Privacy policy: payments and billing

Last updated 7 October 2026

1. Payment Information We Collect

What We Store

• Subscription Details: Plan type, billing period, status, renewal date
• Transaction Metadata: Transaction ID, amount, date, status
• Partial Card Info: Last 4 digits of card, card type (for display only)
• Billing Email: Email used for receipts and invoices

What We DON'T Store

• Full credit card numbers
• CVV/CVC codes
• Card expiration dates (full)
• Bank account details
• PayPal credentials

2. How Payment Data is Protected

Third-Party Payment Processing

All payment information is collected and processed by LemonSqueezy, a PCI DSS Level 1 certified payment processor. When you enter payment details:

• Your payment information goes directly to LemonSqueezy (not our servers)
• Data is encrypted in transit using TLS 1.2+
• LemonSqueezy stores your payment methods securely
• We receive only a secure token to process future charges

Our Security Measures

• Encryption: All data encrypted at rest and in transit
• Access Control: Strict role-based access to billing data
• Audit Logging: All payment actions are logged
• Regular Audits: Security audits and penetration testing

3. How We Use Your Billing Data

We use your billing information to:

• Process subscription payments
• Send receipts and invoices
• Manage subscription upgrades/downgrades
• Handle refunds and disputes
• Prevent fraud and abuse
• Comply with tax and accounting requirements
• Analyze subscription trends (aggregated data only)

What We DON'T Do

• Sell your payment information to third parties
• Use payment data for marketing without consent
• Share card details with anyone (we don't have them)

4. Data Sharing & Third Parties

Payment Processor: LemonSqueezy

LemonSqueezy processes all payments and stores your payment methods. They:

• Are PCI DSS Level 1 compliant
• Have their own privacy policy (see LemonSqueezy.com)
• Use your data only for payment processing
• Provide secure customer portal for managing payments

Other Service Providers

We may share limited billing data (transaction amounts, dates) with:

• Email Service: To send receipts and billing notifications
• Analytics: The plan and billing period of a checkout or a purchase, when usage analytics is on for you (section 10). Never card or payment details.
• Tax Services: For tax compliance (as required by law)

5. Your Rights & Controls

Access Your Data

• View subscription details in your account settings
• Access invoices and payment history
• Request a complete data export (includes billing data)

Update Payment Method

• Update card/payment info through the customer portal
• Changes take effect immediately
• Old payment methods are securely removed by LemonSqueezy

Delete Your Data

• Cancel subscription to stop future charges
• Request account deletion (payment data deleted after 7 years)
• Note: We must retain some billing data for tax/legal compliance

6. Data Retention

Active Subscriptions

• Billing data retained for the life of your subscription
• Transaction history maintained for your records

After Cancellation

• Transaction Records: 7 years (tax compliance)
• Payment Methods: Immediately removed from LemonSqueezy

7. Compliance

PCI DSS Compliance

While we don't directly handle payment cards, we follow PCI DSS guidelines:

• Use certified payment processor (LemonSqueezy)
• Never store sensitive card data
• Secure transmission of all payment data
• Regular security assessments

GDPR Compliance (EU Users)

• Right to access your payment data
• Right to data portability (export)
• Right to deletion (with legal exceptions)
• Right to object to processing

CCPA Compliance (California Users)

• Right to know what data we collect
• Right to delete personal information
• Right to opt-out of data sales (we don't sell data)

8. Payment Disputes & Fraud

Fraud Prevention

To protect against fraud, we:

• Monitor for suspicious payment activity
• Verify high-value transactions
• May temporarily hold new accounts
• Share fraud data with LemonSqueezy

Dispute Resolution

For billing disputes:

• Contact support first (faster resolution)
• Provide transaction ID and details
• We'll investigate within 3 business days
• Chargebacks should be last resort (may affect account standing)

9. Support Chat

“Chat with us” and the Chat button open a chat run by Crisp (Crisp IM SAS, France), whose servers are in the European Union.

• The chat loads only when you open it. Until then, no Crisp script, request or cookie touches the app. Once you have opened it, it loads on your later visits too, closed, so we can show you when we’ve replied.
• We send Crisp your email, name, account ID and plan, so we know who we’re talking to. If you open the chat before signing in, none of these is sent.
• Crisp receives your messages and any files you send, with your IP address, browser, device and the page you’re on.
• Once you open it, Crisp keeps its own cookies (crisp-client/*) for 6 months, so your conversation continues.
• We use the chat only to help you. We never change your account or billing because of a chat message alone: we confirm by email first.
• To have your chat history deleted, email contact@rext.ai.

10. Usage Analytics

We measure how the app is used with PostHog (PostHog Inc.), on its cloud in the European Union, so we can see which pages and steps work and which don’t.

• In the EEA, the UK and Switzerland we ask you first, once, after you sign in. Until you answer, nothing is sent.
• Everywhere else it is on, and you can turn it off.
• When it is on, PostHog receives the pages you open and what you do on them (for example that a keyword was analysed, a title chosen, an article published or a plan bought, but not the keyword, the title or the article), together with your account ID and role, not your email or your name. It keeps an identifier in a cookie for rext.ai and in your browser’s storage. Our website uses the same one, so a visit to rext.ai and your use of the app count as one person.
• When it is on, it includes recordings of your screen on the app’s working pages, so we can see where people get stuck. A recording hides everything you type and all text on the page, except the app’s own words on its buttons, menus, labels and table headers; pictures are left out. Your workspace’s content, your keywords and your articles are not readable in it. The sign-in, password, invitation and checkout pages are never recorded.
• When it is on, it also receives where on a page you click and move the pointer, as positions on the page and nothing of what was there, so we can see which parts of a page are used.
• When it is on, it also receives that the app met an error it did not handle: which kind of error, and where in our own code it happened. The error’s own message is never sent, because it could hold something of yours.
• When it is on, it also receives how fast each page loaded and answered you, as numbers.
• When it is off, PostHog receives only anonymous counts of the kinds of page opened: no account, workspace, article or keyword, and nothing is kept in your browser.
• The links in our emails carry a key in their address. That key, and an email address in a sign-in page’s address, are removed before anything is sent.
• You can change your choice at any time in Settings, Data, under “Usage analytics”. It is kept in the browser you are using, for six months.

11. Children's Privacy

We do not knowingly collect payment information from anyone under 16. If you believe a child has provided payment details, contact us immediately at contact@rext.ai.

12. Changes to This Policy

We may update this privacy policy to reflect:

• Changes in payment processing
• New legal requirements
• Service improvements

Material changes will be announced via email 14 days before taking effect.

13. Contact & Questions

For privacy or billing questions:

• Email: contact@rext.ai