Privacy

Last updated November 13, 2026.

WinCustomersBack.com helps businesses contact their own past customers. A business uploads or connects its customer records, and we process them only to find inactive customers, send the reactivation messages the business sets up, stop outreach when customers return, and report the results.

Who is responsible for customer records

Customer records belong to the business that provides them. The business decides whom to contact and is responsible for having the right to do so; we process those records on its behalf and only to provide the service. We never sell customer records, never use one business's records for another, and never message a contact who has unsubscribed or been suppressed.

What we collect

• Business accounts: name, email address and password (stored only as a secure hash) for each team member, plus business profile details such as business name, postal address, website, timezone and sender name.
• Customer records a business provides: names, email addresses, phone numbers, activity and purchase dates, purchase values, tags, locations, and consent and opt-out status.
• Messages and email events: the messages sent, and delivery events reported by our email provider, such as delivered, bounced, spam complaints and unsubscribes. Clicks on the links in our emails, and opens where the email provider reports them, are recorded so a business can see results.
• Returns and revenue: purchases, bookings or visits a business records through an integration, the API or manually, used to stop outreach and report recovered revenue.
• Usage and security information: for signed-in sessions, the IP address and browser type; a log of important account, billing and campaign actions; and, for the contact form on our website, a one-way hash of the IP address rather than the address itself.
• Billing: plan, subscription status and invoice references from Stripe. Card details are entered on Stripe's pages and never reach our servers.

Service providers

We use a small number of providers to run the service, and each receives only what it needs. Cloudflare hosts and serves the application. Neon provides our PostgreSQL database. Stripe handles subscription billing. Resend delivers email. If a business turns them on, Twilio delivers text messages, Postmark receives customer email replies, and Square syncs customers and payments.

Cookies

We use only the cookies needed to keep you signed in, protect forms against forgery, and show one-time notices. We do not use advertising or cross-site tracking cookies, and we do not add analytics scripts to our pages. Our hosting provider may set a strictly necessary security cookie to protect the site from abuse.

Retention and deletion

Uploaded CSV files are deleted 3 days after import (or 7 days if an import is never started). Data exports expire after 7 days. Sign-in sessions expire after 30 days. Businesses can export their data or delete their account at any time from Help & account. Deletion permanently erases customer records, campaigns and messages after a 14-day grace period that can be cancelled; billing and audit records are kept where the law requires it.

Your requests

Business users can view and update their account and business details in Settings, export their data, and delete their account. Customers of a business can stop emails at any time with the unsubscribe link in every message, and texts by replying STOP. For any other request about personal data, contact support@wincustomersback.com. If you are a customer of a business that uses WinCustomersBack, we may refer your request to that business.

Contact

Questions: support@wincustomersback.com.