Data policy

This is a draft for the private beta. It describes how Joinfold is designed to work.

What Joinfold reads from Stripe

When you connect Stripe, Joinfold asks for read-only access. It reads customers, subscriptions, plans and invoices so it can show who joined, who left and the revenue involved. It cannot create charges, refunds or changes in your Stripe account.

What we store

We store the customer and subscription records we read, the survey questions you approve, the answers people give, and the insights we derive. Access tokens are encrypted. Everything is kept separately for each workspace.

Who can see it

Only the members of your workspace. Joinfold staff access customer data only to fix a problem you ask us about, and each such access is recorded.

AI processing

Joinfold uses AI providers to classify survey answers and write summaries. Survey text is masked for emails, phone numbers and card-like numbers before it is sent, and providers are not allowed to train on it. Subscription state, revenue figures and consent are calculated by ordinary code, never by AI.

Export, deletion and how long we keep things

In Settings, under Your data, an owner or admin can download everything the workspace holds (JSON, and the answers as a spreadsheet), delete one person's answers and name and address, disconnect Stripe and delete everything read from it, or delete the whole workspace. Each is recorded in the audit log without the personal data it removed. Survey answers, and the addresses they were sent to, are deleted automatically after the retention period you choose (3 months to 5 years). Customers can stop survey emails from the link in every email, and no survey is required for anything.

Our database provider and email provider process this data for us, as do the AI providers named above. Access tokens for connected accounts are not stored for Stripe: we read it with our own key, limited to the account you connect.

See also the terms and the privacy policy.