Privacy Policy
Last updated: October 28, 2026. Draft: have it reviewed by a lawyer before relying on it.
Who we are
Dunly ("we") provides software that sends payment reminder emails on behalf of subscription businesses ("customers"). Contact: support@dunly.uk.
Two kinds of people, two roles
Our customers (the businesses that sign up). For their account data we act as the controller.
Our customers' buyers (people who received a failed payment). For their data we act as a processor: we handle it only on our customer's instructions, to send payment reminders.
What we collect
- From customers: email address, a hashed password, product name, support email, and the Stripe webhook signing secret they provide.
- From Stripe webhooks: invoice ID, buyer email, buyer name (if present), amount, currency and the hosted invoice link.
- Technical data: IP address used for login rate limiting, and a session cookie.
We do not collect or store card numbers, and we do not ask for your Stripe secret API key.
How we use it
To send reminder emails, show recovered revenue, run the service, prevent abuse, and bill our customers. We do not sell personal data and do not use it for advertising.
Service providers
- Resend: sends emails.
- Our hosting provider: stores the database.
- Our payment provider (merchant of record): processes subscription payments for Dunly itself.
Retention
Webhook event IDs are deleted after 30 days. Failed-payment records and customer accounts are kept while the account is active. On request we delete an account and its data.
Your rights
You can ask to access, correct or delete your data. If you are a buyer who received one of our emails, contact the business that sent it, or write to us and we will pass the request on or act on it.
Security
Passwords are hashed with scrypt, webhook signatures are verified, and sessions use HttpOnly cookies. No system is perfectly secure.
Changes
We will update this page when the policy changes.