Last updated September 27, 2026
Draft, pending legal review. This describes how Detractr actually behaves today, but hasn't been reviewed by counsel and doesn't yet name a finalized legal entity or jurisdiction — ticket 02 covers that. Treat this page as accurate about the product, not yet as a signed, binding document.
The Workspace is the controller of its own customers' personal data. Detractr is the processor, acting only on the Workspace's instructions as expressed through its own Program configuration and this product's normal operation.
Processing personal data mirrored from the Workspace's connected Stripe account, for as long as the Workspace keeps that Connection active, or until the Workspace closes its account (see Deletion, below).
Reading Stripe customer and subscription state to determine survey eligibility (the Sweep), sending survey Invitations, recording Responses, and surfacing them back to the Workspace (the dashboard, the Detractors queue, and detractor alerts).
The Workspace's own paying customers — never Detractr's own Workspaces, who are our direct customers, not data subjects under this addendum.
Stripe customer id, email, name, first and last successful payment date, subscription status, whether a subscription is set to cancel at period end, and MRR — the exact field list ADR-0003 fixes deliberately short. Any Response a customer submits (a 0–10 score and optional free-text follow-up) is also personal data under this addendum once it can be tied back to a named customer.
Stripe (source of the mirrored data itself), our hosting provider (Vercel), and our bulk email delivery provider once ticket 02/14 selects one — updated here once that happens, with notice to Workspaces before any new sub-processor goes live.
Stripe credentials and webhook signing secrets are encrypted at rest, never rendered back once saved. No card numbers or payment methods are ever mirrored or stored. Every Connection is read-only — Detractr cannot initiate a charge, refund, or payout on a Workspace's Stripe account.
Disconnecting a Connection hard-deletes its entire Customer tree (every mirrored Customer, and every Invitation, Response, and alert beneath it) immediately, in the same action — not a queued job, not a grace period. Closing a Workspace hard-deletes everything beneath it, the same way. See our data retention position for the full detail, including what happens to raw Stripe webhook payloads.
A Workspace may request a summary of this processing at any time by contacting us — see below.
privacy@detractr.com (routing to be confirmed once ticket 02's domain/DNS work is complete).