1. Who We Are and What This Covers
Verdact is a chargeback dispute management platform for Stripe merchants, including businesses, freelancers and individuals who take card payments through Stripe. We help you monitor dispute-rate risk and organize dispute evidence records for your review. Verdact is operated by Verdact LLC, a Wyoming limited liability company.
Our two roles. For your own account data (your name, email, sign-in details, settings and how you use Verdact) Verdact LLC decides how the data is used, and is the controller of it. For personal data about your customers that you ask Verdact to work with in a dispute, such as the name, email and billing address on a disputed charge, we act on your behalf and on your instructions. You remain responsible for having the right to use that data for your dispute and for any notice you owe your own customers. If one of your customers asks us about their data, we will point them to you and help you respond.
Contact: admin@verdact.io
2. Age Requirement
Verdact is for people aged 18 or older who use it for themselves or for a business. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email us and we will delete it.
3. Data We Collect
Account data
- Name, email address and sign-in credentials for your Verdact account (passwords are stored by our sign-in provider as one-way hashes, never in readable form)
- Workspace and business details you enter, such as business name, product description, and refund and cancellation policy text or links
- Your notification and email preferences
Records of what you agreed to
- When you accept our Terms and Privacy Policy we record the version you accepted, the time, your IP address and your browser user-agent string. We keep the IP address (not a hash) so the record can show who accepted what, and when
Stripe, required
- Dispute records, charge and transaction data, and early fraud warning events, received through Stripe OAuth. We store your Stripe account identifier, not your Stripe access token
- Personal data about your customers that Stripe holds on the disputed charge, such as name, email and billing address
Slack, if you choose to connect
- Read-only access to message content from channels you explicitly open
- We read messages only when you start an evidence search for a specific dispute
- We do not read, store, or scan your workspace continuously or in the background
Gmail (not offered at launch)
- Gmail connection is not available to merchants at launch. If and when we enable it, we will read email content only when you initiate an evidence search for a specific dispute, and we will update this policy before turning it on.
Evidence you add
- Files you upload, text you write or paste, and the evidence packets you assemble. Each uploaded file is hashed when it is stored
- Evidence text and documents you include in a dispute may be sent to our AI provider so it can draft a response or read a document (see Section 6)
Audit tool, if you use it
- The public dispute audit tool collects the email address and optional business name you enter, plus the dispute figures you submit (such as transaction counts, dispute amounts, reason codes, outcomes, and which evidence types you say you hold)
- We store these submissions and the score we calculate so we can follow up about your results
Waitlist, if you join
- Sign-up is invite-only during the launch period. If you join the waitlist, we collect the email address you submit and a tag noting where you signed up
Feedback you send
- If you use the feedback widget we store your message, the category you chose, the page or screen you were on, whether a screenshot was attached, your email address if you gave one (or your account email if you are signed in), and your browser user-agent string
Usage and security data
- We use a product analytics provider to understand how the product is used. This captures pageviews, clicks, and similar interaction events
- For signed-in users, events are tied to a pseudonymous account identifier, never to your name or email
- In production we record anonymized session replays. Replay is configured to mask all form inputs and all on-screen text, so customer names, evidence, and dispute detail are not legible in a recording. Session replay is disabled in local development
- Our hosting provider supplies aggregate page-view and performance measurement. This records the page, referrer, approximate location, and browser and device type, and are designed not to identify an individual visitor
- Our host keeps ordinary server request logs, which include IP addresses, for security and troubleshooting
- For rate limiting and abuse prevention on the public audit and waitlist forms we store a one-way hashed form of your IP address and your browser user-agent string, not your raw IP
- If coarse country and region capture is enabled, we may record an approximate location derived from request headers. We do not store your raw IP address for this purpose
4. How We Use Your Data
We use your data to:
- Provide Verdact: identify relevant evidence for a chargeback dispute you are actively working on and prepare submission-ready evidence records for your review
- Calculate and display your estimated dispute-rate standing
- Send transactional notifications about dispute deadlines, alerts and outcomes, and tell you about changes to our Terms or this policy
- Follow up about audit results or waitlist sign-ups you submit to us
- Respond to feedback and support requests
- Keep Verdact secure, prevent abuse and fraud, and meet our legal obligations
- Understand product usage and improve the service through analytics
We do not:
- Sell your data, or share it with third parties for their own advertising
- Train AI models on your data
- Access your connected Slack workspace outside of an active evidence search you initiate
- Send your customers' data to Stripe except as part of a dispute evidence submission you (or your configured automatic-filing rules) initiated
- Share your data with anyone other than Stripe, the services listed in Section 5, and the situations described there
Email: Verdact currently sends transactional and service emails only. We do not send marketing newsletters. If that changes we will ask first, and every marketing message will include a way to opt out. You can switch most notification emails on or off in Settings.
5. Who We Share Data With
These services process data on our behalf, and only as needed to run Verdact:
- Cloud database and storage provider — Database, sign-in and file storage, hosted in the United States. Data involved: Account data, workspace data, uploaded evidence files, dispute records, consent records.
- Hosting and site-analytics provider — Website hosting, request logs, and aggregate page-view and performance measurement. Data involved: Requests to the site, including IP address in server logs; page, referrer, approximate location, browser and device type for aggregate measurement.
- Background-job provider — Runs background tasks such as syncing disputes and sending reminders. Data involved: Job inputs and results, which can include dispute identifiers and amounts.
- AI provider — AI drafting and document reading on the evidence you include. Data involved: Evidence text and documents you include in a dispute.
- Email delivery provider — Transactional email delivery. Data involved: Recipient email address and the content of the email.
- Product analytics provider — Product analytics and masked session replay. Data involved: Pageviews, clicks and similar events; for signed-in users a pseudonymous account identifier; masked replays.
- Password-safety service — Checks new passwords against a public list of breached passwords. Data involved: Only the first five characters of a one-way hash of the password; never the password itself.
Services you connect yourself:
- Stripe — Your payment processor. Verdact reads your disputes, charges and early fraud warnings, and, only if filing is switched on and you approve, sends the evidence you approved.
- Slack (optional) — Verdact reads messages from channels you open, only when you start an evidence search for a dispute.
What reaches Stripe when you file. When you approve and submit an evidence packet, Verdact sends the approved evidence to Stripe on your behalf, which may include: the customer's name, email, and billing address as recorded on the disputed charge; the files and text you approved as evidence; and your business's product description and refund/cancellation policy text. This only happens for a specific dispute you have reviewed and explicitly submitted (or, if you have separately enabled automatic filing, disputes matching criteria you configured). Stripe, the card networks and the issuing bank then handle it under their own rules.
Other situations. We may disclose data when the law requires it, to protect the rights, safety or security of Verdact or others, or to a buyer or investor if Verdact LLC is involved in a merger, financing or sale of its assets (we would tell you first and the same protections would continue). We keep a current list of the services above on our security page.
6. Artificial Intelligence
- Verdact sends the evidence text and documents you include in a dispute to an AI provider to draft a response and to read documents
- AI output is a draft. You review and approve it, and you are responsible for what you file. AI can make mistakes
- Verdact does not train AI models on your data, and your connected Slack data is not used to train AI models
- We send the AI provider only what is needed for the task you started
7. Data Storage and Security
- Data is stored in encrypted databases using AES-256 at rest, and sent over HTTPS
- Slack access tokens are encrypted again by Verdact before they are stored and are never stored in plain text
- Access to your workspace data is limited to your workspace through row-level security in the database
- Our database and hosting providers operate in the United States
- No system is perfectly secure, and we cannot promise that a security incident will never happen. Please use a strong, unique password
8. Google API Data
Gmail connection is not available to merchants at launch. The commitments below describe how we would handle Google API data if and when we enable Gmail, in line with the Google API Services User Data Policy, including the Limited Use requirements.
- We would request Gmail access only when a user explicitly initiates an evidence search
- Gmail data would be used only to identify dispute-relevant emails such as service delivery proof, usage confirmations, refund-policy references, and customer communications
- We would not use Gmail data for advertising or to build user profiles
- We would not allow humans to read your Gmail data except where you have given explicit consent or where required by law
9. How Long We Keep Data
- Account data: while your account is active
- Raw imports from connected sources not included in an evidence record: deleted within 90 days of dispute resolution
- Evidence records: kept for at least 24 months, or longer where card-network, legal, tax, fraud-prevention or audit rules require it
- Customer personal data in retained records: redacted on a valid deletion request where those rules allow
- Records of what you agreed to: while your account is active and for 3 years after it closes, so we can show what was accepted
- Waitlist sign-ups, audit tool submissions and feedback: up to 24 months, or until you ask us to delete them if sooner
- Account data after a deletion request: within 30 days we delete your sign-in details, connections, uploaded files and the customer details we imported. We keep a de-identified record of any dispute response we filed for you: the packet exactly as filed (so it contains whatever evidence you included), the internal ID of the account that approved it, the time and IP address of that approval, and a log of changes. Card-network, legal, tax and audit rules can require this
- Analytics data held by our analytics and hosting providers follows the retention settings of those services
- Backups and logs roll off on their providers' normal schedules
10. Your Rights and Choices
You may at any time:
- Disconnect Slack: Slack admin settings → Installed apps → Verdact → Remove
- Disconnect Stripe: Verdact dashboard → Settings → Integrations → Disconnect, or revoke Verdact in your Stripe dashboard
- Change your email notification choices in Settings
- Ask for a copy of your data, to correct it, or to delete it: email admin@verdact.io with the subject "Data Request", or start an account deletion request in Settings
We will reply within 30 days. We may need to confirm it is really you before acting. There is no one-click export yet, so we prepare exports by hand. We do not charge for ordinary requests.
Depending on where you live, such as California and other U.S. states, you may have extra rights over your personal data, including to know what we hold, correct or delete it, and opt out of its sale or sharing for advertising. We do not sell personal data or share it for advertising, and we will handle these requests from anyone, wherever they live. If we decline a request you can reply to ask us to look again.
11. Where Your Data Is Handled
Verdact is operated from the United States and our database is hosted in the US East region. If you use Verdact from outside the United States, your data will be transferred to and processed in the United States, which may have different data protection laws from your country.
12. Links to Other Sites
Verdact links to sites we do not run, such as Stripe, Slack and the card networks. We are not responsible for their privacy practices, so please read their policies.
13. Changes to This Policy
We will notify you by email at the address on your account before making material changes to this policy.
14. Contact
Questions about this policy: admin@verdact.io