Privacy Policy

The short version

Stubly receives account information, payment-event data, and operational information needed to provide and protect the service.

We use this information to operate Stubly, generate receipts and transaction records, send requested communications, prevent abuse, troubleshoot problems, and provide support.

We do not sell or rent personal information.

We do not use personal information for cross-site behavioral advertising.

Information we collect

The information we collect depends on how you use Stubly.

Account information

When you create or use a Stubly account, we may receive and store:

• your name;
• your email address;
• account and user identifiers;
• organization information;
• authentication and session information; and
• account settings.

Our authentication provider processes information needed to create accounts, authenticate users, and maintain sessions.

Payment-event and transaction information

When a customer’s x402 server sends a payment event to a Stubly webhook endpoint, we may receive and store information such as:

• payer wallet address;
• payee wallet address;
• payment amount;
• currency or asset identifier;
• network;
• payment timestamp;
• transaction hash;
• resource path; and
• other information included in the payment event.

Customers may choose to include optional information, such as a payer’s email address.

The customer controls what optional information it submits and is responsible for having the rights and authority necessary to provide that information.

We do not ask customers to include sensitive personal information in payment events. Customers should not include information such as passwords, government identification numbers, health information, or other highly sensitive data in fields submitted to Stubly.

If a payer email address is provided, we use it to send receipts or other communications requested through the service and to support reliable delivery. We generally retain the address in association with the related transaction record according to the retention practices described below.

Wallet addresses, transaction hashes, and other blockchain-related identifiers may be personal information when they can be linked to an individual or household. Blockchain records may also be public and difficult or impossible to alter or delete. Stubly cannot delete or change information recorded on a blockchain or other network that we do not control.

Webhook and operational information

We collect information needed to operate, secure, and troubleshoot the service, including:

• source IP addresses for webhook requests;
• request timestamps;
• webhook endpoint identifiers;
• authentication and signature-validation results;
• rate-limit events;
• delivery attempts;
• error and failure information;
• system and security logs; and
• information about service performance.

Email delivery information

If Stubly sends a receipt or other transactional email, we may receive information from our email provider about the delivery of that message, such as:

• delivery status;
• bounce or rejection information;
• failure reasons; and
• related technical metadata.

We use this information to deliver messages, troubleshoot delivery problems, prevent abuse, and maintain service reliability.

We do not use transactional email information for cross-site behavioral advertising.

Stubly does not currently rely on email open or click tracking for advertising or behavioral profiling. If our email practices materially change, we will update this Privacy Policy as appropriate.

Support communications

If you contact us, we collect the information you choose to provide, which may include:

• your name and email address;
• the content of your message;
• attachments or screenshots you provide; and
• information needed to investigate and respond to your request.

Where information comes from

We collect information:

• directly from you when you create an account or contact us;
• from customer systems when they send payment events to Stubly;
• automatically when you or your systems interact with the service; and
• from service providers that help us operate Stubly.

How we use information

We use information to:

• create and manage accounts;
• authenticate users and maintain sessions;
• receive and process payment events;
• identify duplicate event submissions;
• generate PDF receipts;
• create and display transaction records;
• provide dashboards and exports;
• send receipts and other communications requested through the service;
• operate and maintain Stubly;
• monitor service performance;
• troubleshoot errors;
• protect the security and integrity of the service;
• prevent fraud and abuse;
• enforce our Terms of Service;
• respond to support requests;
• improve the reliability and functionality of Stubly;
• comply with applicable law and valid legal process; and
• protect the rights, safety, and security of Stubly, our users, and others.

We do not use payment-event data to make decisions about a person’s eligibility for credit, employment, housing, insurance, or other similarly significant decisions.

We do not use Customer Data to train generalized artificial intelligence or machine-learning models for unrelated products or third-party advertising.

Our role when processing information

Our role depends on the category of personal information involved.

For account information, service-administration information, security information, and our own business operations, RitzyLabs generally determines why and how the information is processed.

For personal information contained in payment events that customers submit to Stubly, including optional payer email addresses, the customer generally determines why the information is submitted. Stubly processes that information to provide the service and carry out the customer’s instructions, subject to our Terms of Service and applicable law.

If you are a payer or another individual whose information was submitted to Stubly by one of our customers, the customer is typically the appropriate party to contact first about the collection or use of that information.

We may assist the customer with a privacy request when appropriate. If we cannot identify the relevant customer or transaction from the information you provide, our ability to locate information or assist with the request may be limited.

What we do not collect or do

Stubly does not collect or store payment card numbers or card security codes as part of the Stubly service.

Stubly is not a payment processor and does not take custody of customer funds.

We do not collect browsing behavior across unrelated websites.

We do not embed third-party advertising SDKs or use cross-site tracking technologies for behavioral advertising in the early-access version of Stubly.

We do not sell or rent personal information.

How we disclose information

We disclose information only as described in this Privacy Policy.

Service providers

We use service providers to operate Stubly. Depending on how the service is configured, these providers may process information on our behalf.

Our current providers include:

• Clerk — authentication and account management; may process account, authentication, and session information;
• Vercel — application hosting and infrastructure; may process application data, request information, and operational logs;
• Neon — database hosting; may store account information, Customer Data, and transaction records;
• Cloudflare — file storage and edge infrastructure; may process stored files, network traffic, and related technical information;
• Resend — transactional email delivery; may process recipient email addresses, email content, and delivery metadata; and
• Inngest — background processing; may process queued tasks and related operational metadata needed to perform service functions.

These descriptions reflect the functions these providers perform for Stubly. The specific information processed may depend on how the service is configured and used.

These providers process information according to their own terms, privacy policies, and agreements with us.

Our provider list may change as the service develops. We will update this Privacy Policy when a change materially affects how personal information is handled.

Legal requirements and protection

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to valid legal process;
• enforce our Terms of Service;
• investigate fraud, abuse, or security incidents;
• protect the rights, property, or safety of RitzyLabs, our users, or others; or
• establish, exercise, or defend legal claims.

Business transactions

We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or another transaction involving all or part of our business.

If such a transaction materially changes how personal information is handled, we will provide notice when required by law.

With your direction

We may disclose information when you direct or authorize us to do so.

Cookies and similar technologies

Stubly uses cookies and similar technologies that are necessary for:

• authentication;
• session management;
• security; and
• operation of the service.

Necessary technologies may include those used to keep you signed in, maintain session state, protect against fraud or abuse, and support essential service functions.

We do not use advertising cookies or cross-site behavioral advertising technologies in the early-access version of Stubly.

Our practices may change as the service develops. If a change materially affects how personal information is handled, we will update this Privacy Policy and provide notice when required.

Your browser may allow you to block or delete cookies. Blocking cookies required for authentication or security may prevent Stubly from working correctly.

Data retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Account and transaction data

We generally retain account information, transaction data, optional payer email addresses associated with transaction records, and generated receipts while your Stubly account remains active.

After account deletion, we generally maintain a 30-day grace period during which you may request an export of available data.

After the grace period, we generally delete transaction data and generated receipts from active systems, subject to limited retention where reasonably necessary for:

• legal obligations;
• security and fraud prevention;
• dispute resolution;
• enforcement of agreements; and
• ordinary backup processes.

Information remaining in backups may persist until the backups are deleted or overwritten according to our ordinary retention practices.

Operational logs

We generally retain operational logs, including rate-limit events and webhook delivery information, for up to 90 days for security, abuse prevention, troubleshooting, and service reliability.

Some security records may be retained longer when reasonably necessary to investigate an incident, prevent fraud or abuse, comply with law, or resolve a dispute.

Email delivery information

We retain email delivery information for as long as reasonably necessary to deliver messages, troubleshoot delivery problems, prevent abuse, maintain service reliability, and resolve disputes.

Support records

We may retain support communications for as long as reasonably necessary to respond to requests, maintain service history, resolve disputes, and improve support.

Data security

We use administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards may include access controls, authentication measures, service monitoring, and security practices appropriate to the nature of the service and information involved.

No system is completely secure. We cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization.

You are responsible for protecting your account credentials and webhook signing secrets and for promptly rotating or replacing credentials or secrets you believe have been compromised.

Your choices and rights

Depending on where you live and the laws that apply, you may have the right to:

• request access to personal information about you;
• request a copy of your information;
• request correction of inaccurate information;
• request deletion of information;
• object to or restrict certain processing; or
• exercise other privacy rights provided by applicable law.

You may request access, correction, deletion, or other applicable privacy rights by emailing jeff@getstubly.com.

We may need to verify your identity or authority before completing a request. Where applicable law permits requests through an authorized agent, we may require proof of the agent’s authority and may verify your identity directly.

We will respond within the time required by applicable law and generally aim to respond within 30 days.

If applicable law gives you a right to appeal our decision on a privacy request, you may submit an appeal by replying to our decision or emailing jeff@getstubly.com with “Privacy Appeal” in the subject line.

Some information may be exempt from a request, and we may retain limited information when required or permitted by law.

If personal information about you was submitted to Stubly by one of our customers, we may direct you to that customer or assist the customer in responding to your request, depending on the circumstances and applicable law.

Stubly does not currently sell personal information, use personal information for targeted advertising, or use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects. If our practices materially change, we will update this Privacy Policy and provide any choices required by applicable law.

Children

Stubly is intended for business and administrative use. It is not directed to individuals under 18 years of age, and individuals under 18 may not create or use a Stubly account.

We do not knowingly collect personal information directly from children through account registration.

We do not perform age verification beyond standard account processes.

If we learn that a person under 18 created an account or directly provided personal information in violation of this policy, we will take reasonable steps to delete the information.

International users and transfers

Stubly is operated from the United States and, during early access, is primarily focused on U.S.-based users and operations.

Personal information may be processed and stored in the United States and in other countries where our service providers operate.

Those countries may have privacy and data-protection laws that differ from the laws where you live.

Privacy obligations under laws such as the GDPR or UK GDPR may depend on facts such as where a business is established and whether it targets or monitors individuals in the European Economic Area or United Kingdom.

Where applicable law requires a specific mechanism or safeguard for an international transfer of personal information, we will use an appropriate mechanism or safeguard as required.

Third-party services

Stubly may interact with third-party networks, blockchains, infrastructure, and services.

This Privacy Policy applies to information handled by RitzyLabs through Stubly. It does not govern independent third parties that control their own collection and use of information.

You should review the privacy practices of third-party services you choose to use.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

We will provide existing users at least 30 days’ notice before a material change takes effect. Notice may be sent to the email address associated with your account or provided through the service.

Changes required by law or necessary to address an urgent security issue may take effect sooner when reasonably necessary.

The “Last updated” date at the top of this Privacy Policy shows when it was most recently revised.

Contact

Questions about your information or this Privacy Policy?

Email jeff@getstubly.com.