Privacy Policy

What we collect

• Account: email address and a hashed password (handled by our authentication library, never stored in plain text).
• Stripe connection: an encrypted restricted API key you provide, plus your Stripe account id. We use the key to subscribe to the webhook events required for alerting.
• Slack connection: an encrypted bot token obtained via OAuth, your workspace id and name, the bot user id and name, the channel you select for alerts, and the scopes granted.
• Subscription state: your Stripe customer id, subscription id, status (trialing, active, past_due, canceled), and trial/period end dates. Payment card details are processed by Stripe and never stored on our infrastructure.
• Alert history: a record of the Stripe events we processed on your behalf, the alerts we derived from them, and their delivery status (Slack message id, send timestamp, failure reason if any).
• Email logs: transactional email metadata (verification, daily summary, warm-up) for delivery diagnostics.

How we use it

• Deliver real-time alerts to your chosen Slack channel.
• Send you a daily summary email of the previous 24 hours of Stripe activity.
• Bill your subscription and manage your trial.
• Send transactional email (email verification, billing notices).
• Debug delivery issues and respond to support requests.

We do not use your data to train machine learning models. We do not send you marketing email without opt-in.

How we store it

• Data lives in a managed PostgreSQL database on Railway (US region). Transport between your browser, our services, and our database is encrypted with TLS.
• Stripe API keys and Slack bot tokens are encrypted at rest with AES-256-GCM using a secret held only in our deployment environment.
• Backups are retained by Railway according to their managed-database policy (up to 30 days by default).

Who else touches your data

We share your data only with the processors needed to operate the service:

• Stripe — billing (your subscription) and alert-ingestion source (your connected Stripe account).
• Slack — delivery destination for real-time alerts.
• Resend — transactional email provider (email verification, daily summaries).
• Railway — application hosting and managed database.

Each of these processors has its own privacy commitments. We do not share your data with any other third party.

Cookies

We use two first-party cookies:

• A session cookie for authentication (set by our authentication library).
• A short-lived CSRF cookie (5-minute TTL) used during the Slack OAuth install to prevent cross-site request forgery.

No analytics, advertising, or third-party cookies.

Your choices

• Disconnect Stripe or Slack at any time. Clicking Disconnect on either connection removes the encrypted token from the active set and stops delivery.
• Export your data. Use our Contact page and we will send a machine-readable copy of your data within 30 days.
• Delete your account. Email us and we will delete your account and associated data within 30 days.

Retention

We retain your data while your account is active. If you delete your account, we remove your data from our production database within 30 days. Backups containing your data may persist up to 30 additional days before being rotated out.

Children

emtrio is intended for business use by people aged 18 or older. We do not knowingly collect data from children under 13.

Changes

If we make material changes to this policy, we'll update the date at the top and notify you by email before the changes take effect.

Contact

Questions or requests? Use our Contact page. We respond within 1–2 business days.