What we do with your Stripe data
A plain-language page: what FlowMRR reads, the one thing it writes, how everything is protected, and how you take control back in one click.
Last updated: September 14, 2026
1. Our commitments, in one paragraph
FlowMRR is an analytics and payment-recovery tool. It reads your Stripe account to compute MRR, churn, cohorts, cash flow and your recovery queue. It performs exactly one write: retrying a failed invoice, and only when you click “Retry payment”. It never creates, edits or deletes customers, subscriptions, prices, charges or payouts. Your credentials are encrypted at rest, decrypted only in memory while a sync or a request you triggered is running, and wiped the moment you disconnect. You can pause ingestion, revoke access or erase every synced row yourself, at any time, without asking us.
2. Two ways to connect — and what each grants
“Connect with Stripe” (OAuth)
You approve FlowMRR on Stripe’s consent screen and Stripe hands us an access token. Stripe’s Connect OAuth for standard accounts offers a single scope, read_write; Stripe does not make a read-only option available to platforms like ours, so the consent screen will say FlowMRR can “manage” your account. That is Stripe’s wording for the scope, not a description of what we do. Our behaviour is what section 3 describes, and it is enforced in code, not by policy: there is no code path in FlowMRR that creates a charge, a subscription, a price or a payout.
Real-time updates for Connect tenants arrive on a single endpoint that lives on our Stripe platform account, so nothing needs to be created on yours.
API key (restricted or secret)
You decide permission by permission. We recommend a restricted key with read access to core and billing resources plus write on exactly two: Invoices (payment retry) and Webhook Endpoints (so we can register real-time updates). A read-only key works for every dashboard; it disables payment retries and requires the webhook to be registered by hand — the app tells you when that is the case and walks you through it. Step-by-step guide →
3. Exactly what we read, and the one thing we write
| Customers | Read — names, emails and countries are encrypted before storage; used for cohorts, geography and recovery emails you send. |
|---|---|
| Subscriptions, products, prices, coupons | Read — the basis of MRR, plan mix and discount analytics. |
| Invoices, charges, refunds, disputes | Read — revenue recognition, failed-payment detection, refund and dispute rates. |
| Payment intents & payment methods | Read — decline codes and card expiry, so the recovery queue can tell a soft decline from a dead card. |
| Balance & balance transactions | Read — Stripe fees and cash on hand for the Treasury view. We never move money or request payouts. |
| Invoices | Write — Invoice.pay on an already-failed invoice, only on your explicit click. The sole mutating call in the product. |
| Webhook endpoints (API-key connections only) | Write — creating, updating and deleting the one endpoint we register for you, so you receive real-time updates. |
Nothing else. In particular we do not read or store your Stripe bank details, tax IDs, API keys of your own, or your team members’ identities.
4. How your data is protected
Credentials
Access tokens and API keys are encrypted with Fernet (AES-128-CBC + HMAC) before they touch the database, using a key that lives only in the application’s environment. They are decrypted in memory for the duration of a sync or of a request you initiated, and never logged.
Personal data of your customers
End-customer names, emails, phone numbers and company names are encrypted at rest with the same scheme. Analytics run on hashed identifiers; the plaintext is only decrypted to render a page you are looking at or an email you asked us to send.
Infrastructure
Database and backups in the European Union (Supabase, Paris region). Application servers on Railway, frontend on Vercel, transactional email via Brevo (EU), file storage on AWS S3 in eu-west-3. All traffic is TLS; HSTS is enforced. Each of these providers is bound by a data-processing agreement, under the sub-processor framework set out in our DPA.
Webhooks
Every inbound Stripe event is signature-verified before a single byte is parsed. Events are deduplicated per tenant so a Stripe retry can never double-count revenue. Raw event payloads are kept for seven days for debugging, then deleted.
No third-party trackers
Neither the app nor this website loads advertising or third-party analytics scripts. Our own measurement is session-scoped and cookie-free — see the Privacy Policy.
5. You stay in control
| Pause | Stops all ingestion — webhooks, scheduled syncs, live reads — while keeping your data frozen at that moment. Resume whenever you like. |
|---|---|
| Remove credentials | Deletes the token or key from our systems and, for API-key connections, removes the webhook we created. Optionally erases every synced row at the same time. |
| Revoke from Stripe | For Connect: uninstalling FlowMRR from your Stripe Dashboard invalidates our token; we notice within seconds and clear the credential on our side. |
| Delete your account | Removes everything — synced data, analytics, reports, support tickets and attachments, and the Stripe customer record we hold for your own FlowMRR subscription. |
| Unsubscribe lists survive erasure | If you erase synced data and later reconnect, the recipients who unsubscribed from your recovery emails stay unsubscribed. That opt-out is owed to them, not derived from Stripe. |
6. What we will never do
- Charge your customers, change your prices, or create or cancel subscriptions.
- Move money, request payouts, or touch bank or tax details.
- Sell, rent or share your data or your customers’ data with anyone for their own purposes.
- Train models on your customers’ personal data.
- Add a third-party tracker to the app or this site without updating this page and, where required, asking for consent first.
If Stripe ever makes a narrower scope available to platforms like ours, we will adopt it and say so here.
Write to us: support@flow-mrr.com. To report a vulnerability, use the same address with “security” in the subject — we respond within 48 hours.