churnhook

Privacy policy

Last updated: 18 September 2026

This policy explains how CODARCA (“we”) processes personal data when you visit churnhook.com, create a workspace, join the pilot waitlist, or use the churnhook service. It is separate from the Terms and the legal notice.

Controller: CODARCA, SAS, 125 rue Vers Vaulx, 38540 Grenay, France. Contact: contact@codarca.fr. We have not appointed a data protection officer.

Two roles

We are the controller for operator accounts, the churnhook subscription, security logs, and the pilot waitlist.

We are the processor for recovery data we handle on your instructions: customers, subscriptions, invoices, cancellation reasons, sequence runs, and emails sent to your customers. You remain the controller for that data. That processing is governed by the data processing agreement in the Terms.

Data we process as controller

Account and workspace. Name, email, password hash or Google account identifier, organisation name, role, language, date format, timezone of the workspace. Legal bases: contract; legitimate interest in securing the account.

Billing. Stripe customer and subscription identifiers for the churnhook plan (€79 / month plus peak-MRR packs), payment status, invoices. Card details are entered on Stripe, never stored by CODARCA. Legal bases: contract; legal obligation to keep invoices.

Support and contact. Messages you send to contact@codarca.fr. Legal basis: legitimate interest / pre-contractual steps.

Pilot waitlist. Name, email, company, product URL, approximate MRR band, IP address (rate limit and Turnstile). Legal bases: legitimate interest and pre-contractual steps. This does not create an account.

Security and abuse. Technical logs, IP address, Turnstile tokens. Legal basis: legitimate interest in protecting the service.

We do not sell personal data.

Data we process as processor

When you connect Stripe, we import and keep up to date the data needed for recovery: customer name and email, subscription and invoice identifiers, amounts, status, cancel dates, cancellation reasons and optional comments, and the content of recovery emails you configure. We send those emails through Resend, on your brand when a sending domain is verified.

We never store your Stripe secret key. Cards are collected only on Stripe (Portal or Checkout). Public offer, pause, keep and portal links use a churnhook token; they do not create a consumer account with us.

Recipients

Depending on the purpose:

Authorities may receive data if the law requires it.

Transfers outside the EU

PostgreSQL and Redis run in Amsterdam. The website (Vercel), OpenAI, and some Stripe / Resend / Cloudflare processing may take place in the United States or other third countries. Those transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission’s standard contractual clauses, plus supplementary measures where needed.

Retention

Your rights

You may request access, rectification, erasure, restriction, objection, and portability, and withdraw consent where a processing is based on consent. Write to contact@codarca.fr. You may lodge a complaint with the CNIL (cnil.fr).

If we hold data only as your processor, we will point the person to you or assist you under the DPA.

Cookies and local storage

We do not use analytics or advertising cookies. No consent banner is shown.

Strictly necessary items:

You can delete cookies and localStorage in the browser; you will need to sign in again.

Public ticket pages

/offer, /pause, /keep and /portal only resolve a token. Those flows process data under the DPA, not as a consumer account with CODARCA.

Changes

We will update the date at the top of this page when the policy changes. Material changes will be announced in the product or by email when we have an address.