1. Disconnect Stripe in Seedling
- Sign in to the Seedling workspace as a current workspace administrator.
- Open Apps or Connections, select the exact Stripe workspace connection, and choose Disconnect.
- Confirm the request. Seedling immediately fences new provider calls, captures the exact connection and source targets, deletes active credentials and Marketplace routing if present, revokes declared grants, and starts a durable exact-source purge even if Stripe is unavailable.
- Wait for the disconnect operation to report completion before creating a replacement connection. Reinstallation starts with new credentials, cursors, receipts, staging, and grants; it does not resurrect purged data.
2. Retire access in Stripe
For the implemented customer-managed mode, delete the restricted API key in the exact Stripe account and environment after local disconnect. Provider-side key deletion stops future API calls but does not notify Seedling to purge synchronized data, so both steps are required.
When Marketplace mode is released, uninstall the Seedling app in Stripe as well as disconnecting locally. A valid signed account.application.deauthorized event will run the same idempotent cleanup for the exact account and environment, but Seedling's local purge never waits for that callback. The final uninstall/revocation behavior remains a launch-verification gate.
3. Request deletion without workspace access
Email privacy@tryseedling.ai from a work address associated with the organization. Include the organization name, Seedling workspace name if known, Stripe account ID, environment, and your authority to request deletion. Never include a restricted key, customer or billing content, provider response, or identity document unless Seedling provides a secure method.
Seedling verifies identity and authority before acting and will explain any information needed to locate the tenant safely.
4. What the purge removes or redacts
The purge uses captured exact connection and source identifiers. Seedling does not delete by provider kind, account email, or a broad account heuristic, and disconnecting never modifies the original data in Stripe.
- Restricted keys, future OAuth access and refresh tokens, refresh state, Marketplace route, webhook receipts, capability records, connection policies, declared data-type scopes, member grants, and audience contributions.
- Every Stripe source, observation, typed staging row, event, synchronization batch and cursor, projected customer, product, subscription, invoice, payment, refund, dispute, credit-note, and payout object.
- Source objects, chunks, embeddings, identifiers, and Stripe-linked activity, fieldwork, chat messages and citations, exploration artifacts, proposals, verification evidence, and affected run context covered by the shared purge contract.
- Provider-derived content in retained approved decision or materialization records, while preserving only the bounded review or materialization fact required by the applicable audit contract.
5. What may remain
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion. It is deleted again if a backup is restored for disaster recovery.
- Lifecycle audit
- Seedling may retain workspace and connection identifiers, action, outcome, bounded reason codes, and timestamps needed to demonstrate deletion and protect the Service. These records contain no Stripe credential, webhook body, or billing content.
- Legal and security records
- Limited non-content records may remain longer when required for security, fraud prevention, disputes, accounting, or law.
6. Confirmation and related guidance
Seedling will confirm receipt of an emailed deletion request and provide a completion or decision notice after verification and processing. Questions may be sent to privacy@tryseedling.ai; product troubleshooting may be sent to support@tryseedling.ai.