Reference 3 of 3
Two different sets of data live here: what your visitors do on the cancel page, and what your own account holds. This page covers both, with numbers where there are numbers and plain language where there are not.
The cancel page sets no cookies, reads no IP address, records no user agent, and loads no third-party script. There is no analytics of any kind on it. This is not a policy we are describing; there is no code in the page that does any of those things, and its content security policy is default-src 'none' with no script source at all. The page we host sends no JavaScript. Its referrer policy is no-referrer, so your billing host never learns which page the visitor arrived from.
Five events per visit at most: that the page opened, which reason was selected, that an offer was shown, that it was accepted, and that the visitor was sent on to your billing page. Alongside them: the reason code, which offer it was, the ref you passed us, and — if you signed it — the subscriber ID.
Cancel flow events, fulfilment records, notification records: twenty-four months, then removed by a job that runs every day. Billing provider event records: the raw message from the provider is erased after ninety days. What stays permanently is a minimal record — which provider, their event ID, when, and what we did — because that is what stops the same payment event being applied twice.
Closing your account is something you ask us for — write to us and we do it. Your products, their flow events, your fulfilment and notification records, your signing key and any connected provider key all go in the same operation. One thing does not: the minimal billing record is detached from your account rather than deleted, because it has to outlive the account it belonged to.
If any of this changes, this page changes with it. The retention numbers above are the same ones in our privacy policy, and they are enforced by a scheduled job rather than by a promise to remember.
