Privacy policy

1. Who this policy is for

Airdun is a business-to-business service. Our direct customers are the businesses that connect their Stripe account to Airdun (the “Merchant”). In doing so, Airdun processes information about the Merchant's own end-customers (the “Customers”) solely to notify them of failed payments and help restore their payment method, on the Merchant's behalf.

• For Merchants — Airdun acts as a data controller for account, billing and marketing data, and as a data processor for the Customer data it handles on the Merchant's instructions.
• For Customers — the Merchant remains the data controller. Airdun processes their data only as a processor, under the Merchant's authorization, as set out in our Data Processing Agreement.

2. Data we process

When a Merchant connects Stripe through the Airdun Stripe App, granting the access scopes it explicitly approves, Airdun accesses only the data needed to detect and act on failed payments:

• Payment and subscription data — invoices, charges, payment attempts, failure reasons and codes, amounts, currency, subscription and plan details.
• Customer data — name, email address, phone number, country, language, billing history and related metadata made available through Stripe.
• Payment method metadata — the last four digits, card brand, expiry date and issuer decline code.
• Recovery activity — messages sent, channels used, delivery status, replies received, and outcomes generated by Airdun.
• Decision records — a record of each automated decision, including the information it was based on, kept so that decisions can be audited and reviewed.

We do not collect or store full card numbers, CVCs, or complete bank details. Card data remains within Stripe's secure environment.

As for visitors of our website: airdun.com does not use advertising cookies or third-party trackers.

3. How we use data

Airdun uses Merchant and Customer data for a single purpose: detecting failed payments and notifying the affected Customer on the Merchant's behalf. Specifically, to:

• open and enrich a case when a payment fails;
• decide whether, when and through which channel to notify the Customer;
• generate and send a personalized notification (email, SMS, WhatsApp);
• adapt the message to the Customer's situation, language and time zone;
• stop the sequence automatically once a payment succeeds;
• provide the Merchant with performance reporting on their own account.

We do not use this data for advertising, we do not sell it, and we do not use one Merchant's data to benefit another.

Automated processing. Decisions about whether and how to contact a Customer, and the content of the messages sent, are generated automatically using artificial intelligence, within the parameters configured by the Merchant. These decisions concern only the manner of notification: they do not determine access to any product, service or credit, do not assess creditworthiness, and do not produce legal effects concerning the Customer.

Legal bases. Where the GDPR applies, we process this data on the basis of the performance of our contract with the Merchant and, for Customer data, the Merchant's documented instructions as data controller. Where relevant, we also rely on our legitimate interest in operating and securing the Service.

4. Data isolation and confidentiality

Each Merchant's data is logically isolated and accessible only to that Merchant. A Customer's data is never exposed to other Merchants or other Customers. Internal access is restricted to authorized personnel on a strict need-to-know basis, protected by access controls and authentication. Any aggregated insights used to improve the Service are derived without exposing identifiable Merchant or Customer data across accounts.

5. Service providers

Stripe is not one of our providers — it is the Merchant's own. The Merchant appoints Stripe directly, and Airdun accesses payment and customer records from the Merchant's Stripe account only with the Merchant's authorization, through the access scopes it approves.

Beyond that, we share data only with the providers strictly necessary to operate the Service, under contractual confidentiality and data-protection obligations. We do not sell or rent personal data to anyone.

• Google Cloud — application hosting, in France (Paris region).
• Firebase Hosting — website hosting, operated by Google Ireland Limited.
• Neon — database, in the United Kingdom (London).
• Anthropic — generation of notification decisions and content, in the United States.
• Langfuse — monitoring of automated decisions, in the European Union.
• Postmark (ActiveCampaign) — email delivery of notifications, in the United States.
• Twilio — SMS delivery — restricted to the European Economic Area — and WhatsApp delivery, in the United States.
• PostHog — product analytics within the Airdun dashboard, in the European Union.

Anthropic does not use data sent through the Service to train its models. Anthropic deletes inputs and outputs from its systems within 30 days.

6. Our own communications with Merchants

Separately from the Service, we process the contact details of business representatives — prospects, signups and Merchants — to send them information about Airdun. For this processing, Airdun is the data controller.

• Provider — Loops (email).
• Legal basis — our legitimate interest in promoting a business service to professionals, or consent where required.
• Your choice — every message includes an unsubscribe link, and you may object at any time by writing to legal@airdun.com.

This data is entirely separate from Merchant Customer data, which is never used for marketing.

7. Data security

We protect data using industry-standard measures: encryption in transit and at rest, with an additional layer of application-level encryption for sensitive credentials.

Authentication is delegated to a dedicated identity provider — we never store passwords. Each workspace's data is accessible only to its members: membership is verified server-side on every request, and role-based permissions determine what actions are allowed.

8. Data retention and deletion

We retain data only as long as needed to provide the Service and to meet our legal obligations.

• Merchant account and billing data — for the duration of the account, and thereafter for the period required by accounting and tax law.
• Customer and payment data — for as long as the Merchant's Stripe account remains connected to the Service.
• Decision records — for as long as necessary to audit the reliability of the Service and to investigate incidents.
• Provider retention — Anthropic deletes inputs and outputs within 30 days.

Deletion requests. A Merchant may request the deletion or return of its data at any time, including after disconnecting the Service. A Customer may request the deletion of their data through the Merchant they interact with. We act on any such request within one month, in accordance with Article 12(3) of the GDPR, except where retention is required by law.

9. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability.

• Customers — should contact the Merchant they interact with — the Merchant is the data controller. Airdun will support any such request.
• Merchants and prospects — may contact us directly.

To exercise your rights or ask a question: legal@airdun.com.

You also have the right to lodge a complaint with your data protection authority — in France, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

10. International transfers

Our application is hosted in the European Union (Google Cloud, Paris region). Our database is hosted in the United Kingdom, which benefits from an adequacy decision of the European Commission. Message generation (Anthropic), email delivery (Postmark) and SMS and WhatsApp delivery (Twilio) are performed by providers established in the United States, for which we rely on the European Commission's Standard Contractual Clauses.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated “Last updated” date, and Merchants will be notified by email.

12. Contact

AIRDUN — 63 route de Laoureaux, 31590 Lavalette, France. legal@airdun.com — general enquiries: hello@airdun.com.