Privacy Policy

Last updated 7 August 2026

This policy explains what ChargebackDossier collects, why, and what happens to it. Plain language, no hidden clauses.

What we collect

• Account data. Email address, password (stored only as a bcrypt hash), and optionally your display name and company name.
• Case data. Everything you enter about a dispute: amounts, merchant details, the last four digits of a card, reason codes, dates, deadlines, and your notes.
• Evidence files. The documents and images you upload against a case.
• Activity records. A log of actions taken on your cases, so you have an audit trail.
• Technical data. Standard server logs, including IP address, needed to run and secure the Service.

Why we hold it

To provide the Service: storing your cases, generating documents, and showing you your own history. We do not sell your data, and we do not use your case content for advertising.

Language model processing

When you request a case review, an evidence review, or a drafted letter, the case details and the file names and categories of your evidence are sent to a language model to produce the text. The contents of uploaded files are not read by the model, only their names, categories, and your descriptions.

The provider currently in use is DeepSeek. Case text is transmitted to their API and processed under their terms. We do not send the contents of your uploaded files, only their names, categories, and any description you add. We will update this section whenever the arrangement changes.

Usage analytics

We record a small number of first-party events to understand how people find the Service and where they get stuck: a page visit, an account being created, a case being created, evidence being uploaded, a review being run, a document being exported, and a return visit. Each event stores the step reached, the referring site or campaign tag, and an identifier for your session or account.

This is first-party only. There is no third-party analytics script, no advertising identifier, and nothing that tracks you across other websites. We do not record the contents of your cases in these events.

Sharing

We share data only with the infrastructure providers needed to run the Service, such as our hosting provider and, if you subscribe to a paid plan, our payment processor. Payment card details for subscriptions are handled by the payment processor and never reach our servers. We may disclose data where the law requires it.

Retention and deletion

Case data is kept while your account is open. Deleting a case removes its record and its evidence files. Closing your account, from Settings, removes your account, the cases attached to it, and the evidence files you uploaded, and cancels any active subscription first. You can download a copy of everything held about your account from Settings at any time. Backups are retained on a rolling basis and are overwritten in the normal cycle.

Security

• TLS 1.3 in transit, with HSTS enforced.
• Passwords hashed with bcrypt and per-user salts.
• CSRF tokens on every form submission.
• Rate limiting and account lockout on authentication.
• A strict Content Security Policy and clickjacking protection.
• Uploads validated server side by extension and MIME type, with a size cap.

No system is perfectly secure. If we become aware of a breach affecting your data we will notify you without undue delay.

Your rights

You can access and correct your data from within the application at any time, export your cases to CSV, and delete cases or your whole account. If you are in a jurisdiction granting additional rights, such as the UK or EU, you may also request a copy of your data or object to processing by contacting us.

Cookies

We set two cookies, both first-party. One is a signed session cookie that keeps you logged in. The other records which site or campaign you arrived from, so we can tell which channels bring people to the Service; it holds a random identifier and the referring source, expires after 30 days, and contains nothing personal. There are no advertising or third-party tracking cookies.

Changes

Material changes to this policy will be notified by email or in the application before taking effect.

Contact

Privacy questions, including a request for a copy of your data or an objection to processing, can be sent to support@chargebackdossier.com.