1. What We Collect

We collect information you provide directly:

• Account data — email address, name, password (hashed)
• Claim data — platform, issue type, order ID, order total, order date, restaurant name, and your description of what happened
• Evidence checklist — which evidence types you have (we do not store uploaded files beyond your account)
• Payment data — handled entirely by Stripe. We store only your Stripe customer ID, not your card number

We also collect standard server logs (IP address, browser type, pages visited) and usage analytics.

2. How We Use Your Data

• To generate your dispute scripts and chargeback packages via our AI
• To track your claim history and outcomes
• To process payments and manage your subscription
• To send transactional emails (account confirmation, receipts)
• To display aggregate, anonymized win-rate statistics on our platform
• To improve the Service

We do not sell your personal data. We do not use your data to train AI models without explicit consent.

3. AI Processing

Claim details you enter are sent to Anthropic's Claude API to generate dispute scripts. Anthropic's data use policy applies to this processing. We send only the minimum necessary claim details — we do not send your name, email, or payment information to the AI.

4. Data Sharing

We share data only with:

• Supabase — database and authentication hosting
• Stripe — payment processing
• Anthropic — AI script generation
• Resend — transactional email delivery
• Vercel — application hosting

We may disclose your data if required by law or to protect our rights.

5. Win Wall & Public Data

If you report a win and opt in to the public win wall, we display your platform, issue type, amount recovered, and optionally your quote and city. No name or account information is displayed. You can opt out at any time from your account settings, which will remove your entry from the win wall.

6. Data Retention

We retain your account and claim data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law or for fraud prevention.

7. Your Rights (CCPA / California Residents)

California residents have the right to:

• Know what personal data we collect and how it is used
• Request deletion of your personal data
• Opt out of the sale of personal data (we do not sell data)
• Non-discrimination for exercising these rights

To exercise any of these rights, email hello@getdisputo.com.

8. Security

We use industry-standard security practices including encrypted connections (HTTPS), row-level security on our database, and hashed passwords. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

9. Children

Disputo is not directed to children under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

10. Changes

We may update this Privacy Policy. We will notify you of material changes by email and update the effective date above.

11. Contact

Privacy questions or data requests: hello@getdisputo.com