Privacy Policy

Dispute Daddy is a product of ScryOS, Inc. (“ScryOS”, “we”, “us”). This policy explains what we collect when you visit disputedaddy.ai, join our early-access list, or use the Dispute Daddy application at app.disputedaddy.ai, and how we handle it.

Dispute Daddy handles sensitive business records. Merchants upload receipts, agreements, customer messages and, for healthcare businesses, records that can include protected health information. We built the product to keep those records private, use them only to prepare your dispute responses, and never sell them.

1. Who this policy covers

• Website visitors to disputedaddy.ai.
• Early-access sign-ups who leave an email address.
• Customers (merchants) who use the Dispute Daddy application, and the people they invite to their workspace.
• People whose information appears in a merchant’s records, such as the merchant’s customers or patients. For those records, the merchant decides what to upload and why. We process the records on the merchant’s behalf and under the merchant’s instructions.

2. The website and early-access list

• What we collect: if you join the early-access list, we collect your email address and, if you give it, your company name, along with the time you signed up.
• Analytics: we count page visits with Cloudflare Web Analytics, which uses no cookies and doesn’t identify individual visitors. The website uses no advertising trackers and no marketing cookies. The Dispute Daddy application has no analytics.
• Abuse protection: to protect the signup form we keep short-lived counters derived from your IP address. They are pseudonymized with a keyed hash and deleted after about ten minutes. We don’t store your IP address itself.
• Use: we use your email only to contact you about early access to Dispute Daddy. We don’t add you to unrelated marketing, and we don’t sell or share the list.
• Removal: email privacy@disputedaddy.ai and we will delete your entry.

3. What the application collects

• Account information: your name, email address, business name and workspace settings.
• Billing information: handled by Stripe. We receive your subscription status and limited card details, such as the card brand and last four digits. We never see or store your full card number.
• Dispute records you upload: dispute notices, receipts, invoices, agreements, delivery or service records, customer messages and similar documents. They may contain personal information about your customers or patients.
• What we create from your records: extracted text, classifications, findings, draft responses, packets, your edits and approvals, and the outcomes you record.
• Usage and security logs: sign-ins, actions taken in your workspace and audit records, kept to secure the service and to show who did what.

4. How we use it

• We use your records to provide the service: reading your documents, organizing evidence, checking it against dispute requirements, drafting responses for your review, tracking deadlines and outcomes, and sending you service emails such as deadline reminders.
• We use your records to improve results inside your own workspace.
• We don’t use your records to train models for other customers.
• We don’t sell personal information.
• We don’t submit anything for you. You review and approve every response, and you submit it to your processor yourself.

5. AI processing

Dispute Daddy uses AI models to read documents and draft responses. These run on Amazon Web Services (Amazon Bedrock and Amazon Textract) in the United States. For some bounded classification steps we also use OpenAI’s API, under a business associate agreement between ScryOS and OpenAI. AI providers process your records only to return results to us and, under our agreements with them, don’t use your records to train their models.

6. Health information (HIPAA)

If your business is a HIPAA covered entity, such as a dental, medical or aesthetics practice, we act as your business associate. You accept our Business Associate Agreement during subscription, before you upload records. Protected health information stays on HIPAA-eligible services covered by our own business associate agreements and is encrypted in transit and at rest. Please upload only what a dispute needs.

7. Service providers

We require each provider to protect the data and to use it only to provide its service to us.

8. Where data is stored and how long we keep it

• Application data is stored and processed in the United States.
• We keep your workspace data while your account is active.
• You can delete your workspace in Settings. That erases cases, files, packets, approvals, tracking entries and audit records within about 15 minutes; database backups that already contain the data expire within 7 days.
• Security audit logs are kept for six years in protected storage, as HIPAA documentation rules require.

9. Security

We use encryption in transit (HTTPS only) and at rest, private storage that isn’t reachable from the internet, databases that require encrypted connections, and access logging with an audit trail. No system is perfectly secure; we will notify you of a security incident affecting your data as the law and our agreements require.

10. Your choices and rights

• You can access, export, correct or delete your account data.
• If you are a customer or patient of a merchant that uses Dispute Daddy, please contact that merchant about its records. We will help them respond.
• Depending on where you live, you may have additional rights under your state’s privacy law. Contact us to use them; we won’t discriminate against you for doing so.

11. Children

Dispute Daddy is a business service. It is not directed to children, and we do not knowingly collect children’s information.

12. Changes and contact

If we change this policy, we will update the effective date, and we will notify customers before a material change takes effect. Questions or requests: privacy@disputedaddy.ai. ScryOS, Inc.