Privacy Policy

Masafumi Suzuki (“RevenueUI,” “we,” “us,” or “our”) handles information relating to users of RevenueUI and visitors to measured websites as described in this Privacy Policy.

1. Information we collect

Account and subscription information

• Name, email address, profile image, and other information supplied through Google sign-in
• Selected plan, trial expiry, subscription status, billing interval, and Stripe customer identifier
• Support requests and related correspondence

Stripe processes payment-card information. RevenueUI does not store full payment-card numbers in its application database.

Website and analytics information

• Registered domain, time zone, display currency, and public key
• Event ID, visitor or session ID, first-visit time, session number, and event time
• Page path without the query string, external referrer host, and UTM source, medium, and campaign
• Browser, operating system, device type, country code, and consent state

RevenueUI does not include a visitor’s full IP address in its event payload or persistent analytics records. Network and infrastructure providers may temporarily process connection metadata to transmit requests, prevent abuse, and operate their systems.

Connected Stripe information

• Stripe account identifier, currency, connection status, and webhook status
• Payment, refund, invoice, Payment Intent, Checkout Session, customer, and subscription identifiers
• Amounts, currencies, fees, net amounts, statuses, and transaction times
• RevenueUI visitor and session identifiers placed in Stripe metadata
• The Stripe restricted key and webhook signing secret supplied by the user

Restricted keys and webhook signing secrets are stored in encrypted form and are not returned in full through normal screens or API responses.

Technical and security information

We may collect login-session data, operational logs, error logs, request times, security events, and other information required to operate and secure the service.

2. How we use information

We use collected information to:

1. create accounts, authenticate users, and verify identity;
2. provide website analytics, revenue analytics, and payment attribution to visitors or sessions;
3. connect to Stripe, import supported historical payments, and process webhooks;
4. manage subscriptions, billing, plan limits, and usage;
5. provide, maintain, troubleshoot, secure, and protect the service from misuse;
6. respond to support requests and send important service notices;
7. improve quality, understand usage trends, and plan features using information that does not directly identify an individual; and
8. comply with law, enforce our Terms, and protect legal rights.

When we analyze browsing and payment history, we do so to provide SaaS revenue and conversion analytics to the relevant RevenueUI customer.

3. Cookies, consent-required measurement, and privacy signals

1. In first-party mode, RevenueUI stores a visitor ID, session ID, first-visit time, and session number in first-party cookies on the measured website.
2. In consent-required mode, RevenueUI does not create visitor or session cookies before consent or when consent has not been granted. It uses a temporary, tab-scoped session identifier instead.
3. If consent changes to granted in consent-required mode, RevenueUI may create first-party identifiers. If consent is denied or withdrawn, those identifiers are removed.
4. When the browser enables Global Privacy Control or Do Not Track, the RevenueUI tracker stops event delivery and identifier creation.
5. The operator of each measured website is responsible for notices and consent management required by the laws that apply to that website.

4. Disclosures and service providers

We do not disclose personal data to a third party except where:

• the individual has consented;
• disclosure is required by law;
• disclosure is necessary to protect life, physical safety, or property and obtaining consent is impracticable;
• the information is transferred as part of a merger, acquisition, or other business succession; or
• a processor handles information on our behalf as necessary for the purposes described in this Policy.

RevenueUI primarily uses the following providers:

These providers may process information outside Japan. We manage processors through contracts, access controls, and other reasonable measures. A provider’s independent processing is governed by that provider’s own privacy policy.

5. Security measures

We use measures appropriate to the nature and risk of the information, including:

• account authentication and tenant-level access controls;
• encryption of Stripe restricted keys and webhook signing secrets;
• verification of Stripe webhook signatures and signing of internal event delivery;
• input validation, rate limiting, and operational monitoring;
• least-privilege access;
• retention and deletion procedures; and
• selection and contractual oversight of service providers.

We will provide additional information about our security measures upon a verified request to the extent doing so would not undermine security.

6. Retention and deletion

1. Standard tracking-data retention is 1 year for Starter, 3 years for Growth, and 5 years for Pro.
2. After a trial or subscription ends, RevenueUI may delete websites and related analytics data following a 90-day recovery period.
3. If a user deletes an account, RevenueUI deletes the account, websites, provider connections, subscriptions, and related analytics data and attempts to remove provider webhooks created in Stripe.
4. We may retain limited information for as long as reasonably necessary to comply with law, resolve disputes, prevent fraud, rotate backups, or protect legal rights.

7. Individual rights

Subject to applicable law, an individual may request notice of purpose, access, correction, supplementation, deletion, restriction, erasure, or cessation of third-party disclosure concerning personal data we hold about that individual.

We may request information needed to verify identity. If we cannot fulfill a request under applicable law, we will explain the reason where required.

For data collected on a RevenueUI customer’s website, that website operator may be the primary contact responsible for the data. We will reasonably assist the operator with an appropriate request.

8. Children

RevenueUI is intended for people operating SaaS products for business or professional purposes and is not directed primarily to children. A minor must obtain any consent required from a parent or guardian before entering into a subscription.

9. Changes to this Policy

We may update this Policy to reflect legal or service changes. If a change is material, we will provide notice through the service, the registered email address, or another reasonable method.

10. Contact

• Operator: Masafumi Suzuki
• Address: Disclosed without delay by email upon request.
• Email: palty.support@gmail.com

Please use this contact for privacy questions or requests concerning individual rights.