Ooof, this is a deep topic and people bleed all over it when running a SaaS company. I used Pin Payments (nee Spreedly Subscriptions) for Appointment Reminder. You will probably end up using Stripe's subscription feature, which has some (but not all) of this logic baked in.<p>> What happens when credit card is declined<p>You retry the card on three consecutive days (many declines are due to network or balance issues) then start emailing the customer about it. After a few emails you escalate to phone calls. Except, you don't do this -- you use Churnbuster to do this, because for a pittance they will make you thousands of dollars a month at scale. (Churnbuster assumes you're going to be using Stripe... but you should use Stripe.)<p>> What happens when they downgrade the subscription<p>Judgment call here: do you want to do a pro-rated refund or a pro-rated account credit? e.g. If someone changes from a $100 plan to a $25 plan halfway through the month, we observe that they've consumed $50 worth of services and have $50 remaining, which we could either a) send them back on their CC and bill them normally from here out or b) give them an account credit for $50, which will cover their next two months of service, then bill them normally.<p>The case for the account credit is largely "it optimizes for your cash-flow management as opposed to their cash-flow management." (This can be important in corner cases like e.g. switching from $5.5k for 12 months to $1k per month in month 2. Which, by the way, annual to monthly pro-ration logic is something you're going to probably have to write.)<p>> How long should the data be retained in a suspended account<p>Judgment call; I default to "indefinitely unless legally required otherwise or requested otherwise." Many customers will come back to you a year later and _expect_ that you still have their account on file. Customers who are more privacy conscious will tell you; you can delete their account then. (Note that deleting an account is largely a feel-good measure for the customer and accomplishes epsilon from the privacy perspective. There are probably 1+ people reading this who disagree with this assertion, so riddle me this: what happens to our last 2 years of backups when I delete an account? Do I re-hydrate all of them, run the delete SQL, then re-backup and blow away the old version? Nope. Do I toss 2 years of backups because a $29 account churned? Umm, nope. We have your data at least as long as our data recovery window <i>and it is probably recoverable for longer than that</i>, and us deleting an account does not change that.)