Data Deletion Policy

Refund Sensor (“Refund Sensor”, “we”, “us”, “our”) helps iOS developers respond to Apple refund requests. This Data Deletion Policy explains what data you can delete, how to delete it yourself from the dashboard, how to ask us to delete it for you, and what happens after deletion. It should be read alongside our Privacy Policy, which describes what we collect and why.

We believe you should stay in control of your data. You can remove most of it yourself at any time, and you can ask us to erase the rest.

Deletion can cover the following, depending on your request:

• Account information such as your email address, company name, and profile details.
• Connected app data received from Apple's App Store Server Notifications, including transaction identifiers, subscription and refund event records, and the responses we submitted to Apple on your behalf.
• App Store credentials you provided to connect an app (such as the Apple .p8 key, Key ID, and Issuer ID), which are stored encrypted.
• Consumption signals you chose to forward, such as aggregate session counts, active time, and feature-usage indicators.

Most data can be removed directly from the dashboard, without contacting us:

Remove a connected app

Removing a connected app permanently deletes that app's transaction and refund-response records from our systems and renders its stored Apple credentials, including the .p8 key, unusable. Historical records tied only to that app are removed as part of the same action.

Delete your account

Deleting your account removes your profile and disconnects all connected apps, deleting their associated data. If your account manages a team, the team members and their associated data are removed as part of the account deletion. This action is permanent and cannot be undone.

If you would prefer that we handle deletion, or you can no longer sign in, email us at [email protected] from the email address associated with your account. To help us act quickly, please include:

• The account email address the request relates to.
• Whether you want your entire account deleted, or only specific apps or records.

We may need to verify your identity before acting on a request, so that we do not delete data at the request of someone who is not entitled to.

Once deletion is confirmed, the affected data is permanently removed from our live systems. Copies held in encrypted backups are overwritten on our normal backup rotation, typically within 30 days, after which they can no longer be restored. Deletion is irreversible, so please export anything you need beforehand.

We may keep a limited amount of data after a deletion request where the law allows or requires it, for example to:

• Meet legal, tax, accounting, or billing obligations for paid plans.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Resolve disputes and enforce our agreements.

Any retained data is kept to the minimum needed for these purposes and is deleted once it is no longer required. Aggregated or anonymized information that can no longer be linked to you may be retained.

For data about your end users (the people who requested refunds), you are the controller and Refund Sensor acts as a processor on your behalf. If one of your end users asks you to delete their data, you can remove it using the controls above, and we will assist you as needed under our Data Processing Agreement. End users should direct their requests to the developer whose app they purchased, not to Refund Sensor directly.

Self-service deletions from the dashboard take effect immediately. Email requests are actioned without undue delay and, in any case, within the time required by applicable law (typically within 30 days). If a request is complex or we receive a large number of requests, we will let you know and keep you updated.

Questions about deleting your data, or need help with a request? Email [email protected] and we will respond within one business day.