Privacy Policy

Introduction

This Privacy Policy describes how FLARES Inc (doing business as "Rebutiq"), a Nigerian company operating through its US subsidiary FLARES Network Systems, Inc., collects, uses, stores, and discloses information in connection with the Rebutiq automated dispute defense platform (the "Service"). This policy applies to merchants who create accounts on Rebutiq ("Merchants"), as well as to the end-users of Merchants' websites and applications whose data is collected through the Rebutiq JavaScript SDK and REST API ("End-Users").

By using our Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy should be read alongside our Terms of Service.

Information We Collect

Merchant Account Information

When you create a Rebutiq account, we collect information necessary to provide the Service and manage your subscription:

• Full name and email address
• Company or business name
• Business website URL
• Payment information (processed and stored by Stripe; we do not store full card numbers)
• Stripe API keys (stored in hashed form)
• Business policies (refund policy, terms of service, shipping policy) that you provide for evidence compilation

End-User Behavioral Data (via SDK)

When a Merchant integrates the Rebutiq JavaScript SDK or uses the REST API, we collect the following data from the Merchant's End-Users for the sole purpose of building dispute evidence:

• Page views — URLs visited, page titles, referrer URLs, and timestamps
• Click events — Element identifiers, button text, and link destinations
• Session data — Session identifiers, session start/end times, and total session duration
• Form interactions — Form submission events and field names (we do not capture field values for sensitive fields such as passwords or payment details)
• Scroll depth — Maximum scroll percentage reached on each page
• IP address — Used for geolocation and to corroborate shipping address verification
• Device information — Device type, operating system, screen resolution, and browser name/version (derived from user agent string)
• Timezone and language — Browser timezone setting and preferred language

Stripe Data

When you connect your Stripe account, we access the following data through the Stripe API, limited to what is necessary for dispute defense:

• Customer IDs and associated email addresses
• Charge IDs, amounts, currency, and timestamps
• Dispute details including reason codes, amounts, status, and evidence deadlines
• Payment method metadata (card brand, last four digits, country of issue)

Usage Data

We automatically collect information about how you interact with the Rebutiq dashboard and API:

• Dashboard activity (pages visited, features used, settings changed)
• API call logs (endpoints called, request timestamps, response codes)
• Login timestamps and IP addresses

How We Use Information

We use the information we collect for the following purposes:

• Dispute Defense — To compile behavioral evidence, transaction records, and contextual data into structured evidence packages for submission to Stripe in response to payment disputes.
• Evidence Generation — To feed anonymized dispute context into AI models (Groq/Llama) that generate human-readable evidence narratives summarizing end-user activity and transaction legitimacy.
• Risk Scoring — To analyze dispute patterns, behavioral signals, and transaction attributes to assign risk scores that help determine the likelihood of winning a dispute.
• Auto-Refund Decisions — If enabled by the Merchant, to use risk scores and dispute analysis to automatically issue refunds on charges that are assessed as highly likely to be lost, reducing dispute rate impact.
• Service Improvement — To analyze aggregate, de-identified usage patterns to improve the accuracy of our evidence generation, optimize our risk scoring models, and enhance the overall Service.
• Account Management — To manage your subscription, process payments, send transactional communications (receipts, dispute notifications, evidence submission confirmations), and provide customer support.
• Security — To detect and prevent fraud, abuse, and unauthorized access to the Service.

Data Sharing

We do not sell your personal data or your End-Users' data to third parties. We share data only in the following limited circumstances:

Stripe

We submit compiled evidence packages to Stripe through their Disputes API on your behalf. This evidence may include behavioral data, transaction details, and AI-generated narratives. This sharing is necessary to perform the core function of the Service.

AI Service Providers

We send anonymized and contextual dispute data to Groq (our AI inference provider) to generate evidence narratives. Data sent to Groq does not include directly identifying personal information of End-Users. We have data processing agreements in place with our AI providers that prohibit them from using your data for training or any purpose other than providing inference services to us.

Legal Compliance

We may disclose information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud.

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data becomes subject to a different privacy policy.

Data Retention

We retain data for the minimum period necessary to fulfill the purposes described in this Privacy Policy. Specific retention periods are as follows:

You may request earlier deletion of your data at any time by contacting us at legal@flaresinc.com. We will process deletion requests within 30 days, subject to any legal obligations that require us to retain certain data.

Data Security

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encryption at Rest — All sensitive data is encrypted at rest using AES-256-CBC encryption.
• Encryption in Transit — All data transmitted between your browser, our servers, and third-party services is encrypted using TLS 1.2 or higher.
• API Key Security — Stripe API keys and other sensitive credentials are stored in hashed form and are never exposed in plaintext through the dashboard or API.
• Access Controls — Access to production data is restricted to authorized personnel on a need-to-know basis, with all access logged and audited.
• Infrastructure Security — Our infrastructure is hosted on secure cloud providers with SOC 2 compliance, regular vulnerability assessments, and automated security patching.

While we strive to protect your data using commercially reasonable measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly notifying affected users in the event of a data breach, in accordance with applicable law.

Merchant's Responsibilities

When you integrate the Rebutiq SDK into your website or application, you act as the data controller for the End-User data collected through the SDK, and Rebutiq acts as a data processor on your behalf. As the data controller, you are responsible for:

• Privacy Policy Disclosure — Maintaining a privacy policy on your website that clearly informs your End-Users about the data collected through the Rebutiq SDK, the purposes of that collection, and how they can exercise their privacy rights.
• Consent Management — Obtaining any consents required by applicable law (including GDPR, CCPA, and other privacy regulations) before deploying the SDK and collecting End-User data.
• Data Subject Requests — Facilitating and responding to End-User requests to access, correct, or delete their data. You may contact us at legal@flaresinc.com to assist with fulfilling such requests for data we hold as your processor.
• Lawful Use — Ensuring that your use of the Rebutiq SDK and the data collected through it complies with all applicable laws and regulations in the jurisdictions where your End-Users are located.

Cookies & Tracking

The Rebutiq JavaScript SDK does not use cookies to track End-Users. Instead, the SDK generates a session identifier that is stored in memory for the duration of the browser session and is not persisted across sessions or shared with any third party.

The SDK does not perform cross-site tracking. It only collects data on the specific website or application where it has been installed by the Merchant. No data is shared between different Merchants' installations.

The Rebutiq dashboard (the Merchant-facing web application) may use essential cookies for authentication and session management. These cookies are strictly necessary for the operation of the dashboard and do not track you across other websites.

International Data Transfers

FLARES Inc is headquartered in Nigeria, with a US subsidiary (FLARES Network Systems, Inc.) handling support operations. Data collected through the Service is stored on servers located in the United Kingdom and may be processed in both the UK and the United States in the course of providing the Service.

By using the Service, you consent to the transfer of your data to the UK and US. If you are a Merchant with End-Users in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require specific legal mechanisms for international data transfers, you are responsible for ensuring that you have an appropriate lawful basis for transferring End-User data through the Service.

Children's Privacy

The Service is not directed at, and is not intended to collect data from, children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as promptly as possible.

If you are a Merchant whose website or application is directed at or used by children under 13, you must not deploy the Rebutiq SDK on those pages or sections of your site. If you believe that we have collected data from a child under 13, please contact us immediately at legal@flaresinc.com.

Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. We are committed to honoring these rights to the extent required by applicable law:

• Right of Access — You may request a copy of the personal data we hold about you, including any End-User data we process on your behalf as a Merchant.
• Right to Correction — You may request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Deletion — You may request that we delete your personal data from our systems, subject to any legal obligations that require us to retain certain records.
• Right to Data Portability — You may request a machine-readable export of the personal data you have provided to us, including behavioral data and dispute records.
• Right to Object — Where we process your data based on legitimate interests, you may object to such processing, and we will cease processing unless we have compelling legitimate grounds.
• Right to Restrict Processing — You may request that we restrict the processing of your data in certain circumstances, such as while we verify the accuracy of data you have contested.

To exercise any of these rights, please contact us at legal@flaresinc.com. We will respond to all verified requests within 30 days. We may ask you to verify your identity before processing your request.

Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will provide at least thirty (30) days' prior notice by sending an email to the address associated with your account and by posting the updated Privacy Policy on the Service with a revised "Last updated" date.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you should discontinue your use of the Service before they take effect.

Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

FLARES Inc (Parent Company)
27 Awoyemi Street, Ejugbo, Lagos, Nigeria
Phone: +234 201 330 6352

FLARES Network Systems, Inc. (US Support Branch)
1111B S Governors Ave STE 21292, Dover, DE 19904 US
Phone: +1 (608) 925-2262

Legal: legal@flaresinc.com
Support: support@flaresinc.com