1. Who this policy covers
This policy describes the Sentinel Payout & Balance Auditor Stripe App (the “App”) and the public website that publishes this policy (the “Site”). The merchant is the Stripe account that installs the App. “You” means that merchant and the people the merchant authorizes to use the Stripe Dashboard.
The data controller for Sentinel is [Legal entity name], established in [Country], with its registered address at [Street, city, postal code, country]. Privacy contact: https://stripesentinel.com/support. If an EU or UK representative is required, it is [Representative name and address, or “Not appointed”].
Sentinel is an independent extension. It is not Stripe, and Stripe is not the controller of Sentinel’s own records. Stripe is the controller of the Stripe account, and Stripe’s privacy policy governs Stripe’s processing. This policy governs what the App does with access you grant at install, and what the Site does when you open it.
2. Where the App runs
The App is a user-interface extension. After you install it, Stripe loads it inside the Dashboard in the Stripe App sandbox. It does not run on a server you point at a secret key, and you do not paste an API key into another website.
Calls to the Stripe API are made from that sandbox with the permissions you approved. The calculation of a payout waterfall, fee burn, foreign-exchange fees, and dispute aging happens in that session. It is ephemeral. When you close the view, the working set is discarded. Sentinel does not receive a stream of those API responses on its own systems.
3. Permissions and Stripe objects the App reads
The install requests four read permissions and no write permissions. The App cannot create a refund, pay out funds, edit a charge, or change a dispute.
| Permission | Why it is requested |
|---|---|
| balance_read | Read the current balance, pending amounts, and reserve balances, and list balance transactions. |
| payout_read | Read payouts so a bank payout can be rebuilt from the balance transactions assigned to it. |
| charge_read | Read charges and refunds so a refund can be tied to its charge and the fee on that charge can be measured. |
| dispute_read | Read disputes so holds, dispute fees, and releases after a won dispute can be timed. |
Under those permissions the App reads these native Stripe objects, and only the fields the tie-out uses:
- Balance. Available, pending, Connect reserved, and dispute-prefunding amounts, with their currencies.
- Balance transactions. Identifier, amount, fee, net, currency, type, reporting category, fee details, created time, available-on time, source identifier, payout identifier, description, and a posted exchange rate when Stripe includes one.
- Payouts. Identifier, amount, currency, status, whether the payout is automatic, created time, arrival date, method, and description.
- Charges. Identifier, amount, currency, and the expanded balance transaction that carries the fee basis. The App uses those fields to measure fees. It does not use a cardholder name, email, billing address, or card last4.
- Refunds. Identifier, amount, currency, and the charge the refund belongs to, so a refund row can be linked and a retained fee can be measured.
- Disputes. Identifier, amount, currency, status, reason, the evidence due-by time, and the balance transactions on the dispute.
The App does not request customer_read or any permission whose purpose is to collect a cardholder’s contact details. It does not read Customers, PaymentMethods, or external bank-account objects as part of the audit.
4. Card numbers, cardholder data, and bank credentials
Sentinel does not collect credit card numbers, card security codes, or bank account credentials. Stripe does not provide a primary account number or a bank login to a Stripe App, and the App does not ask you for either.
A charge object returned by Stripe can contain billing details and a card brand or last4 even when an app does not use them. Sentinel does not copy those fields into the waterfall, does not display them, and does not transmit them to a Sentinel server. If Stripe includes them in an API response inside the sandbox, they stay in that session and are discarded with it.
The App does not collect a cardholder’s name, email, phone number, or shipping address for its own purposes. It does not build a marketing list from your buyers.
5. Storage, logging, and retention
The gross-to-net math, the fee-burn calculation, the foreign-exchange fee totals, and the dispute-aging check run client-side in the Stripe App sandbox. That is ephemeral compute inside the Dashboard session. Sentinel does not store or log balance transactions, payouts, charges, refunds, disputes, fee amounts, or waterfall results on Sentinel servers.
There is no Sentinel database of your ledger. There is no backup of it, and there is no analytics pipeline fed by it.
The only account record a paid subscription uses is the merchant’s Stripe account identifier and the billing subscription status (for example, active, past due, or canceled), together with the plan name and the dates needed to know that status. That record does not include financial transaction data. No payout, charge, refund, dispute, or balance transaction is attached to it.
The free install does not create that billing record, and the current App does not charge a card. Until you start a paid subscription, Sentinel keeps no account-identifier record and no subscription-status record of its own. Stripe still knows the App is installed, because Stripe is the platform. That installation record is Stripe’s, and it is governed by Stripe’s privacy policy.
The public support form at /support is separate from the App. It asks for your name, email, phone, company, and message, and emails that note to the operator. Sentinel does not put that message in a ledger database. The copy that remains is the email in the operator’s mailbox. Do not send card numbers or bank credentials through the form.
If a paid subscription later exists, Sentinel keeps the account identifier and subscription status only while the subscription is active and, if a tax authority requires a record of the subscription charge, for the period that law requires. That retained record is the account identifier, plan, status, amount, and dates. It is not a copy of the ledger. Stripe processes the payment and holds the payment-card data. Sentinel does not receive the card number and does not keep a second copy of the card charge.
6. Why the data is used
Inside the session, the objects in section 3 are used only to:
- rebuild one payout into a gross-to-net waterfall and test whether the variance is exactly zero;
- measure Stripe fees that refunds did not return;
- total posted conversion and cross-border fees, without estimating a markup from an exchange rate;
- show dispute holds and whether funds from a won dispute remain unreleased after 48 business hours;
- let you copy a ledger note to your clipboard. The note stays in the Dashboard. If the clipboard is blocked, it stays on screen in that session.
Where the GDPR or UK GDPR applies, the legal bases are these. Providing the audit you installed is performance of the contract with the merchant. Keeping a minimal subscription record, once a paid plan exists, is performance of that contract and, where an invoice must be retained, compliance with a legal obligation. Sentinel does not rely on consent for the ledger read, because the read is the service you installed and it is not stored.
Sentinel does not use Stripe data to train a model, to advertise to your buyers, or to score consumers.
7. Sharing
Merchant financial data is not sold. It is not shared with data brokers. It is not rented, and it is not exchanged for anything of value. Sentinel does not “share” personal information for cross-context behavioral advertising, as that term is used in the California Consumer Privacy Act.
The parties that process data in connection with Sentinel are:
- Stripe. Stripe hosts the Dashboard, runs the App sandbox, enforces the read permissions, and is the API that returns the objects in section 3. If you subscribe to a paid plan, Stripe processes the subscription payment. Stripe’s privacy policy and the Stripe agreement you already have govern Stripe’s processing. Sentinel does not send your ledger from the sandbox to a second Stripe account of its own.
- Vercel, Inc. Vercel hosts this public website. Vercel may keep standard connection logs for the Site, such as IP address, user agent, and the time of a request. Those logs are not Stripe ledger data. The App does not send payouts, charges, refunds, disputes, or balance transactions to Vercel.
- Google Fonts. The Site loads typefaces from Google. That request can send your IP address to Google. The App does not load Google Fonts and does not send Stripe data to Google.
- Amazon SES. A message submitted on the support form is sent as email from alerts@mavex.live through Amazon Simple Email Service. The message contains the name, email, phone, company, and text you typed. It does not contain Stripe ledger objects. Amazon Web Services processes that email in transit. The App does not use SES.
Sentinel does not use an analytics product, an advertising pixel, or a session-replay tool on the App or the Site. A government authority can compel a host or Stripe under applicable law. If that happens, the request goes to the party that holds the data. Sentinel cannot produce a ledger archive it does not have.
8. Uninstall, deletion, and your rights
You uninstall the App in the Stripe Dashboard. Stripe revokes the App’s access immediately. From that moment the App cannot read balance transactions, payouts, charges, refunds, or disputes on the account.
Because Sentinel does not keep those objects, uninstalling does not leave a Sentinel copy behind, and there is no ledger to purge. The session you had open ends with the Dashboard.
If a billing record exists (Stripe account identifier and subscription status only), Sentinel cancels the subscription with Stripe and deletes that record within 30 days of uninstall, except for the limited tax record described in section 5. That exception, when it applies, is deleted at the end of the legal period. You can ask for deletion sooner, and Sentinel will delete anything it is not required to keep.
If the GDPR, the UK GDPR, or a similar law applies, you can ask the controller to:
- confirm whether Sentinel holds a billing record for your Stripe account, and for a copy of it;
- correct a subscription status that is wrong;
- delete that record, subject to a legal retention duty;
- restrict or object to processing that is not required to provide the App or to meet a legal duty;
- receive the billing record in a portable form, where the law gives you that right;
- lodge a complaint with the supervisory authority where you live or work, or where the controller is established. The controller’s lead authority will be named here once [Country] is filled in. You can also complain to Stripe about data Stripe holds.
Sentinel will respond within one month, or within the shorter period a local law requires. Sentinel may ask you to show that you control the Stripe account, because the account identifier is the record. For the ledger itself, Stripe is the party that holds it. A request for payout or charge history should be made to Stripe as well as to Sentinel. Sentinel will tell you if it has nothing to produce.
If the California Consumer Privacy Act applies, a California resident, or an authorized agent with signed permission, may ask to know, delete, and correct the personal information Sentinel holds. Sentinel will not discriminate against you for making a request. Sentinel does not sell or share personal information, so there is no sale to opt out of. Sentinel does not use sensitive personal information to infer characteristics. To submit a request, use the contact in section 11. Sentinel will verify the request against control of the Stripe account.
9. International transfers
The App does not transfer your ledger to Sentinel, so Sentinel does not move that ledger to another country. Stripe processes account data in the regions described in Stripe’s own documentation, under your agreement with Stripe.
The Site is hosted by Vercel and may be requested from more than one country. Connection logs for the Site are Vercel’s processing, not a transfer of Stripe objects. If the controller named in section 1 is outside the country where you operate, the only Sentinel record that could be held there is the billing record in section 5, and only after a paid subscription exists.
10. Security
Access is limited to the four read permissions in section 3. The App runs in Stripe’s sandboxed extension runtime, which is isolated from the rest of the Dashboard page. There is no Sentinel credential stored in the merchant’s browser for a back-end ledger, because there is no such back end.
No security measure is absolute. The practical limit here is that a copy Sentinel does not have cannot be taken from Sentinel. Your Stripe account’s own administrators, roles, and login security remain the control on who can open the App.
11. Contact
Privacy requests, including access, correction, deletion, and uninstall questions, go to the support form. Postal address: [Street, city, postal code, country]. Put the Stripe account identifier in the request if you have it, and do not send card numbers or bank credentials. Sentinel does not need them and does not want them.
Dashboard users are acting for the merchant. The merchant is responsible for having a lawful basis to let those users open Stripe data in the Dashboard, including this App.
12. Children
The App and the Site are for businesses. They are not directed at children, and Sentinel does not knowingly collect personal information from anyone under 16.
13. Changes
If this policy changes, the new version will be posted at https://stripesentinel.com/privacy and the effective date above will change. If a change would cause Sentinel to store payout, charge, refund, dispute, or balance-transaction data, or to request a new Stripe permission, Sentinel will post that change before it takes effect and will describe it in the Stripe App listing. Continued use after the effective date is how a merchant accepts a change that does not expand storage of the ledger. A change that does expand that storage will not apply to an installed account until the merchant has the notice above.