Privacy Policy
Last updated 14 November 2026
We collect as little as we can, keep it safe, and never sell it. Here is exactly what that means.
Who is responsible
Refund Score, run from the United Kingdom, is responsible for your data. Questions or requests: hello@refundscore.io.
What we collect
Your email address. The website you claim. An encrypted copy of the read only Stripe key you give us. The badge style you choose. Basic records of your subscription from Dodo Payments.
What we read from Stripe
Your lists of charges, refunds and disputes. From those we keep only running totals and the ID of each refunded or disputed charge, so nothing is counted twice. We never store customer names, emails, card details or amounts.
What is public
Only once you subscribe and we have checked you own your site: your website address, score, refund rate, sales band (for example "1k+ sales"), the month of your first sale and when we last checked. Never your exact number of sales and never anything about your customers.
Why we use it
To run the service you asked for (contract), to keep it secure and stop abuse (legitimate interests), and to meet legal and tax duties (legal obligation).
Who helps us
Cloudflare hosts the site and database and forwards our email. Resend sends login emails. Dodo Payments handles billing as merchant of record. Stripe is where your sales data comes from. Each only gets what it needs to do its job.
Cookies
One cookie, to keep you logged in. No advertising or tracking cookies, and no third party analytics.
How long we keep it
While your account is open. If you disconnect Stripe we delete your counts straight away. If you ask us to delete your account we remove your data within 30 days, except billing records we must keep for tax.
Your rights
Under UK and EU data protection law you can ask to see, correct, export or delete your data, or object to how we use it. Email hello@refundscore.io and we will reply within a month. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Security
Stripe keys are encrypted before they are stored. Login links expire after 20 minutes and sessions are stored only as hashes.