Privacy policy

Privacy for sensitive refund evidence.

Last updated: July 19, 2026

This policy explains the information processed through refundora.app, why it is needed, which service providers support the product, and how a case can be deleted.

1. Scope and service operator

This policy applies to Refundora and the website at refundora.app. The legal merchant and service-operator details are displayed by the payment provider during checkout and on the payment receipt. Privacy questions may be sent to support@refundora.app.

2. Information we process

  • Case details: merchant name, amount, currency, dates, merchant response and requested resolution.
  • Contact details: the email address used for secure case access, recovery and service messages.
  • Evidence: PDF, JPG or PNG files you choose to upload and text extracted from those files.
  • Generated content: case summaries, timelines, letters, evidence indexes and final PDF packets.
  • Payment records: provider transaction identifiers, amount, currency, status and limited masked card metadata. Refundora does not store full card numbers or card security codes.
  • Technical and usage data: request logs, security events, approximate device category, referring page and a first-party anonymous visitor identifier.

3. Why we use this information

Information is used to create and secure a case, upload and analyze evidence, confirm payment, generate and deliver the requested packet, send recovery and completion messages, prevent abuse, troubleshoot failures, maintain accounting and operational records, and improve the reliability of the service.

4. Passwordless access and cookies

Refundora does not require a traditional password account. Access is protected through private case links, revocable tokens, short-lived recovery links and an HttpOnly browser cookie. A private link should be treated like a password and should not be forwarded or posted publicly.

Optional Google Analytics and advertising-measurement storage is controlled by the consent banner. You may accept or reject optional storage and reopen the choice from the Cookie settings control in the footer. Essential security, case-access and payment functions are not disabled when optional analytics is rejected.

5. Evidence storage and artificial intelligence

Evidence is stored in a private object-storage bucket and accessed through short-lived signed URLs. After payment, extracted text and confirmed facts may be sent to the configured AI processing provider to organize the evidence and draft the packet. The case email address is not intentionally included in the AI document-generation prompt. AI and OCR output can be incomplete or wrong, so the user must review and confirm the facts before final generation.

6. Service providers

Refundora uses service providers for hosting, PostgreSQL database storage, private object storage, AI processing, email delivery and payment processing. Current production providers include Lava.top for payment processing and Resend for transactional email. Providers process information only for the service they supply and under their own security and legal obligations.

7. International processing

Some providers may process or store information in a country different from the user's country. By using the service, you understand that case information may be transferred for hosting, email delivery, payment processing or AI processing, subject to the safeguards and contractual arrangements available to the operator and provider.

8. Retention and deletion

The default automated case-retention period is up to 45 days after the case was last updated. The cleanup process removes the case record, generated document, rollback copy and files stored under the case. A completed case may also be deleted immediately from its secure case page. Limited payment, fraud-prevention, support and accounting records may be retained longer when reasonably necessary or legally required.

9. Analytics, Google Tag Manager and server logs

Refundora uses limited first-party analytics and, with the visitor's consent, Google Tag Manager and Google Analytics 4 to understand page traffic, referral sources, device categories and the performance of the checkout flow. Measurement events may include a case start, checkout start, confirmed purchase and completed document. Refundora does not intentionally send case text, evidence files, merchant names, email addresses, full card details or other directly identifying case content to Google.

When optional storage is rejected, Google consent signals remain denied. Depending on the configured consent mode, Google tags may receive limited cookieless measurement signals without writing analytics or advertising cookies. Infrastructure and security providers may separately keep temporary network logs for operations and abuse prevention.

10. Your choices and requests

You may avoid uploading optional evidence, delete a completed case from the secure page, or contact support to request access, correction or deletion where applicable. Refundora may need to verify that a request comes from the email address connected to the case before acting on it.

11. Security

Refundora uses private storage, restricted file types and sizes, short-lived signed links, server-side credentials, payment-webhook signatures, rate limits, access tokens and encrypted HTTPS transport. No online system can guarantee absolute security. Report a suspected security issue to support@refundora.app.

12. Children

Refundora is intended for adults who can enter into a purchase and manage their own consumer matter. The service is not directed to children.

13. Changes to this policy

This policy may be updated when the service, providers or legal requirements change. The current version and update date will remain available on this page.