Privacy Policy

2. Data we process

2.1 Account data

When you create an account we process your email address, a hashed password, the one time code used to confirm your email, your name if you add it, and your role in the workspace.

2.2 Workspace and billing data

We process the workspace name, team members and their roles, your plan, usage counters, and billing details such as the billing address, tax ID if you provide one, invoices and payment status. Card details are entered directly with our payment processor. We see only the card brand, last four digits and expiry date.

2.3 Support and communication

When you email support@nochargeback.com we process your message, your email address and our reply.

2.4 Usage, device and log data

We record sign ins, actions in the app, IP address, browser and device type, and error logs. We use this data to run and secure the service.

2.5 Connected processor data

When you connect a payment processor or store platform, we process data that belongs to your business and to your customers: disputes, inquiries, early fraud warnings, charges, payment intents, invoices, subscriptions, orders, fulfillment and tracking data, customer names, email addresses, billing and shipping addresses, IP addresses, authentication and AVS or CVC results, and usage or access records your systems provide. We never receive full card numbers. We process this data only on your behalf, as described in section 4.

2.6 Demo uploads

If you use the demo and upload a dispute notice, we process the file and the details you enter to show a preview. Uploaded files are deleted after 24 hours.

2.7 Cookies

We use two strictly necessary cookies and nothing else: a session cookie that keeps you signed in and a security token (XSRF) that protects forms against forged requests. Both are required for the service to work, so they need no consent and we show no cookie banner. We do not use analytics, advertising or tracking cookies, ad pixels, fingerprinting or cross site tracking. We understand traffic only from our own server logs.

2.8 Marketing website

When you browse nochargeback.com, our servers log your IP address, browser, pages requested and the time of the request, to deliver the pages and protect the site.

3. Purposes and legal bases

We do not use your data for automated decisions that produce legal effects on you. The win chance score in the app estimates the strength of evidence for a dispute and is a tool for the merchant, not a decision about any person.

4. Your customers' data and our role as processor

For connected processor data described in section 2.5, the merchant is the controller and we act as a processor (a service provider under US state privacy laws). We process this data only to provide the service you request: to show alerts, build and submit evidence packs, compute chargeback ratios and produce analytics for your workspace. We do not use it for our own purposes, do not sell it, and do not combine it with data from other merchants.

You are responsible for having a lawful basis to share your customers' data with us and for informing your customers in your own privacy notice. A data processing agreement with standard contractual clauses is available on request by email to support@nochargeback.com. If your customer contacts us directly about their data, we refer them to you and assist you in answering.

5. Recipients

We share personal data only with service providers that help us run the service, under contracts that limit their use of the data to our instructions. We describe them by category.

• Infrastructure hosting provider, with servers in the EU or US region, for the application, database and backups.
• Payment processor, for our own subscription billing.
• Transactional email provider, for account emails, codes and alerts.
• AI text model provider, used only to draft evidence letters for disputes. Under our provider terms the data is not used to train their models.
• Your connected processors and platforms, when we submit evidence on your instruction.
• Professional advisers and public authorities, when law requires it or to defend legal claims.

We use strictly necessary cookies only, and no analytics or advertising providers receive your data. A full list of subprocessors is available to customers on request.

6. International transfers

We are established in the European Union and many of our users are in the United States. When personal data moves from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the standard contractual clauses approved by the European Commission, together with additional safeguards such as encryption. You can request a copy of the relevant safeguards by email.

7. Retention

• Account and workspace data is kept while your account is active and deleted within 30 days after account closure.
• Connected processor credentials are deleted immediately when you disconnect an account.
• Dispute, alert and evidence data is kept while the account stays connected, and deleted on request or within 30 days after account closure.
• Demo uploads are deleted after 24 hours.
• Logs are kept for up to 90 days, unless needed longer to investigate a security incident.
• Invoices and billing records are kept as long as tax and accounting law requires.

Backups containing deleted data roll off on their normal cycle within a further 30 days.

8. Security

We encrypt processor credentials at rest, use TLS for all traffic, verify webhook signatures, store passwords as salted hashes and limit staff access to what is needed for support you request. Processor connections use read permissions plus dispute evidence only, so the service cannot create charges, refunds or payouts. More details are on our security page. If you suspect a security issue, email support@nochargeback.com.

9. Your rights

9.1 Rights under GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access your data, correct it, delete it, restrict or object to processing, receive your data in a portable format and withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority.

9.2 Rights under US state privacy laws

If you are a resident of California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to access it, to correct it, to delete it, and to opt out of sale, sharing for cross context behavioral advertising and targeted advertising. You also have the right not to be discriminated against for exercising these rights.

We do not sell personal information and do not share it for cross context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the service. In the past 12 months we collected the categories of personal information described in section 2 (identifiers, commercial information, internet activity and professional information) for the purposes in section 3, and disclosed them only to the recipients in section 5.

9.3 How to exercise your rights

Email support@nochargeback.com from the address linked to your account, or tell us how to identify you if you do not have an account. We verify your identity before acting on a request. You may use an authorized agent, who must provide proof of authorization. We respond within 30 days. If you are not satisfied with our answer, you may appeal by replying to our response, and we answer appeals within 45 days.

If your request concerns data that a merchant shared with us about you as their customer, we forward it to that merchant, who decides on it as controller.

10. Children

The service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email support@nochargeback.com and we delete it.

11. Changes to this policy

We may update this policy when our service or the law changes. We post the new version on this page with a new date, and we notify account owners by email before material changes take effect.

12. Contact

Questions about this policy or your data go to support@nochargeback.com.

Last updated October 10, 2026.