How WinPacket handles your data

1. What this covers

This policy explains what information WinPacket collects when you use winpacket.shabsand.com, why we collect it, who we share it with, how long we keep it, and how you can delete it. It is written to match what the product actually does.

2. Account data

To sign in we store your email address, an optional display name, the name of your workspace and store(s), and session records. We do not store passwords; sign-in uses one-time links sent by email. We record basic usage events (for example that a packet was generated or exported) and purchase records so we can honor what you paid for.

3. Dispute and evidence data

To build a packet you enter dispute facts (order details, customer name and contact details, addresses, payment verification results, tracking information, communication summaries) and may upload or paste evidence (emails, tracking records, screenshots, invoices, logs). This can include personal data about your customers. You are responsible for having a lawful basis to use it for responding to a dispute; responding to a chargeback is a normal part of processing the payment the customer made.

Evidence files are stored privately per workspace and are served only to signed-in members of that workspace. They are not public, not listed, and not shared with other customers.

4. Third-party AI providers

To draft the written parts of a packet (summary, response to the claim, letter), WinPacket sends the dispute facts, your store policies and the text of your evidence to an AI model provider (currently Anthropic). Uploaded image and PDF files are not sent to the AI provider; only text you entered or pasted is. We use the provider's commercial API, whose terms state that API inputs and outputs are not used to train their models. The checklist, strength score, exhibit order and field mapping are computed by WinPacket's own rules and are not produced by the AI model. WinPacket does not use your data to train any AI model.

5. Email provider

Sign-in links and account emails are delivered through Resend. Resend processes your email address and the message content for delivery.

6. Payment provider

Payments are processed by PayPal. WinPacket never sees or stores your card number. We store the PayPal order and capture identifiers, the amount, the status of the payment and the payer email PayPal returns to us, so we can grant and support your purchase.

7. Hosting and infrastructure

The application, its database and uploaded files are hosted on Railway. Traffic is encrypted in transit (HTTPS). Access to production systems is limited to the people operating WinPacket.

8. Retention

Disputes, packets and evidence stay in your workspace until you delete them. Sign-in tokens expire after 15 minutes and sessions after 30 days. Purchase records are kept as long as needed for accounting and dispute support. Server logs that may contain request metadata are kept for a limited period for security and debugging.

9. Deletion

You can delete any dispute, including every packet and uploaded file attached to it, from the dispute page. You can delete your entire workspace, including all disputes, files, memberships and, if it is your only workspace, your account, from Settings. Deletion is immediate and cannot be undone. Backups may retain copies for a short period before they are rotated out.

10. What we do not do

We do not sell personal data. We do not use your evidence for advertising. We do not submit anything to your payment processor; you upload packets yourself. We do not claim any security or compliance certification; we apply reasonable technical measures appropriate for a small service and describe them honestly here.

11. Your rights

Depending on where you are, you may have rights to access, correct, export or delete your personal data. Most of this you can do yourself inside the product. For anything else, email winpacket@shabsand.com and we will respond within a reasonable time.

12. Changes

If this policy changes in a way that matters, we will update the date above and, for significant changes, notify account holders by email.