Privacy Policy

Last updated: October 14, 2026.

Who this covers

This policy explains what Gasket collects about (a) merchants who sign up for Gasket and (b) the merchants' customers whose payment data Gasket reads from Stripe and whom Gasket may email on the merchant's behalf. For merchants' customers, the merchant is the controller and Gasket acts as their processor.

What we collect from merchants

• Account data: email address, business name, sign-in records (via Supabase Auth; Google sign-in shares your name and email).
• Settings you enter: sender name, reply-to address, sending domain, brand color and logo URL.
• Billing data: plan, subscription status and HandyPay ids. HandyPay processes the payment; Gasket never receives card details.
• Audit records of actions taken in your account.

What we read from a connected Stripe account

Using the read-only key you provide, Gasket reads invoices, the related customer's name and email, subscription and charge identifiers, payment status, decline codes and timestamps. Gasket stores only failed invoices and the fields needed to recover them and report results. It does not store card numbers or bank details, which Gasket never receives.

How we use it

• To show you lost and recovered revenue.
• If you enable recovery, to email your customers about a failed payment, from your domain and in your name, with a link to pay on Stripe.
• To operate, secure and bill for the service. We don't sell data or use it for advertising.

Customers' choices

Every recovery email contains a one-click opt-out. Opted-out addresses are not emailed again for that merchant.

Retention and deletion

• Invoice and email records are kept while your Stripe account is connected.
• Raw event records are trimmed to identifiers and deleted after 30 days.
• Disconnecting Stripe deletes all data read from it. Deleting your account deletes your account data; a minimal audit record that the deletion happened is kept without customer data.

Subprocessors

• Supabase: database and authentication.
• Railway: application hosting.
• Composio: holds the Stripe connection credential and relays read requests to Stripe.
• HandyPay: processes payments for Gasket subscriptions.
• Email delivery provider (Resend), once sending is enabled.

Security

See the Security page for how access, isolation and sending are controlled.

Contact

Questions or requests (access, correction, deletion): use the contact form.