Privacy policy

When you create an account:

• Your email address — used to sign in and to contact you about your account.
• Your password — stored hashed. The original is never stored and nobody can read it back.
• Your last sign-in time and the session's IP address — used to spot unusual access.

When you use the service:

• The wallet addresses you enter — they are yours; the system only reads them and never holds your private key.
• Invoice data: transaction ID, amount, status, network, and the order ID you send us.
• Callback logs: the address called, the status returned, and the error from each attempt.
• Third-party API keys you enter (Binance Merchant, for example) — encrypted with AES-256-GCM before storage.

Không thu thập số thẻ ngân hàng, số tài khoản ngân hàng, giấy tờ tùy thân, private key hay cụm từ khôi phục ví. Hệ thống không có chỗ nào để nhập những thứ đó, và không nhân viên nào được phép hỏi bạn.

No third-party advertising trackers, no selling of data, nothing shared with data brokers.

Only two cookies, both strictly necessary: one for your login session, one to remember your language. No advertising or behavioural tracking cookies.

To read blockchain data the system calls public node providers. Those calls carry only public wallet addresses and none of your personal information.

If you enable Google sign-in, Google gives us your verified email address. If you connect Discord or Telegram notifications, the message content goes to the channel you chose.

If you use the support chat, what you type is sent to a language-model provider to produce the answer. Do not paste passwords, API keys or personal data into it.

Dữ liệu hóa đơn và giao dịch được giữ trong suốt thời gian tài khoản còn hoạt động, vì bạn cần chúng để đối soát. Phiên đăng nhập hết hạn tự động. Xóa tài khoản thì dữ liệu cửa hàng, hóa đơn và ví đi kèm cũng bị xóa.

You may request a copy of your data, ask for incorrect details to be fixed, and ask for your account to be deleted. Send the request through the contact channel below; we handle it within 30 days.

Every connection runs over HTTPS. Passwords are hashed. Every third-party secret is encrypted with AES-256-GCM before it reaches the database. Sessions are revoked the moment an account is suspended.

No system is perfectly secure. If we find an incident affecting your data, we will tell you at your registered email address.

Questions about this policy, or requests concerning your data: see the Contact page.

This policy covers payfjord and every page on this domain.