Privacy Policy

1. Two hats: controller and processor

It matters which role we’re playing:

• For your account. When you sign up and use the service, we’re the controller of your own personal data (your name, email, and how you use the app). This policy covers that.
• For your clients’ data. When we read your invoices and contact the people you bill, we’re acting as your processor — you decide what happens, we carry it out. That relationship is governed by our Data Processing Addendum, not this policy. You should have your own privacy notice for your clients.
• After you delete your account. We keep a one-way fingerprint of each client address or number that opted out (see section 7), for our own purpose: making sure nobody who asked to stop is contacted through our service again. For that record we’re the controller, and this policy covers it.

2. What we collect

Data you give us or that comes from Stripe

• Account details — your email address and the Stripe account identifier and email we receive when you connect Stripe.
• Terms acceptance — which version of our Terms of Service you accepted, when, and the account email that accepted it, kept as the record of our contract.
• Configuration — the escalation rules, message templates, timezone, quiet hours, and sending settings you create.
• Billing details — if you subscribe, Polar (Polar Software Inc.), acting as merchant of record, processes your payment and handles any VAT or sales tax. We never see or store your full card number; we receive limited information such as your plan, payment status, and billing country.
• Sample requests — the email address you enter on our website to get a sample reminder, and when we sent it. If the address unsubscribes, or our email provider stops delivering to it, we keep when and why (an unsubscribe, a spam report, a bounce or a block at our provider), so we send it no more samples. If you then confirm, from a link we email to that address, that you want samples again, we keep when and how you confirmed.

Data we generate

• Activity logs — records of what the service did (which reminder was sent for which invoice, when, and whether it succeeded, failed, or was skipped).
• Suppression records — email addresses and phone numbers of people our customers send reminders to that have unsubscribed, bounced, or opted out, so we don’t contact them again. Once an account is deleted we keep only a one-way keyed fingerprint of those that unsubscribed, reported spam or replied STOP, never the address or number itself.
• Trial record — your Stripe account identifier and when its free trial started, kept after you delete your account so the trial is granted once.
• Technical data — IP address, browser type, and log data when you use the app, used to keep it secure and working.

Your clients’ data (as processor)

To do its job the service also handles your clients’ names, email addresses, phone numbers, and invoice details, read from Stripe, and any message a client sends you through the dispute link in a final notice. We process that only to run your follow-ups, apart from the opt-out fingerprints we keep after you delete your account (section 1). See the DPA.

3. Why we use it, and our legal basis

Under the GDPR we need a lawful basis for each use. Here’s ours:

Where we rely on legitimate interests, we’ve weighed them against your rights, and you can object (see Your rights).

4. Cookies

We keep this simple: we only use cookies that are necessary for the app to work. We don’t use advertising or cross-site tracking cookies.

Because these are strictly necessary (or a preference you set), they don’t require a consent banner under the EU ePrivacy rules as implemented in the Czech Republic by Act No. 127/2005 Coll., on Electronic Communications (which requires consent only for cookies that aren’t strictly necessary). You can clear them in your browser at any time, though signing in won’t work without the session cookie.

5. Who we share it with

We don’t sell your data. We share it only with the service providers we need to run UntilPaid, and only for that purpose. Each is bound by a contract to protect it.

We may also disclose data if the law requires it, to protect our rights or someone’s safety, or as part of a merger or sale of the business (in which case we’ll tell you).

6. International transfers

Some of our providers process data in the United States — Stripe, Polar, Postmark, Twilio, Cloudflare (a US company whose network serves each request from a data centre near the visitor), and (depending on the deployment region) Railway. When personal data is transferred outside the EEA/UK, we rely on an appropriate safeguard: the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise the European Commission’s Standard Contractual Clauses (with the UK addendum) — so your data keeps an equivalent level of protection. You can ask us for details.

7. How long we keep it

• Account & configuration data — for as long as you have an account. When you close your account, we delete it, along with your rules, sequences, logs, and suppression list. We keep only your Stripe account identifier and when its free trial started, so the trial isn’t granted twice. The Stripe connection stays in place so you can sign up again with the same account, but we make no requests to it; you can remove UntilPaid from your Stripe Dashboard at any time.
• Suppression records — kept for as long as needed to keep honouring an opt-out. When your account is deleted, we keep a one-way keyed fingerprint (not the address or number) of each one that unsubscribed, reported spam or replied STOP, with your Stripe account identifier, so they aren’t contacted again if that account reconnects. Bounces are deleted with the account.
• Sample requests — kept until you ask us to delete them, except that a record of an unsubscribe, spam report or bounce is kept for as long as needed to keep honouring it. An unsubscribe can be lifted only from the address itself: through a link we email to it, or the undo button for an hour after unsubscribing. A spam report or bounce can’t be lifted that way.
• Billing and tax records — kept for the period required by Czech tax and accounting law (up to 10 years for VAT documents under Act No. 235/2004 Coll.; accounting records for 5 years under Act No. 563/1991 Coll.).
• Backups and security logs — kept for a limited period, then rotated out.

8. How we protect it

We take security seriously and use measures appropriate to the risk, including: encryption in transit (HTTPS); encryption at rest for the sensitive secrets we store (such as mail-provider credentials and webhook signing secrets); signed, verifiable webhooks; access controls and least-privilege access to production systems; and validated, origin-checked requests to guard against forgery. No system is perfectly secure, but we work to keep the risk low, and we’ll notify you and the relevant authority of a personal-data breach where the law requires.

9. Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you, and get a copy;
• correct data that’s wrong or incomplete;
• erase your data (“the right to be forgotten”), in the circumstances the law allows;
• restrict or object to certain processing, including anything based on our legitimate interests;
• portability — receive your data in a structured, common format; and
• withdraw consent at any time, where we relied on it.

To exercise any of these, email privacy@untilpaid.com. We’ll respond within the time the law allows (usually one month). You won’t be charged, and we won’t treat you differently for asking. If you’re unhappy with how we’ve handled your data, you can complain to your local data-protection authority — for us, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ, uoou.gov.cz) — but we’d appreciate the chance to put things right first.

If you’re one of our customers’ clients and want your data changed or removed, please contact that business (the controller). We’ll help them act on your request.

10. Children

The service is for businesses, not for children. We don’t knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we’ll delete it.

11. Changes

We may update this policy as the service or the law changes. We’ll post the new version here and update the date at the top; if a change is significant, we’ll tell you directly.

12. Contact

For any privacy question, email privacy@untilpaid.com. The controller is Jonas Vondracek, Czech Republic. We have not appointed a Data Protection Officer, as one is not required for processing on this scale.