Privacy Policy
Version 2026-10-07.
1. Who we are
Thaw is a revenue-recovery service for subscription businesses (“merchants”), operated by Pine Creative Inc. o/a Thaw Payments, a corporation based in Canada. For a merchant's customer data, the merchant is the data controller and the Company is a processor acting on the merchant's instructions — see the DPA.
2. Data we process
For merchants: account details, business name, contact email, and payment method for fees. For merchants' customers: name, email, subscription and payment-status metadata (e.g. amount, decline reason, invoice identifiers) obtained via the merchant's Stripe connection — used solely to recover payments on the merchant's behalf.
3. How we use it
To detect at-risk payments, generate and send recovery communications, re-attempt charges within card-network rules, attribute recoveries, bill fees, and secure and operate the service.
4. Card data
Card details are handled by Stripe. Thaw does not store full card numbers. Merchant fee cards are collected via Stripe and stored as Stripe payment methods.
5. Retention & deletion
End-customer personal data is retained while the merchant is connected and for 90 days after disconnection, then scrubbed. While a merchant is connected, a customer's contact details on a settled case are scrubbed 13 months after it settles, and raw payment-event data from Stripe is reduced to non-identifying reference ids 90 days after it is processed. Recovery and fee records are retained as needed for accounting and legal obligations. You may request earlier deletion — see below.
6. Your rights
Depending on your location, you (or a merchant's customer, via the merchant) may have rights to access, correct, delete, or restrict processing of personal data. Requests are routed through the merchant as controller; contact privacy@thawpayments.com. A merchant can erase a specific customer's personal data on demand from their account, which scrubs that person's identifying data across our event, action, and suppression records immediately while retaining the underlying financial record required for accounting. An erased customer's details are not stored again in their case records: we keep only one-way fingerprints of their identifiers to honour the erasure. Raw payment-event data about them that Stripe sends afterwards is kept no longer than 90 days. Every erasure is audit-logged against a hash of the email rather than the address itself.
7. Subprocessors
We use infrastructure and service subprocessors (e.g. hosting, database, email delivery, payment processing, AI text generation, and analytics). A current list is available on request and maintained in the DPA. Google Analytics is used for marketing-site measurement only, as described below. The AI provider that drafts recovery emails receives no customer name, email address or payment link: those are filled in after the text is written. Error reports sent to our error-monitoring provider have email addresses, phone numbers, payment identifiers and link tokens removed, and never include form contents or cookies.
8. Cookies & analytics
Our public marketing pages (home, how it works, trust, status, login, the waitlist and the legal pages) use Google Analytics to measure traffic and understand how visitors find us. It runs only if you accept it: no analytics cookie is set and no analytics script is loaded until you choose “Accept” on the consent banner, and declining is offered on equal terms. Analytics never runs inside a merchant account, and never on the payment or unsubscribe pages a merchant's customers visit. We strip query parameters other than campaign tags before sending a page view, so account identifiers are not shared. You can withdraw consent at any time by clearing this site's data in your browser, which restores the banner.
9. Contact
Pine Creative Inc., 350 Bay St, Suite 1300B, Toronto, ON M5H 2S6, Canada. Questions: privacy@thawpayments.com.
Last updated: 2026-10-07.