1. Who We Are
Verdact is a chargeback dispute management platform for Stripe merchants. We help merchants monitor dispute-rate risk and organize dispute evidence records for merchant review.
Contact: admin@verdact.io
2. Data We Collect
Slack, if you choose to connect
- Read-only access to message content from channels you explicitly select
- We read messages only when you initiate an evidence search for a specific dispute
- We do not read, store, or scan your workspace continuously or in the background
Gmail (not offered at launch)
- Gmail connection is not available to merchants at launch. If and when we enable it, we will read email content only when you initiate an evidence search for a specific dispute, and we will update this policy before turning it on.
Stripe, required
- Dispute records, transaction data, and early fraud warning events via Stripe OAuth
Account data
- Name, email address, and login credentials for your Verdact account
Audit tool, if you use it
- The public dispute audit tool collects the email address and optional business name you enter, plus the dispute figures you submit (such as transaction counts, dispute amounts, reason codes, outcomes, and which evidence types you say you hold)
- We store these submissions and the score we calculate so we can follow up about your results
- We store a one-way hashed form of your IP address and your browser user-agent string for rate limiting and abuse prevention, not your raw IP
Waitlist, if you join
- Sign-up is invite-only during the launch period. If you join the waitlist, we collect the email address you submit and a tag noting where you signed up
- As with the audit tool, we store a one-way hashed form of your IP address and your browser user-agent string for rate limiting and abuse prevention
Product analytics
- We use PostHog to understand how the product is used. This captures pageviews, clicks, and similar interaction events
- For signed-in merchants, events are tied to a pseudonymous account identifier, never to your name or email
- In production we record anonymized session replays. Replay is configured to mask all form inputs and all on-screen text, so customer names, evidence, and dispute detail are not legible in a recording. Session replay is disabled in local development
- If coarse country and region capture is enabled, we may record an approximate location derived from request headers. We do not store your raw IP address for this purpose
3. How We Use Your Data
We use your data to:
- Identify relevant evidence for a chargeback dispute you are actively working on
- Prepare submission-ready dispute evidence records for merchant review
- Calculate and display your estimated dispute-rate standing
- Send transactional notifications about dispute deadlines and outcomes
- Follow up about audit results or waitlist sign-ups you submit to us
- Understand product usage and improve the service through analytics
We do not:
- Sell your data to third parties
- Use your connected Slack data to train AI models
- Access your connected Slack workspace outside of an active evidence search you initiate
- Send your customers' data to Stripe except as part of a dispute evidence submission you (or your configured automatic-filing rules) initiated
- Share your data with any party other than Stripe and the service providers listed in Section 5
4. Data Storage and Security
- All data is stored in encrypted databases using AES-256 at rest
- Slack access tokens are encrypted and never stored in plain text
- Evidence extracted from connected sources is deleted within 90 days of dispute resolution
- We use Supabase for database infrastructure and Vercel for hosting
5. Third-Party Services
We share data with the following services only as necessary to operate the platform:
- Stripe — We read dispute, charge, and early-fraud-warning data from your connected Stripe account. When you approve and submit an evidence packet, Verdact sends the approved evidence to Stripe on your behalf, which may include: the customer's name, email, and billing address as recorded on the disputed charge; the files and text you approved as evidence; and your business's product description and refund/cancellation policy text. This only happens for a specific dispute you have reviewed and explicitly submitted (or, if you have separately enabled automatic filing, disputes matching criteria you configured).
- Supabase - database storage
- Vercel - hosting infrastructure
- Anthropic - AI evidence drafting
- Resend - transactional email delivery
- PostHog - product analytics and anonymized session replay
6. Google API Data
Gmail connection is not available to merchants at launch. The commitments below describe how we would handle Google API data if and when we enable Gmail, in line with the Google API Services User Data Policy, including the Limited Use requirements.
- We would request Gmail access only when a user explicitly initiates an evidence search
- Gmail data would be used only to identify dispute-relevant emails such as service delivery proof, usage confirmations, refund-policy references, and customer communications
- We would not use Gmail data for advertising or to build user profiles
- We would not allow humans to read your Gmail data except where you have given explicit consent or where required by law
7. Your Rights
You may at any time:
- Disconnect Slack: Slack admin settings → Installed apps → Verdact → Remove
- Disconnect Stripe: Verdact dashboard → Settings → Integrations → Disconnect
- Request data deletion: email admin@verdact.io with subject "Data Deletion Request" - processed within 30 days
- Request data export: email admin@verdact.io with subject "Data Export Request"
8. Data Retention
- Active account data: retained while your account is active
- Raw imports from connected sources not included in an evidence record: deleted within 90 days of dispute resolution
- Evidence records: retained for at least 24 months or longer where card-network, legal, tax, fraud-prevention, or audit obligations require it
- Customer PII in retained records: redacted on valid deletion request where retention rules allow
- Account data after deletion request: purged or de-identified within 30 days unless retention rules require preservation
9. Changes to This Policy
We will notify you by email at the address on your account before making material changes to this policy.
10. Contact
Questions about this policy: admin@verdact.io