Effective 10 September 2026. What we store, why, and how to get it out.
Website and account data (your name, email, workspace settings, usage of the dashboard) is data we control. Customer Data (your subscribers' records, cancel sessions, offers, emails we send on your behalf) is data you control and we process as your service provider under our terms and, where applicable, a data-processing agreement.
Account details, the configuration you enter, server logs with IP addresses for security and rate limiting, and an audit trail of actions taken in your workspace. The dashboard uses no third-party analytics or advertising pixels.
Whatever you send: identifiers, plan and billing signals, usage signals, cancel reasons and free text, and the outcomes of offers. You choose which fields to send. When you sign subscriber identity with your widget secret, the widget accepts only a display name from the browser and everything else must come from your server; without signed identity it will also accept a plan label and custom attributes from the page, and those can affect targeting, so sign identity in production.
TypeSafe (typesafe.ai), the decision model Tenure asks what to offer, receives data from every workspace: for each moment, the moment type, bucketed billing state (price and tenure bands, never amounts), summaries of the usage facts you send, the offers in your plan, and up to 1,200 characters of the subscriber's typed text after email addresses, links, phone numbers, card-like numbers and the subscriber's name are removed; already-redacted cancel-reason text (up to 600 characters) to group feedback into themes; your public site text at setup; and your workspace's aggregate weekly figures. It never receives a subscriber's email address, name, customer id or billing amounts. Otherwise only services you connect receive Customer Data: your billing provider (Stripe or Chargebee), your email provider (Resend), and Anthropic (Claude, for the AI features below). Firecrawl (firecrawl.dev), a page-rendering service on Tenure's own account, reads only your own public website: the page you give at setup (with your app's sign-in page, for its look), your pricing page (for plan features), your changelog or blog (for What's new suggestions), a screenshot of your app's page, and documents you choose to add; afterwards your pricing page, changelog and look are re-read at most weekly while you use Tenure. It never receives anything about your subscribers. Self-hosted deployments send nothing to Tenure.
Cancel sessions are kept for as long as your workspace exists so Results can report outcomes over time. Audit events are kept for the retention period set on your workspace (365 days by default, or forever if you set it to 0) and are purged nightly past that age. Webhook delivery payloads are removed after 90 days. You can erase any individual customer with all their sessions from the dashboard ("Erase customer" on the customer page); erasure also removes their references from the audit log. The data-subject API exports a customer's data; it does not erase. Password-reset and invite tokens expire automatically.
Passwords are hashed with bcrypt; API keys are stored as hashes; session cookies are encrypted and HttpOnly; outbound webhooks are signed; widget identity can be signed with a per-workspace secret; billing changes require explicit acceptance and are idempotent. Report vulnerabilities to security@churner.app.
Account holders can export or delete their workspace. For Customer Data, requests from your subscribers should be directed to you as controller; the data-subject endpoint lets you fulfil access requests in seconds, and erasure requests are fulfilled from the dashboard.
Claude (Anthropic) drafts your plan and customer wording from your site, proposes offer conditions from your own words, answers questions about a decision, suggests a brand voice, writes the weekly summary and groups feedback into themes, each with only the fields that task needs. No Customer Data is used to train models by Tenure or, under Anthropic's API terms, by Anthropic.
Data lives where you deploy Tenure. For the hosted service, data is stored in the region of your deployment and transferred only to the subprocessors you enable.
Privacy questions: privacy@churner.app. Security issues: security@churner.app.