Privacy Policy

Unquit is run by Saurav Kumar Sah, operating Unquit, based in Bengaluru, India. For founders’ own account data, Unquit decides how it is used. For your customers’ data, you are in charge and Unquit processes it on your behalf, only to run the features you turn on.

• Your login: email address and a bcrypt hash of your password (never the password itself).
• Your settings: company name, reply-to address, cancel-flow offers, dunning email copy and schedule.
• Your Stripe connection: your Stripe account id and whether it is in test or live mode. If you connect with a restricted key, we store that key and the webhook signing secret encrypted (AES-256-GCM), plus your Stripe publishable key and the last 4 characters of the restricted key so you can recognise it.
• Billing: your saves, fees, statements, charges and disputes. Your billing card is collected and stored by Dodo Payments (Unquit's merchant of record); we only keep Dodo's customer and subscription ids, the card brand and last 4 digits, and each charge's status and receipt link.

Only what the features need, read from your Stripe account or from the cancel flow:

• Stripe ids for the customer, subscription, invoice and price; plan, amount, currency and status.
• Cancel flow: the reason they picked, any comment they typed, and the offer they accepted or declined.
• Failed payments: their email address and name (from the Stripe invoice), the invoice number and amount, Stripe’s decline code, which emails were sent, and when the card-update link was opened or clicked.
• Card details typed on the card-update page go straight to Stripe through Stripe’s own card form. Unquit never sees or stores card numbers.

Full details of each Stripe object Unquit reads and changes are on the Data Use page.

• A sign-in cookie that keeps you logged in to the dashboard.
• IP addresses, briefly, to rate-limit the public cancel-flow API, and in Vercel’s short-lived request logs.
• Your light or dark theme choice, saved in your browser.
• Google Analytics cookies on the public pages only (home, sign-up, sign-in and these policy pages).

• To run Unquit for you: apply offers, send the failed-payment emails you turned on, prove saves and bill you.
• To keep it secure: sign-in, rate limits, fraud and abuse checks.
• To contact you about your account, receipts, disputes and bills.
• To understand which marketing pages are visited (Google Analytics, marketing pages only).

We don’t sell personal data, we don’t use your customers’ data for advertising, and we don’t email your customers for our own purposes.

• Vercel

  Hosts the website, the dashboard and the API, and keeps short-lived server logs.

• Neon

  The Postgres database where Unquit’s records are stored.

• Stripe

  Your connected Stripe account (where your customers’ billing lives) and the secure card form on the card-update page.

• Dodo Payments

  Merchant of record for Unquit’s own fees: collects and stores your billing card, charges your monthly statement, issues receipts and handles sales tax/VAT. Receives your name, email, billing address and the statement amounts.

• Resend

  Sends the failed-payment emails to your customers and receipt and billing emails to you.

• Google Analytics

  Counts visits to the public marketing pages. It is switched off on the dashboard, the card-update pages your customers see and developer setup links.

Their servers may be outside India (for example in the United States). We’ll update this list before adding a new one.

• When you disconnect Stripe, Unquit stops reading and writing your Stripe account straight away. For a restricted-key connection we delete the webhook endpoint Unquit created in your Stripe account and wipe the stored key and signing secret. For Stripe Connect we revoke Unquit’s access.
• Records already collected (saves, receipts, statements, disputes and failed-payment cases) are kept after you disconnect, so your receipts and bills stay correct and any open disputes can finish.
• Ask us to delete everything by emailing sauravsahbrj@gmail.com from your account email. We’ll delete your account and all records linked to it, including your customers’ data, within 30 days. Charges and receipts for Unquit's fees stay with Dodo Payments as billing records.
• If one of your customers asks you to delete their data, email us their Stripe customer id and we’ll remove what Unquit holds about them.

Everything is sent over HTTPS. Passwords are hashed with bcrypt, restricted keys and webhook secrets are encrypted at rest, and every database query is scoped to your own account. No system is perfectly secure; if we learn of a breach affecting your data, we’ll tell you by email without undue delay.

You can ask to see, correct, export or delete your data, or object to how it is used. Email sauravsahbrj@gmail.com and we’ll reply within 30 days.