Privacy Policy

Reclaiva (legal entity and registered address in Switzerland to be confirmed) is responsible for the processing of the data of its Customers, the businesses that open an account. For the data of your end customers read from your Stripe account, Reclaiva acts on your behalf as a processor; the Data Processing Agreement applies.

Contact for privacy matters: the support address shown in the app (to be confirmed before the first paying customer).

• Account: your email address (magic-link login), company name, sender name, support email, language, time zone and settings.
• Stripe data, read-only: invoices (identifiers, amounts, currency, status, decline codes, hosted payment link), customers (name, email, country, language), subscriptions, prices and coupons. Ninety days at the audit, then continuously while the connection is active. Never card numbers: Stripe does not expose them.
• Emails: the reminder emails sent to your end customers (recipient, subject, content, send time) and their delivery events (bounce, complaint, click on the tracking link with its time and browser user agent).
• Usage: funnel events (for example "audit started", "Stripe connected"), an audit log of sensitive actions (connection, sending activation, approval of an AI-drafted email, pause, disconnection, dispute, deletion) and technical logs without secrets.
• Billing: your Reclaiva plan, your statements and, through Stripe, your payment method. Reclaiva never stores card numbers.

• Providing the Service (audit, recovery, measurement, statements, billing): performance of the contract.
• Securing the Service and preventing abuse: legitimate interest.
• Meeting accounting and tax obligations: legal obligation.
• Improving the Service with aggregated usage data: legitimate interest. Reclaiva does no advertising profiling.

Data is stored in Supabase (Postgres database and authentication) in the AWS region eu-central-1, Frankfurt, Germany. The following providers process data on our behalf:

Where a provider is outside Switzerland or the European Economic Area, transfers rely on the standard contractual clauses recognised by the Swiss FDPIC and the European Commission, or on an adequacy decision (to be confirmed per provider at the legal review).

• Data read from your Stripe account: kept while your connection is active, deleted when you disconnect or delete your account.
• Account data: kept while your account exists, deleted when you delete your account.
• Emails sent and delivery events: kept 12 months after sending for deliverability and dispute purposes, then deleted. Suppression lists (bounces, complaints) are kept as long as needed to honour them.
• Statements and invoices: kept 10 years, as required by Swiss accounting law (art. 958f of the Code of Obligations).
• Audit log: kept 12 months.

• Stripe tokens and keys are encrypted at rest with AES-256-GCM and never displayed after entry.
• Row-level security in the database: one account never reads another account's rows. The service role is used only on the server.
• Read-only scope on Stripe; an automated test verifies that a write is refused.
• TLS in transit. Secrets are never written to logs, error messages or source control.
• Webhooks are verified by signature and processed once.

Reclaiva uses only strictly necessary cookies: the session cookie of the authentication service and a cookie that remembers your language. No advertising or tracking cookies.

Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR, you may ask for access to your data, its rectification or erasure, the restriction of its processing, its portability, and object to processing based on legitimate interest. Write to the contact address above. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or with your local supervisory authority.

End customers of our Customers should address their requests to the business that bills them. Reclaiva assists that business as described in the Data Processing Agreement.

Reclaiva may update this policy. Material changes are announced by email 30 days before they take effect.