Solely to operate the Service: monitoring disputes, generating response evidence and rebuttal letters, submitting them to Stripe or PayPal, charging our fee, showing your dashboard, and sending you service emails (dispute alerts, deadline warnings, fee notices, password resets, replies to support requests) and, if you joined our mailing list, our newsletter. We do not sell personal data, and we never use your account, dispute or customer data for advertising. The advertising tools we use are Reddit's pixel and Google's ad tag on our homepage and sign-up page, which measure our own Reddit and Google ads (section 5).
Rebuttal letters may be drafted by proprietary AI using the dispute's ID, amount and reason code and the business information you provided. The customer's name and contact details are not included. If you use "Scan my site", the text of the public pages we read from your website is processed the same way, to suggest answers for you to confirm. Either one sends that content to a third-party AI infrastructure provider, which processes it under commercial terms that prohibit using it to train models. We do not use your data to train anything ourselves.
We share data with no one else, except where required by law.
Two cookies, both needed for the Service: a signed session cookie that keeps you logged in, and a security token that stops other websites from making requests as you. The dashboard also keeps two things in your browser's own storage: your light or dark setting, and a copy of your connected Stripe account's public profile (such as its name and logo) so the page loads faster, which is cleared when you sign out.
Reddit's advertising pixel. Our homepage loads Reddit's pixel, and so does our sign-up page just after you create an account, so we can tell whether our Reddit ads lead to visits and sign-ups. It sets its own cookies on our site (such as _rdt_uuid, and _rdt_cid if you arrived from a Reddit ad) and sends Reddit the page's address, your IP address, details of your browser, and whether you visited or signed up. If you type an email address on our homepage, for example to join our mailing list, it may also send Reddit a scrambled (hashed) copy, which Reddit uses to match the visit to a Reddit account. Reddit handles this under its own Privacy Policy. The pixel never runs in the dashboard or when you sign in, and it does not load at all if your browser sends a Global Privacy Control signal.
Google's ad tag. Our homepage loads Google's ad tag, and so does our sign-up page just after you create an account, so we can tell whether our Google ads lead to sign-ups. It sets its own cookies on our site (such as _gcl_au, and _gcl_aw if you arrived from a Google ad) and sends Google the page's address, your IP address, details of your browser, and whether you visited or signed up. We have turned off ad personalization, so Google does not use this data to personalize ads. Google handles it under its own Privacy Policy. Like Reddit's pixel, the tag never runs in the dashboard or when you sign in, and it does not load at all if your browser sends a Global Privacy Control signal. We use no other analytics or advertising cookies.
Account, workflow, and dispute data are retained while your account is active, because dispute history informs future cases.
Backups. Once a day we take a snapshot of the database and keep the last 14, about two weeks' worth, on our hosting volume, next to the database and with the same protection. Each snapshot, and every evidence and case file, may also be copied to our backup storage provider. Those offsite copies are encrypted (AES-256-GCM) before they leave our servers and are kept for 90 days. Backups are used only to recover the Service after a failure.
Deleting your account. When you delete your account (or we do at your request), we remove your data from the live database and your files from our hosting volume straight away. We do not edit backups: copies made before the deletion expire on their own, within about two weeks on our hosting volume as newer snapshots replace them, and within 90 days offsite, plus any period our storage provider keeps an expired version before removing it.
Two records outlive a deleted account. Neither is linked to your login, and neither holds customer details or evidence. One is our fee ledger (amounts, currencies, dates, and payment and invoice references), which we need for accounting and tax. The other is a list of the disputes we filed (the processor's dispute ID, the processor account it belongs to, and its dates and outcome), so that the fee on a case we filed is still due if that account is connected to Takeback again and the case is won. Invoices already issued also stay with Stripe.
When we file evidence on your behalf we keep a copy of the case file we submitted, so that what was filed can be established later. It is not published, linked, or shown in your dashboard. There are exactly two ways to read it: download your data from Settings (or ask us for it), which includes the case files, or open the copy your payment processor holds on your own account. Deleting your account deletes ours from the live service; copies in backups expire as described above.
All traffic is encrypted in transit (HTTPS). Passwords are hashed with scrypt; the keys, tokens and secrets you connect with are encrypted at rest (AES-256-GCM); offsite backups are encrypted before upload; sessions are revoked when a password is reset; credential endpoints are rate-limited. No system is perfectly secure — report concerns to the address below.
You can see and update your business data in the dashboard at any time, download a copy of your data from Settings, and delete your account there. The dashboard won't delete an account while a dispute we filed is still waiting for the bank's decision, or while a fee is unpaid (see section 10 of the Terms); if you need your data erased sooner, email us. Depending on where you operate, you may have additional statutory rights (e.g., GDPR/UK GDPR, CCPA); we will honor verified requests.
If this policy changes materially we will notify you by email or in the dashboard before the change takes effect.
The data controller for the information described above is Takeback LLC, a Kansas limited liability company. Contact us at support@takeback.cc.