Data Processing Agreement

Stay Instead’s role depends on the data:

• Processor - for a vendor’s customer data (Stripe customer/subscription identifiers, cancellation reasons, offer acceptance, billing-action status, and email where a vendor enables verification). Stay Instead processes this on the vendor’s documented instructions, expressed through the vendor’s configuration.
• Independent controller - for the vendor’s own account data and for security, fraud-prevention, and audit logs Stay Instead maintains to operate the service.

• Stripe customer and subscription identifiers, plan/price, amount, and currency.
• Cancellation reasons and optional free-text feedback.
• Offer presentation, the exact terms consented to, and billing-action status.
• Customer email address, only where a vendor enables email verification.
• Connected Stripe account identifiers and technical/security logs.

Stay Instead does not store full payment-card details; Stripe processes payment data independently.

• Running the cancellation flow and evaluating retention-offer eligibility.
• Applying vendor-configured subscription changes through Stripe after customer consent.
• Confirmation and reconciliation of billing actions.
• Security, fraud prevention, debugging, support, and legal compliance.

Stay Instead uses the subprocessors listed on our Subprocessors page. Each processes only the data needed for its role.

Stay Instead applies the measures described in the Privacy Policy and retains data for as long as needed to provide the service and to meet legal, fraud-prevention, and dispute obligations. Consent records are immutable and are not altered by later vendor changes to an offer.

Reviewer note: a binding DPA - including the controller/processor designation for your operations, standard contractual clauses or other transfer mechanisms where applicable, sub-processor change-notice terms, and the contracting entity - should be reviewed and executed by Stay Instead’s legal entity with each vendor that requires one. Transfer mechanisms and certifications are intentionally not asserted here.