Privacy Policy

The Service is used by businesses ("Customers") to follow up on invoices owed to them by their own customers ("Debtors"). This creates two distinct roles:

• For account data — information about you and your team when you register and use the Service — we act as the data controller.
• For Debtor data— names, contact details, invoice amounts, and communication history that Customers upload, import, or sync — the Customer is the data controller and Chiron Pay processes that data only on the Customer's instructions to operate the Service.

If you are a Debtor who received a payment reminder through our platform, the business you owe is responsible for the decision to contact you. You can direct questions about the debt or your data to that business, or contact us at support@chironpay.com and we will assist and forward your request to them.

• Account data: name, business email, password (hashed by our authentication provider), workspace and organization details, and roles.
• Debtor and invoice data (processed for Customers): Debtor names, email addresses, phone numbers, invoice numbers, amounts, due dates, payment status, and records of reminders sent and replies received.
• Payment data: subscription and payout details handled by Stripe. We store payment references and statuses; we never store full card numbers.
• Integration data: if you connect an accounting system such as Xero, the contacts and invoices needed to sync your receivables. Integration credentials are encrypted at rest.
• Usage data: log, device, and page analytics data collected to operate, secure, and improve the Service.

• Provide the Service: deliver reminders, payment links, and dashboards.
• Generate AI-assisted communications and recommendations on the Customer's instructions and within the limits the Customer configures.
• Process subscription billing and Debtor payments through payment providers.
• Track message delivery, bounces, opens, and replies so collection activity is auditable.
• Secure the Service, prevent abuse, and comply with legal obligations.
• Communicate with Customers about the Service, including service and billing notices.

AI processing. We use third-party AI providers to draft communications and support agent decisions. We do not permit our AI providers to use your data to train their models.

We do not sell personal data.

We share data only with service providers (subprocessors) that help us operate the Service, under contracts that limit their use of the data to providing their service to us:

• Stripe: Payment processing, subscriptions, and payouts
• Clerk: Authentication and workspace management
• Resend: Transactional and reminder email delivery
• Twilio: SMS and WhatsApp message delivery
• Anthropic: AI drafting and decision support
• Neon: Managed database hosting
• Upstash / Redis hosting: Job queue infrastructure
• Vercel: Web application hosting and analytics
• Render: API and background worker hosting
• Xero: Accounting sync (only if you connect it)

We may also disclose data when required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets (with notice to you).

Our infrastructure providers may store and process data in countries other than your own, including Singapore and the United States. Where personal data is transferred across borders, we take steps to ensure it receives a comparable standard of protection, including contractual safeguards with our subprocessors.

We protect personal data with industry-standard measures, including encryption in transit, encryption at rest for sensitive credentials, workspace-level data isolation, role-based access controls, and audit logging of automated agent actions. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you in accordance with applicable law.

We retain account data for as long as your account is active and for a reasonable period afterwards to comply with legal, tax, and accounting obligations. Debtor data is retained on the Customer's instructions: Customers can delete records in-app, and after termination Customers may request an export within 30 days, after which we delete or anonymize the data unless retention is required by law.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or limit certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact us at support@chironpay.com. If you are a Debtor, we will assist and route your request to the business that controls your data. We respond to requests within the timelines required by applicable law.

We use cookies and similar technologies that are necessary to sign you in and keep the Service secure, and privacy-respecting analytics to understand aggregate usage of our websites. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from working.

The Service is for business use and is not directed to children. We do not knowingly collect personal data from anyone under 18.

We may update this Policy from time to time. For material changes we will notify Customers by email or in-app notice before the changes take effect. The "Last updated" date above reflects the current version.

For privacy questions or requests, contact us at support@chironpay.com.