Privacy Policy

1. Controller

Quitivo, operating quitivo.com. Contact: support@quitivo.com.

2. Data we collect

To send the cancellation letter we collect: first name, last name, postal address, email address, telephone (optional), customer number (optional), and the cancellation reason if provided. Plus payment metadata (payment session ID, payment status) and operational logs (timestamps, IP address for fraud prevention, error logs).

3. Why we use it (legal basis)

(a) Performance of contract — to draft and send the cancellation letter and to send the invoice and reminders. (b) Legitimate interest — to protect against fraud, monitor service quality, and respond to support enquiries. (c) Legal obligation — to retain accounting and tax records.

4. Sharing — sub-processors

We use the following sub-processors. Each receives only the minimum data needed for their function:

Sub-processor	Purpose	Data location
Stripe	payments	EU/US
Viva.com (Viva Wallet)	card payment processing	EU/EEA
Postmark	transactional email + inbound support mail	EU
Bird.com	SMS notifications	EU
Anthropic (Claude)	AI-assisted support replies	EU/US
Neon (Vercel Postgres)	database storage	EU (Frankfurt)
Vercel	hosting	EU
Justus Collect (planned)	debt collection at +21d	EU

We share your name and address with the provider you are cancelling — this is required for them to identify you. Payment data is processed by our payment providers Stripe and Viva.com; we never see your card details.

5. Data location

Database is hosted on Neon Postgres in the EU (Frankfurt, Germany). Email and SMS providers also operate within the EU. Stripe processes payments in EU/US in compliance with EU Standard Contractual Clauses; Viva.com processes payments within the EU/EEA.

6. Payment security

Payments are handled entirely on the PCI-DSS-compliant, TLS-encrypted hosted checkout of our payment providers, Stripe and Viva.com. We never store your card number or CVV.

7. Retention

Dossier data: up to 7 years for accounting and tax purposes (EU/UK requirement). Email correspondence: 3 years. Form drafts: 30 days. Suppression list (unsubscribes): retained indefinitely to honour your preference. You may request earlier deletion of personal data, subject to retention obligations.

8. Your rights

Under GDPR (EU/UK) you have the right to: access, correction, deletion, data portability, restriction of processing, and objection. You also have the right to lodge a complaint with your national supervisory authority. To exercise any of these, email support@quitivo.com.

9. AI-assisted replies

Replies to support emails may be drafted with assistance from Anthropic Claude. The customer email content is processed by Anthropic for the sole purpose of generating the reply and is not used to train any model. We retain the AI-generated draft alongside the original mail in our database.

10. Cookies

See our separate Cookie Policy.

11. Contact

support@quitivo.com