as described in our Privacy Policy, including deleting subscriber email addresses as soon as no reminder can go out.

10.2 When you disconnect, we delete your Stripe key at once, and we delete Subscriber Data within 30 days, or at once if you choose immediate deletion. Shared bounce and complaint codes (Section 4, item 3) are kept as described there. Data in encrypted backups expires within 35 days.

10.3 Before disconnecting, you can download your data from the app. Because Subscriber Data originates in your Stripe account, you keep the full source records there.

11. Audits

On written request no more than once a year (or after a Security Incident), we will answer a reasonable written security questionnaire and give you information reasonably necessary to show our compliance with this Addendum. Any further audit must be agreed in writing, at your cost, with reasonable notice and confidentiality.

12. Location

We process and store Subscriber Data in the United States. We do not transfer it outside the United States, except that our network provider may route traffic globally in encrypted form.

13. Liability and term

This Addendum is subject to the limitations of liability in the Terms. It lasts as long as we process Subscriber Data for you, and Sections 4, 5 and 10 continue for as long as we hold any.

Annex 1: Details of processing

  • Subject matter and duration: providing the Renewvane service for as long as you are connected, plus the deletion periods above.
  • Nature: reading data from your Stripe account through a restricted key, storing a minimal subset, sending emails, measuring results, deleting.
  • Data subjects: your subscribers whose invoices are in your Stripe account, mainly those whose payments failed.
  • Categories of personal information: email address (emailed group only, encrypted, temporary); Stripe customer, invoice and payment method identifiers; invoice amounts, currency, failure type and dates; payment status and dates; reminder email records; link click times; the result of the payment evidence check; keyed one way codes of email addresses for unsubscribes and suppression; content of any message a subscriber sends us directly. The key can also read subscriber names and billing details held in your Stripe account; we do not store them.
  • Sensitive personal information: none intended. We never receive full card numbers. Payment method identifiers and failure reasons are not used to infer anything about a person.

Annex 2: Security measures

  1. Access to your Stripe account: only restricted keys are accepted; full secret keys are refused; we ask only for the permissions the feature needs; you may lock the key to our server's fixed IP address with a Stripe access policy.
  2. Encryption: keys, webhook secrets and subscriber email addresses are encrypted at rest with AES 256 GCM envelope encryption (a fresh data key for each value, protected by a master key held only in our host's secret settings); the master key can be rotated. All traffic uses HTTPS with HSTS.
  3. Minimization: holdout subscribers' addresses are never looked up; other addresses are deleted as soon as no reminder can go out; the leak audit keeps totals only; exports never include keys or addresses.
  4. Application security: signed and replay protected webhooks; protection against cross site request forgery; rate limits; strict security headers; sign in links that expire in 15 minutes and resist email scanners; each email can be sent only once.
  5. Administrator access: limited to the owner; long password; lockout; behind an IP allow list; every administrator visit logged with IP address and kept 400 days.
  6. Secrets: encryption keys and service tokens are kept in our host's secret settings, never in source code or on disk in plain form, with an offline copy held by the owner.
  7. Backups: encrypted before they leave the server, stored separately from it, kept up to 35 days, and restore tested.
  8. Incident response: a written plan covering containment, rotating the master key, telling customers to roll their Stripe keys, and notice under Section 9.
  9. Testing: automated tests run before each release; live keys are refused unless live mode is deliberately approved.