Privacy

Short version: what you paste is used once to write your email and is not stored on our servers. Card numbers, security codes and passwords are removed before anything is read. Your cases are saved in your own browser. If you connect Gmail, we read billing emails only when you press Scan, and we never store their content.

What you paste

When you start a case, the business name, website and any text you paste are sent to our server. Before anything else happens, the server removes anything that looks like a full card number (keeping the last four digits), US Social Security numbers, card security codes and passwords. The cleaned text is then sent to our language-model provider to read the facts and write your email. Requests are routed through OpenRouter to the model in our configuration. We do not save the text, and it is not used to train models by us.

Screenshots and photos you attach are shrunk in your browser and sent with the text to a model that can read images, once, to pull out the same facts. Images can't be redacted the way text is, so the model is told to report only the last four digits of any card number it sees, and you can cover card numbers before uploading. We don't store the images.

The contact lookup

To find a business's billing contact, our server fetches that business's public web pages. Nothing about you is sent to the business when we do this. The contacts we find are public information and are cached for a week by business, never alongside anything you pasted. Addresses from your own receipt are used for your case only and are not cached.

Your cases

The case tracker, your name for the sign-off and your drafts are stored in your browser's local storage on this device. They are not sent to us. Clearing your browser data deletes them.

Gmail inbox scan (Pro)

If you choose to connect Gmail, the connection is made through Composio, our integration provider, which holds the access token on our behalf. Google's consent screen may show Composio's name. We store only the id of that connection, linked to your licence key.

• Reading. Only when you press Scan, we search your mailbox for purchase and billing emails from the last four months and read each one's sender, subject, date and short preview. Those are sent to our language-model provider once to pick out renewals, trials, price rises and double charges. The results are shown to you and not stored.
• Writing. When you press Save to Gmail drafts, we create a draft in your account with the email you wrote. We never send email from your account, and we never delete, label or change your messages.
• Disconnecting. Disconnect on the Inbox scan page deletes the connection. You can also remove access at any time from your Google account's security settings.

DemandRefund's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Gmail data is used only to show you refund and cancellation opportunities and to create drafts you ask for. It is not sold, not used for advertising, not used to train AI models, and not read by people.

Analytics

The site uses Vercel Web Analytics, which counts page views and a small number of events, such as “a case was started” or “a checkout button was clicked”. It doesn't use tracking cookies or build a profile of you. Events never include what you pasted.

Licences

If you buy Pro, the licence key and the Stripe checkout session id are stored so the key can be checked and re-issued if you lose it. Card details are handled by Stripe and never reach this site. Your email address from checkout is used to send your receipt and licence key.

Rate limits

To keep the free tier fair, we count cases per IP address (or per licence key on Pro) for 24 hours. The counter holds a number, not your requests.

Contact

Questions, or a request to delete licence data: Mark@Reinventing.AI.