Privacy Policy
Last updated September 23, 2026
This policy explains what information Dunnhawk handles, why, and who we share it with. It covers two groups: businesses that use Dunnhawk (our customers), and those businesses' subscribers who receive payment reminders from Dunnhawk on their behalf.
Information about our customers
- Account details you give us: your name, company name, brand name, work email and reply-to address.
- Your connected Stripe account ID, and settings like your brand name, logo and color.
- A sign-in cookie that keeps you logged in to your dashboard. We don't use advertising or tracking cookies.
Information about subscribers
When a subscription payment fails, Dunnhawk processes the minimum needed to help the business recover it, acting on that business's behalf:
- Subscriber name and email address, and their Stripe customer and subscription IDs.
- The failed invoice: amount, currency, dates and payment status.
- Email activity: when reminders were sent, whether the card-update link was clicked, and unsubscribe requests.
Dunnhawk never receives full card numbers. Card updates happen on Stripe-hosted pages.
How we use it
- To send payment reminders and create card-update links.
- To work out which payments were recovered and calculate fees fairly.
- To run, secure and support the service.
We don't sell personal information or use subscriber data for marketing.
Service providers
We use a small number of providers to run Dunnhawk:
- Stripe: payments data and card-update pages.
- Vercel: application hosting.
- Supabase: database hosting.
- Resend: email delivery.
- Anthropic: optional personalization of reminder wording. Only the brand name, amount due and the subscriber's first name are sent.
Some of these providers process data in the United States.
Unsubscribing
Every reminder email has a one-click unsubscribe link. Once used, Dunnhawk won't send that address further reminders for that business.
Retention and deletion
We keep data while an account is active and as needed for billing records. When a business closes its account, we delete its subscribers' data within 90 days, except where we must keep records by law. Subscribers can ask the business they pay, or us, to access or delete their information.
Security
Data is encrypted in transit. Webhook signing secrets are encrypted at rest, sign-in links are single-use and expire after 15 minutes, and we store only hashes of sign-in tokens.
Contact
Privacy questions or requests: ismail@dunnhawk.com