This page is a draft for lawyer review and is not legal advice. Do not treat it as a final policy until counsel has reviewed it.

Data Processing note (draft)

This is a draft note describing how Diamond Ray Inc processes personal data of your customers when you use BuckFix. It is not a signed Data Processing Agreement. Counsel should turn this into a DPA before any merchant processes live customer data. Last updated: November 10, 2026.

Parties and roles

You (the merchant) are the controller of your customers’ personal data. Diamond Ray Inc, 791 Jensen Court, Encinitas, CA 92024, is the processor / service provider.

Subject matter and data

Payment-recovery operations: names, email addresses, Stripe identifiers, card expiry month/year (last four digits may be read from Stripe at send time and are not stored as a column), payment failure codes, records of notices we send, opt-outs, and records of card-update page visits, redirects to Stripe, and confirmed payment-method changes. We do not receive full card numbers or CVC. We do not intend to process data about children under 13.

Our obligations (intended)

Use the data only for the service.
Use the subprocessors listed on the Subprocessors page and remain responsible for them.
Implement reasonable security measures, including RLS in the database.
Assist you with data-subject requests and, where legally required, breach notices. A specific breach-notice period will be set in a signed DPA.
When you close your BuckFix account from Settings, deauthorize Stripe, delete operational records and end-customer personal data, and anonymize any recovery rows retained for fee or legal-hold purposes. We do not delete the shared LiteFlow/FormFlow login or FormFlow profile as part of that closure.

See also the Privacy Policy and Acceptable Use Policy. To request a signed DPA, email nathan@nathanpetty.com.