Privacy policy

Who we are

The website www.nochurn.sh and the NoChurn service are published by BHG SAS, 6 rue de la Hallebarde, 45000 Orléans, France, RCS Orléans 922 538 632. For any question about your data: support@nochurn.sh.

This policy covers the website, the documentation (docs.nochurn.sh), the dashboard (app.nochurn.sh) and the components our customers install on their side (the js.nochurn.sh script, cancel.nochurn.sh pages).

Two different roles

Controller. For website visitors, people who write to us and users of a NoChurn account, BHG SAS decides why and how the data is processed.

Processor. For our customers’ end customers (the subscribers of a SaaS or app that uses NoChurn), we process data only on our customer’s instructions, and our customer remains the controller. If that is your case, send your requests first to the company you subscribe to; we help them answer.

When you visit the website

• Technical data. Our host Cloudflare processes the IP address and headers of each request to serve pages and protect the site from abuse. Legal basis: our legitimate interest in running and securing the site.
• Preferences. The language you pick and your cookie choices stay in your browser (see “Cookies and storage”).
• Campaign parameters. If you arrive through a campaign link (utm_*, gclid, fbclid, msclkid), these parameters are kept for the tab’s lifetime and copied onto sign-up links, so we know which campaign brought an account. Legal basis: legitimate interest.
• Audience measurement. Google Tag Manager loads only if you accept the “Audience measurement” category. Legal basis: your consent, which you can withdraw at any time with “Cookie settings” at the bottom of the page.
• Chat. The Intercom support chat loads only with your consent (“Support” category, or the “Open the chat” button on the Support page). It processes your messages and the email you give.
• Free tools. The calculators under /tools/ compute everything in your browser and send nothing. The BIN lookup sends to binlist.net, from your browser, only the first 6 to 8 digits you type. Never type a full card number.

When you have a NoChurn account

• Identity and sign-in: email, name, password (stored only as a bcrypt hash), two-factor secret (encrypted) and backup codes (hashed), Google identifier if you sign in with Google, last sign-in date.
• Sign-up origin: the campaign parameters above, stored with the account.
• NoChurn billing: handled by Stripe; we never see your card number.
• Support: your exchanges by email or chat; the chat receives your identity in signed form so you don’t have to give it again.

Legal bases: performance of the contract (providing the service), our legal obligations (invoices) and our legitimate interest (security, abuse prevention, measuring our campaigns). We send you product emails, which you can unsubscribe from at any time.

Your customers’ data

When you connect your billing, your support tools or our script, NoChurn processes on your behalf:

• your customers’ identity: email, name, language, country, time zone, your internal IDs;
• their subscriptions, invoices and payment attempts;
• for payment methods, only the brand, last 4 digits, expiry, type, country and wallet. Never the full number, nor the security code. The service falls within PCI DSS SAQ-A scope;
• cancellation reasons, answers and comments entered in the cancel flow;
• support conversations read from the tools you connect (read-only);
• attributes and events you send us through the API, including campaign parameters captured by our script.

We use this data only to provide the service you set up: payment recovery, cancel flows, win-back, disputes, scores and analyses. We do not sell it and do not use it for our own advertising. Test and live data are kept apart, and each account is isolated from the others.

Some features (email drafts, reading replies, customer analysis, dispute responses) use Anthropic’s AI model. A customer analysis is sent without the customer’s name, email or the attributes you mark as sensitive. We store neither the prompts nor the answers, only the volume used.

An end customer who asks to stop receiving emails is added to a suppression list: no email or win-back follow-up is sent to them any more.

Our providers

We rely on the following providers, each limited to what it needs:

Tools you connect yourself (Stripe, Chargebee, Paddle, Intercom, Zendesk, Slack…) remain under your own contract with them; NoChurn only reads or writes what the connection allows.

Transfers outside the European Union

Service data is hosted in the European Union. Some of the providers above are based in the United States: the data they process for us may therefore be transferred there. Write to support@nochurn.sh to learn the safeguards that apply to each.

How long

• Service logs (API calls, webhooks, emails): 90 days.
• Raw content of received webhooks and email events: 30 days.
• Your account data and your customers’ data: as long as your account is open. When you close it, write to support@nochurn.sh to ask for its deletion.
• Invoices: 10 years, as required by the French Commercial Code.
• Support exchanges: at most 3 years after the last exchange.
• Preferences in your browser: until you clear them.

Security

• Encryption in transit (HTTPS everywhere, HSTS) and at rest for secrets, connection tokens, text typed by your customers and files.
• Hashed passwords, two-factor authentication available and enforceable for the whole team.
• Sensitive values masked in technical logs.
• No full card data, ever.
• Strict isolation between accounts, and between test and live mode.

Cookies and storage

We set no advertising cookies. Here is what our own pages store:

Google Tag Manager and Intercom cookies are set only with your consent. Change your mind at any time with “Cookie settings” at the bottom of every page.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. Write to support@nochurn.sh; we answer within one month. We may ask you to prove your identity.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.

Changes

We update this page when our processing changes; the date at the top shows the latest version. If an important change affects your account, we tell you by email.