E-Mail-Address associated with SEPA mandate not updated

[cbiere]

In 2020 an SEPA mandate was created with my old email address. Since then, about two years ago, my liberapay account is not associated with the old email address anymore. The SEPA mandate seems to be handled by Stripe. I just noticed that I received an email informing about an upcoming payment to the old email address. The link to the SEPA mandate information does not show any email address but my name, address and IBAN - all of which is valid and unchanged.

It seems to me that my email address was not updated with respect to the existing SEPA mandate. Is that a bug or a feature? I understand that I can invalidate the mandate and create a new one. Just wanted to know if that is normal behaviour. According to my email archive, I have not received mails from stripe to my old address recently, even concerning liberapay.

Also the link in the email from Stripe exposes my fullname, address and IBAN. So if I had actually lost access to that old email address, someone could have received this information. This leds me to believe it's not intended behaviour.

The link looks like this (cut-off, of course):
https://payments.stripe.com/sepa_debit/mandate/[...]

[Changaco]

This problem is a side effect of Stripe forcing us to migrate to a different API last year (#2374). Before that, Stripe didn't send email notifications to Liberapay users, so it didn't really matter if some of the email addresses in their database were obsolete.

I'll try to fix this mess as soon as possible.