Stubly is operated by Jeff Ritz pending formation of Stubly LLC (Delaware). This policy applies to the early access period and will be superseded by post-formation terms upon entity formation. Existing users will be notified at least 30 days before any material changes take effect.
Privacy Policy
Last updated 2026-04-30
What we collect
When you sign up, Clerk (our authentication provider) collects your email address and name. This information is stored in Stubly's database alongside the organization automatically created for your account.
When your x402 server posts payment events to a Stubly webhook endpoint, we receive and store: payer wallet address, payee wallet address, payment amount, currency, network, payment timestamp, transaction hash, resource path, and any optional fields you choose to include such as the payer's email address.
We also collect operational metadata to provide and protect the service: source IP addresses for webhook requests, rate-limit events, webhook delivery attempts including failure reasons, and email delivery status from our outbound email provider.
Why we collect it
We collect the data above to operate the service: generate receipts, optionally email receipts to payers when you provide their address, render the dashboard, prevent abuse, and support customers when something goes wrong.
What we don't collect
Stubly does not collect or store payment card data — we are not a payment processor. We do not collect browsing behavior outside our application. We do not embed cross-site tracking pixels or third-party analytics SDKs in v1. We do not sell or rent your data to any third party under any circumstances.
Third parties we share with
Operating Stubly requires sharing your data with infrastructure providers. Each is named here so you can audit the chain:
- Clerk — user authentication
- Vercel — application hosting
- Neon — database hosting
- Cloudflare — file storage and edge infrastructure
- Resend — transactional email delivery
- Inngest — background processing
Each provider operates under its own privacy policy. We do not share your data with any other parties.
Cookies
Stubly uses Clerk's authentication cookies to maintain your session. Vercel sets functional cookies for hosting and security. We do not set marketing, advertising, or analytics cookies in v1.
Data retention
We retain your transaction data and generated receipts for as long as you have an active Stubly account. After account deletion, we observe a 30-day grace period during which you may request an export of your data. After the grace period, we permanently delete your transaction data and receipts.
Some operational logs — rate-limit events, webhook delivery attempts — are retained for up to 90 days for security and debugging purposes, after which they are also deleted.
User rights
You may request a copy of your data, request correction of inaccurate data, or request deletion of your account at any time by emailing jeff@getstubly.com. We will respond within 30 days.
Children
Stubly is not directed at, and may not be used by, individuals under 18 years of age. If we learn we have collected data from a person under 18, we will delete it.
International users
Stubly is operated from the United States and your data is stored on US-based infrastructure. By using the service, users outside the US consent to the transfer and processing of their data in the US.
Changes
We may update this Privacy Policy with at least 30 days notice for material changes. Notice will be sent to the email address on your account.
Contact
Questions about your data or this policy? Email jeff@getstubly.com.