The cloud functions that add the claim also remove it using the customer.subscription.updated event. I just did some experimenting to make sure I understood everything correctly, and that is what I found. Also, if you do a refund make sure to cancel the subscription also, that way it doesn't charge again and they do not keep access (unless you want that of course).