Privacy Policy

This policy explains how AVOLIA S.R.L. (“we”, “us”) handles personal data in connection with Churnahead: on churnahead.com, in the dashboard at app.churnahead.com, and in the emails and Slack messages it sends.

Two roles

• We are the controller for data about the people who use Churnahead and visit our website: your email address, your sign-ins, your billing with us, and what you write to us.
• We are a processor for the data we read from your Stripe account about your customers. You decide why it’s processed. We process it only to run the Service for you, under the Data Processing Agreement. If you are one of our customers’ customers, contact the business you buy from. We’ll help them answer you.

What we collect

When you use Churnahead

• Your email address, and the name of the workspace we create from its domain.
• Sign-in records: one-time links and 30-day sessions, of which we store only hashes, and the date and version of the terms you accepted.
• Your settings: the address the digest goes to, your Slack webhook URL, the rules you switched off, and example emails you paste in to make drafts sound like you.
• What you record about accounts: contacted, saved or snoozed, notes, and win-back asks.
• Billing with us: your plan and your Stripe customer and subscription IDs. Card details are entered on Stripe’s pages, and we never see them.

When you connect Stripe (as processor; see the DPA)

• Your customers’ names and email addresses, their subscriptions, invoices, charges, refunds and disputes, the brand and expiry month and year of their cards, and the reason and feedback they gave when they cancelled. Never full card numbers or bank details.
• The scores, history and reports we compute from that data.

When you write to us

• Your message and contact details, at hello@churnahead.com.

When you visit our website or use the Service

• Technical data that every web request carries, such as IP address, browser, pages requested and time. It goes into our servers’ and providers’ logs for security and troubleshooting.
• On churnahead.com, our own visitor statistics: the page you open, the site that linked to it and any campaign tag in the link, your country and city as Cloudflare derives them from your IP address, your browser’s language, the type of device, browser and operating system, how long the page was in view, how far you scrolled, and which links you clicked. We don’t store your IP address. Instead we keep a code made from it and your browser details with a secret key, which changes every day, so we can count daily visitors but can’t recognise you on another day or across sites. There are no cookies, no advertising and no third-party analytics or tracking scripts. See the Cookie Policy.

Why we use it, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating your account, signing you in, and providing the Service	Performing our contract with you
Sending sign-in links, digests and alerts you asked for	Performing our contract with you
Billing, invoices and accounting records	Contract, and our legal obligations under tax and accounting law
Keeping the Service secure, preventing abuse, fixing errors	Our legitimate interest in a secure, working service
Counting visits to our website and seeing which pages and links help people find the Service	Our legitimate interest in understanding how our website is used
Answering your messages and support requests	Contract, or our legitimate interest in replying
Telling you about material changes to the Service or these documents	Contract, and our legal obligations
Recording that you accepted the terms	Our legitimate interest in proving the agreement

We don’t send marketing email without your consent, don’t sell personal data, and don’t use it for automated decisions about you that have legal or similarly significant effects. The risk scores are about your customers’ accounts. They exist to help you, and the decisions are yours.

Who we share it with

We share personal data only with the providers that help run the Service, listed with what each does and where on the Subprocessors page. We also share it when the law requires, for example with a court or authority, or as part of a sale or reorganisation of our business, under the same protections.

Where it’s stored, and transfers outside the EU

The Service’s servers and database run with Hetzner in Germany. Some providers, such as Cloudflare, Resend, Stripe and Anthropic, are based in, or may process data in, the United States or other countries outside the European Economic Area. Where that happens, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, together with the provider’s security measures.

How long we keep it

• Account data and settings: while your account is open, and deleted within 30 days after it closes.
• Customer Data from Stripe: until you delete it on the Connect page or close your account, and then within 30 days. Daily score history is kept for 400 days.
• Sign-in links: expire after 15 minutes. Sessions: after 30 days.
• Billing and accounting records: as long as Romanian tax and accounting law requires.
• Emails with us: as long as needed to handle the matter, and no longer than 3 years after it ends.
• Logs: kept for a short time for security and troubleshooting, then deleted.
• Website visitor statistics: 400 days.

Security

Connections are encrypted with TLS. Stripe keys are encrypted at rest. Only hashes of sign-in links and sessions are stored. Access to Stripe is read-only. Every workspace’s data is kept apart from every other’s. Access to production systems is limited to the people who run the Service. The DPA lists these measures in more detail.

Your rights

Under the GDPR, you can ask us for access to your personal data, a copy of it in a portable format, correction, deletion, or restriction of its use. You can also object to processing based on our legitimate interests, and withdraw any consent you gave. Write to hello@churnahead.com. We’ll answer within one month.

You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live or work.

Children

Churnahead is a business tool and isn’t meant for anyone under 16.

Changes

We’ll post any change here with a new date. For a material change, we’ll tell users by email or in the dashboard before it applies.

Contact

AVOLIA S.R.L., Str. Zizin nr. 10A, cam. 1, et. 7, ap. 25, Sector 3, Bucharest, Romania. CUI 55649251. Email hello@churnahead.com. We haven’t appointed a data protection officer. Send privacy questions to the same address.