Compliance

1. Fair cancellation commitment

• Subscribers can always continue to cancellation.
• Exact billing consequences are shown before acceptance.
• No surprise price changes and no fake urgency.
• A save is recorded only after Stripe confirms the action.
• If Stripe cannot apply a change, we never claim the customer was saved.

Using Cancelbox to obstruct cancellation is a breach of the Acceptable Use Policy and the Terms.

2. Privacy laws

Cancelbox is designed so you can operate as a controller and we operate as a processor for subscriber data. The DPA includes instruction, security, subprocessors, breach notice, and transfer language intended to support GDPR, UK GDPR, and similar regimes. California “sale” / “share” opt-out is not required for Cancelbox’s own processing because we do not sell or share personal information for cross-context advertising.

We are not your privacy counsel. You remain responsible for notices to your subscribers, lawful basis, and any industry rules that apply to you.

3. Stripe, PCI, and money

• Cancelbox does not store cardholder data. Card collection stays in Stripe Checkout or your Stripe-hosted surfaces.
• Connect OAuth is the only supported way to attach a customer Stripe account.
• Cancelbox’s own fees are billed on Stripe Checkout.
• Net retained MRR is an analytics metric, not a payment or tax filing.

4. What you still own

• Your subscriber contracts, refunds, chargebacks, and tax collection.
• Consumer-cancellation statutes in each country you sell into.
• Accuracy of the customer-facing copy you configure in Churn Routes.
• Deciding who on your team can connect Stripe or export data.

5. Document map

• Privacy Policy — what we collect and why
• Terms of Service — the commercial contract
• DPA — processor terms
• Cookie Policy — choices and catalog
• Subprocessors — who helps us
• Security — technical controls
• Refunds — Cancelbox plan refunds

Questions: legal@cancelbox.co. Security: security@cancelbox.co.