RebillKit
ENES
Sign inStart setup
Legal

Privacy and data protection

How RebillKit handles your data, the keys you connect and the emails it sends on your behalf.

Last updated: 7 November 2026

Javier García Camacho (NIF 52888826G), Alcalá de Henares, Madrid, Spain. No private street address is published, for the protection of the home.

Write to the channel that fits your request:

  • Firebase Auth account: email address, user identifier and verification status.
  • BYOK keys for Stripe and Resend, encrypted on the server with AES-256-GCM at rest. They are never stored in clear.
  • Stripe webhooks with failed payment data: amount, currency, decline code and invoice and customer identifiers.
  • Plain text recovery emails sent through the client own Resend account and domain.
  • Minimal technical logs required to operate the service and diagnose errors.

Keys are encrypted before they reach disk and are decrypted only in memory for the operation that needs them. RebillKit does not store card data, adds no tracking pixels and never sells or shares data for advertising.

RebillKit relies on these providers under their data processing terms:

  • Google Cloud and Firebase (Firestore in eur3, Cloud Run in europe-west1): hosting and authentication.
  • Cloudflare: DNS resolution and TLS termination at the edge.
  • Stripe: payment and subscription processing.
  • Resend: transactional email delivery from the client own domain.

Where a provider processes data outside the EEA, transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework when applicable.

Account and billing data are processed to perform the contract. Operational logs rely on legitimate interest in keeping the service secure. Data is retained while the account is active and for the statutory periods that apply; recovery emails and webhook payloads are removed with the account.

You may request:

  • Access to the data held about you.
  • Rectification of inaccurate data.
  • Erasure when the legal basis no longer applies.
  • Objection to processing based on legitimate interest.
  • Restriction of processing while a request is resolved.
  • Portability of the data you provided.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

Only the technical session cookie for Firebase Auth and your theme preference are stored. There is no analytics, no advertising and no tracking pixel, neither in the product nor in the emails.

Relevant changes are published on this page with a new date. For material changes, account holders are notified by email.