This page is a draft for lawyer review and is not legal advice. Do not treat it as a final policy until counsel has reviewed it.

Privacy Policy (draft)

This draft describes how Diamond Ray Inc (“we”) handles personal information in BuckFix. It is intended to address the California Consumer Privacy Act (CCPA/CPRA) at a high level and is not a finished policy. Last updated: November 10, 2026. Contact: nathan@nathanpetty.com, 791 Jensen Court, Encinitas, CA 92024.

Roles

For your account, billing contact, and settings, we are a business / controller. For your customers’ data that we process to recover a failed payment (name, email, Stripe identifiers, failure reasons, and records of card-update link use), we act as a service provider / processor on your behalf. You are the controller of that end-customer data. See our draft Data Processing note.

Shared login with LiteFlow/FormFlow

BuckFix uses the same Supabase project and auth.users table as LiteFlow/FormFlow, another Diamond Ray Inc product. Signing up for BuckFix also creates an inactive FormFlow profile (free plan, not onboarded, with no forms). That profile is not used unless you later visit FormFlow. Closing your BuckFix account does not delete the shared login or the FormFlow profile; contact nathan@nathanpetty.com if you want those deleted too.

Information we collect

Account data: name, email, password hashes (stored by the shared Supabase Auth service), brand settings, physical address, fee rate.
Connected account data we read from Stripe: invoices, customers, subscriptions, payment methods (expiry month/year; last four may be read at send time for an expiry reminder and is not stored as a database column), and related events. We never collect or store the full card number or CVC.
Service data: recovery cases, card-update page visits and redirects to Stripe, payment-method change confirmations, emails we attempt to send, customer opt-outs, and webhook event identifiers.
Essential technical data: session cookies and basic server logs needed to operate and secure the service.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

How we use it

To provide the service, authenticate you, send payment notices and (where not opted out) card-expiry reminders you authorize, measure attributed recoveries and fees, secure the product, and comply with law. We do not use end-customer data to market our own products to those customers, and we do not use Stripe Connected Account Data except to provide BuckFix.

Subprocessors

We use the subprocessors listed on the dated Subprocessors page (currently Supabase, Stripe, Resend when sending is enabled, and Vercel if the product is hosted there).

CCPA / CPRA rights, export, and deletion

California residents may request to know, access, correct, or delete personal information, and to opt out of sale or sharing (we do not sell or share). Merchants can download a copy of their BuckFix records and close the account from Settings. Closing the account deauthorizes Stripe, deletes operational and end-customer personal data, and may retain anonymized fee and invoice identifiers needed to complete outstanding billing or meet legal duties. Until platform invoicing is live, no fee invoice is collected after closure. Because we process end-customer data as your service provider, those customers should generally contact you first; we will assist you in responding. You may also email nathan@nathanpetty.com.

Children

BuckFix is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). If we learn that we have, we will delete it.

Retention, security, and contact

We keep recovery records as long as needed to bill accurately, resolve disputes, and meet legal duties, and as described above after account closure. We use TLS in transit, restrict secrets to the server, and enforce row-level security in the database. Questions: Diamond Ray Inc, 791 Jensen Court, Encinitas, CA 92024, nathan@nathanpetty.com.