FendPulse Privacy Policy
Plain-English summary
- FendPulse only reads what it needs from your Stripe account to send security alerts. It never changes anything.
- We store alert records and settings, not card numbers or your customers' personal details.
- We never sell your data. Our providers are listed at fendpulse.com/subprocessors.
- Data is stored in the United States. We protect international transfers with standard contractual clauses.
- Uninstall and we delete your data within 30 days, then email you to confirm.
The full policy below controls.
URL: fendpulse.com/privacy · Effective date: October 26, 2026
1. Who we are
FendPulse is operated by FendPulse LLC, a Florida limited liability company, 400 N Tampa St, Tampa, FL 33602, USA ("we", "us"). Crafted by RESILIENCE: Agentic Solutions LLC. Contact: [email protected]. This policy covers our company and the FendPulse app.
2. What FendPulse reads from your Stripe account
FendPulse is read-only. It never changes your Stripe account. When you install it, you approve these Stripe App permissions. We use each one only for the purpose shown:
| Permission | Why we use it |
|---|---|
event_read | Reads your account's events so FendPulse can spot risky changes, such as payout bank, owner, dispute and decline activity. |
connected_account_read | Reads your account status (charges and payouts enabled) and bank or owner changes for payout-lock alerts. |
webhook_read | Reads your webhook endpoints so FendPulse can alert you when one is added, removed, changed or set up unsafely. |
payout_read | Reads payouts so FendPulse can alert you when a payout fails. |
charge_read | Reads charges and refunds to detect card-testing bursts and unusual sales or refund spikes. |
dispute_read | Reads disputes so FendPulse can alert you to new disputes and a rising dispute rate. |
balance_read | Reads your balance so FendPulse can alert you when it goes negative. |
payment_links_read | Reads your payment links so FendPulse can flag ones that redirect customers to an unexpected site. |
user_email_read | Reads your own Dashboard email so FendPulse can suggest it as the first alert recipient. Nothing is sent until you save. |
FendPulse does not read early fraud warnings, API keys, team members and roles, or Dashboard logins. If we ever need a new permission, Stripe asks you to approve it before we can use it.
3. What we store
- Alert records ("findings"): alert type, severity, time, Stripe object IDs and the changed fields (for example, "webhook URL changed").
- Account data: your Stripe account ID, alert settings, and the alert email addresses you give us.
- Email preferences: whether an address unsubscribed from the weekly summary, so we stop sending it.
- Desktop push data: a browser push subscription (an endpoint and keys made by your browser) if you turn on desktop alerts.
- Trial records (hashed): to give each business one 7-day free trial, we keep the Stripe account ID that used a trial, plus a one-way SHA-256 hash of the card fingerprint and of the normalized billing email used at checkout. We can't turn a hash back into the card or email. These records are kept after uninstall, only to prevent repeat free trials.
- Sign-up and conversion counts (hashed): when an account installs, starts a trial, pays its first invoice or cancels, we record that step with a one-way SHA-256 hash of the Stripe account ID and the time. We use these records only to count how many accounts reach each step; they contain no names, emails or account IDs and are kept after uninstall so the counts stay correct.
- Survey answers: if you answer the one-question survey we email about 14 days after install, we store your answer (a number from 1 to 5) and the time, linked to your Stripe account ID. We delete it with your other data when you uninstall.
- Billing: handled by Stripe/Link as seller of record (see 6.1). We see your name, email, country, plan and subscription status, never your full card number.
- Not stored: card numbers, bank account numbers, your customers' personal details, or full copies of Stripe objects.
3A. Website analytics
fendpulse.com uses Cloudflare Web Analytics to count page views. It sets no cookies, doesn't use local storage, doesn't fingerprint visitors and doesn't record query strings. We see totals such as pages viewed, referring sites, countries and page speed, never who you are.
4. How we use it
Only to run FendPulse: detect risky changes, send alerts, show alert history, provide support, bill subscriptions, prevent trial abuse, count sign-ups, and keep the service secure. We do not use your data for advertising, and we do not train AI models on it.
5. We never sell your data
We do not sell, rent, resell or publish data obtained from your Stripe account, and we do not share it except as described in section 6.
6. Service providers (subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database | United States (us-east-1) |
| Resend | Sending alert emails | United States |
| Cloudflare | Hosting the FendPulse website, server and alert center; website analytics | Global network |
| Stripe | App platform (processor for data read through the app) | Per Stripe's privacy policy |
Your browser vendor's push service (for example Google, Mozilla, Apple or Microsoft) delivers desktop notifications. We may disclose data if the law requires it.
We give at least 30 days' notice before a new subprocessor starts processing your data, on fendpulse.com/subprocessors and in its RSS feed.
6.1 Stripe and Link as independent controllers for checkout
We sell FendPulse through Stripe Managed Payments. When you subscribe, Stripe (including Link) is the merchant of record and acts as an independent controller of the data you enter at checkout: name, billing address, email and payment details. Stripe uses it for payments, tax, fraud prevention, receipts and support under its own privacy policy (stripe.com/privacy; Link: link.com/privacy). We receive only what we need to manage your subscription: name, email, country, plan and subscription status. We never receive your full card number.
6A. Legal bases (EU/UK GDPR)
- Contract: to provide FendPulse and bill your subscription.
- Legitimate interests: to secure, support and improve the Service, to prevent repeat free trials, to count sign-ups, and to send service notices.
- Legitimate interests (survey): to send the one-question survey once and keep your answer, so we can improve FendPulse. Answering is optional and we ask only once. You can withdraw at any time: email [email protected] with the subject line "Delete my survey answer" and we delete it. Addresses that unsubscribed from the weekly summary don't get the survey.
- Legal obligation: tax, accounting and law-enforcement requests.
- Consent: desktop push notifications. You can withdraw consent any time in your browser or settings.
For data that FendPulse reads from your Stripe account, we act as your processor. A summary of our Data Processing Agreement (DPA) is at fendpulse.com/dpa; the full DPA is available on request at [email protected].
6B. International transfers
We are based in the United States, and our data is hosted in the United States (Supabase region us-east-1). When we transfer personal data from the EU, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA) or another lawful mechanism. Our providers use similar safeguards. Our current subprocessor list is at fendpulse.com/subprocessors.
7. How long we keep it
- Alert records: up to 12 months, then deleted.
- Raw Stripe event IDs: 30 days.
- Account, settings and survey data: while the app is installed.
- Hashed trial records and hashed sign-up counts: kept after uninstall, for the purposes in section 3.
- Billing records: as long as tax and accounting law requires.
8. Uninstall and deletion
When you uninstall FendPulse, Stripe notifies us and we stop reading your account immediately. We delete your alert records, settings, survey answers and push subscriptions within 30 days, except billing records we must keep by law and the hashed records in section 3. We email the account owner to confirm when deletion is complete. You can ask for earlier deletion or a copy of your data at [email protected].
9. Security
We use encryption in transit, access controls, least-privilege permissions and verified Stripe signatures. No system is perfectly secure, and we can't guarantee absolute security.
If we become aware of a security incident that affects your data, we email the account owner without undue delay and no later than 72 hours after we become aware of it, with what we know, what we are doing and what you can do.
10. Your rights
EU/UK (GDPR): you can access, correct, delete, restrict or port your data, object to processing, and withdraw consent. You can also complain to your local data protection authority.
US states: if you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you can ask to know and access the personal data we hold about you, correct it, delete it and get a copy of it. You can also opt out of the sale of personal data, targeted advertising and profiling; we do none of these. If we decline a request, you can appeal by replying with the subject line "Privacy appeal".
Non-discrimination: we won't deny you the Service, charge you a different price or give you a different level of service because you used a privacy right.
Authorized agents: someone you authorize can make a request for you. The agent emails [email protected] with the subject line "Privacy request (authorized agent)" and your signed permission or a power of attorney. We may ask you to confirm your identity and the permission with us directly before we act.
Canada, Australia, Brazil (LGPD) and elsewhere: you have the rights your local law provides.
To make a request, email [email protected] with the subject line "Privacy request". We may ask you to confirm you control the Stripe account or email address concerned. We respond to privacy requests within 30 days.
11. Children
FendPulse is a business tool and is not meant for anyone under 18.
12. Changes
We'll post changes here with a new effective date and email account owners about material changes at least 14 days before they take effect.
13. Contact
FendPulse LLC (crafted by RESILIENCE: Agentic Solutions LLC) · 400 N Tampa St, Tampa, FL 33602, USA · [email protected]. We reply within 24 hours.
FendPulse™ is a trademark of FendPulse LLC. Stripe is a trademark of Stripe, Inc.; FendPulse is not affiliated with or endorsed by Stripe.