Privacy Policy

CardHawk (“CardHawk”, “we”, “us”) is a SaaS tool that notifies your customers before their payment card on file expires. This page explains what data we collect, how we use it, and the choices you have. If you have questions, email privacy@cardhawk.app.

When you connect your Stripe account, we receive:

• Customer name and email address
• Subscription metadata (plan, MRR, status)
• The last four digits and expiration date of the payment card on file
• Anonymous usage logs of our own dashboard (page views, button clicks)

We do not receive or store:

• Full card numbers, CVCs, or any data covered under PCI DSS
• Bank account details
• The ability to create charges, refunds, or transfers

We use the data above for one purpose: to send your customers a small number of expiry-warning emails (maximum three per card, signed with yourproduct's name) and to show you, in your CardHawk dashboard, which cards updated and which didn't.

We never sell your data. We never share it with advertisers. We never train machine-learning models on your customer list.

We rely on a small number of vendors to operate the service:

• Stripe — payment + subscription data (read-only)
• Resend — email delivery
• Vercel — application hosting
• Supabase — encrypted database for our own metadata

We retain customer data for as long as your CardHawk account is active. When you cancel, we delete all customer data within 30 days. You can request immediate deletion at any time by emailing privacy@cardhawk.app.

You can revoke our Stripe access from your Stripe dashboard at any time — that severs the entire data flow on Stripe's side. Within CardHawk, you can export and delete your data from Settings → Privacy.

We'll post any material changes to this page and update the “Last updated” date above. For significant changes, we'll email account owners 30 days in advance.

Privacy questions: privacy@cardhawk.app
Mail: CardHawk Inc., 548 Market St #54108, San Francisco, CA 94104