Privacy Policy

This policy explains what personal data VeliraPay collects, why, who sees it and how long it is kept. It covers people who visit the site, merchants and the members of their accounts who use VeliraPay, and customers who pay through a VeliraPay checkout or receive an invoice or a payment request.

Who is responsible

VeliraPay runs VeliraPay and is responsible for the personal data described here. You can reach us about it at contact@velirapay.com.

For the details a merchant's checkout or invoices collect from their customers, the merchant decides what is asked and why, and we process those details on their behalf. The IP address and browser a customer pays from are the exception: we record them ourselves, to prevent fraud and abuse, and we are responsible for that use.

What we collect

If you have an account

• Your name, email address and password, which is stored only as a hash; your phone number and profile picture, if you add them; your two-factor and passkey details; your language and notification preferences.
• The browsers you have signed in from, up to 20: which browser and system each one is, the approximate country of its IP address as Cloudflare works it out, and when it last signed in. Signing out every other browser from your security settings clears the rest of the list, and deleting your account clears all of it. When a sign-in comes from a browser new to your account, we email you its IP address and approximate country.
• About the business: its name, logo, website, support email and phone and brand colour; the business details you choose to give, such as its legal name, registration and tax numbers, address, phone number, industry, what it sells and its expected volume; its payout addresses and payment settings, its API keys and the AI assistants connected to it, its webhook endpoints and the deliveries sent to them, and its members and invitations.
• An activity log of what was done in the account, by whom and from which IP address, including failed attempts to sign in to it, so you can see its history and be warned about changes such as a new payout address.
• Every charge, payout, invoice and payment link, with amounts, coins, deposit addresses and the ids of the blockchain transactions involved.
• Payments for Pro. Card payments are handled by Stripe, which receives the account's name and email address, and its business phone number if you gave one; we keep only the card's brand and last four digits.

If you pay through a checkout or receive an invoice

• What the merchant asks for: your email address, your name and the answers to any questions on the payment page, or the details on your invoice.
• The payment itself: the amount, the coin, the address it was sent to and the transaction that carried it.
• The IP address and browser you start the payment from, with the country and the network that address belongs to, which we keep with it so the merchant and we can spot fraud. We look the network up in a copy of IPinfo's database kept on our own servers, so your address is not sent to IPinfo.
• If you pay SOL from a wallet on the payment page, the address of that wallet, which we need to prepare the transfer for it to sign, and to send it if the wallet leaves that to us. We hold what we prepared for a few minutes; the transfer itself then shows that address on the blockchain, like any other.
• What the merchant tells us about you when they create the payment from their dashboard or through our API, such as your email address, so we can send you a payment request, their own reference for you, your phone number, your country, the IP address and browser they saw you use, or other details they add to the payment.
• When you first open an invoice, the time is recorded and shown to the merchant.

If you visit the site

• Your IP address, browser and the pages you request, which our servers log to keep the service working and secure.
• On the sign-in, sign-up and password reset forms, Cloudflare Turnstile checks that you are not a bot, using your IP address and signals from your browser.
• Only if you allow analytics cookies: through Google Analytics, the pages you visit, how you arrived, your device and approximate location, and the main things you do in an account, such as signing up or creating a payment link. When you are signed in, you are identified by an ID that does not contain your name or email address, along with facts about the account such as its plan.
• Only if you also allow advertising cookies: a hashed form of your email address when you are signed in, which Google uses to match your visit to its own records and to measure our advertising.

Why we use it

• To provide the service you signed up for or are paying through: running accounts, taking and forwarding payments, sending webhooks, and sending the emails that go with them, such as receipts, invoices and security alerts. This is necessary to perform our contract with you or with the merchant.
• To keep the service and its users safe: the activity log, alerts about account changes and sign-ins from new browsers, bot checks and rate limits, and our operators comparing a payment with others from the same email or IP address, with any merchant, when they look into fraud. This is our legitimate interest in preventing fraud and abuse.
• To meet our legal obligations, such as keeping accounting records and answering lawful requests from authorities.
• To see how the site is used so we can improve it, and to measure our advertising, but only with your consent, which you can withdraw at any time.

We do not sell personal data or show advertising, and we do not use analytics or advertising cookies or send marketing emails without your consent.

Payments on a blockchain are public

Every crypto payment is recorded on a public blockchain, where anyone can see the amount and the addresses involved, permanently. Nobody, us included, can remove or change it. Each charge gets an address of its own, but the transfer that forwards a payment to the merchant is public too: anyone who knows the address one payment went to can follow it to the merchant's wallet and see the other payments forwarded there.

Who we share it with

We share personal data only with the providers that help us run VeliraPay, and only as far as each needs. They may use it only on our instructions, except that Stripe and Google also use what they receive for their own purposes, such as preventing fraud or measuring advertising, under their own privacy policies:

• Scaleway, which hosts our servers, our database and the mail server that sends receipts, invoices and alerts;
• Amazon Web Services, for file storage, backups and background processing, in the European Union;
• Cloudflare, which carries all traffic to and from the site to deliver and protect it, tells us roughly which country a sign-in comes from, and runs the bot check on the sign-in forms;
• Laravel, for error and performance monitoring with Nightwatch, which receives technical details of the requests you make, such as your IP address, your browser and your account's number, and technical details of errors, never your name or email address;
• Stripe, when you pay for Pro by card;
• Google, for analytics and advertising measurement, only if you allow those cookies;
• the blockchain data providers we read the chains and send payouts through, such as NOWNodes, Etherscan, Tatum, TronGrid and mempool.space, which see the deposit and payout addresses involved and the transactions we send, never a name or an email address;
• Reown, only when a customer chooses to pay through WalletConnect: it runs the connection to their wallet and learns their IP address, the address of the payment page, the wallet address that connects and which wallet it is, never a name or an email address;
• Coinbase, only when a customer chooses to pay with Coinbase Wallet: it runs the connection to their Coinbase account and learns their IP address, the address of the payment page and the wallet address that pays, never a name or an email address from us;
• Have I Been Pwned, which we ask whether a new password has appeared in a known data breach, sending only the first five characters of a hash of it, never the password itself or your email address.

A customer's details and payment are also shared with the merchant they pay. We disclose data to authorities only when the law requires it. The providers we fetch exchange rates from receive no personal data.

Some providers are based outside the European Economic Area, such as in the United States. Where they are, the transfer relies on an adequacy decision of the European Commission or on its standard contractual clauses.

How long we keep it

• Your own details, such as your name, email address, phone number, password, profile picture, sign-in methods and browsers, until you delete your account. Your name and email address can stay in the logs of what was done in the accounts you belonged to.
• The details of a business, its payout addresses and the records of its payments, payouts and invoices, with the customer details on them, are kept, including after the account is closed: accounting and anti-money-laundering rules require payment records to be kept.
• Activity log entries for one year.
• Logs of webhook deliveries, which can include a customer's details, and background tasks that failed, which can include an email address, for 30 days.
• Answers to API requests sent with an idempotency key, which can include a customer's details, for 24 hours.
• Notifications in your account until they are 90 days old and you have read them.
• Invitations to join an organization for three days, after which they expire and are deleted; password reset links for an hour, after which they expire and are deleted.
• Files uploaded but never saved, such as a logo you picked and did not keep, for at most two days.
• Server logs only as long as they help keep the service working and secure.
• Backups, which hold a copy of all of the above, for 7 days, after which they are deleted.
• Analytics data for at most 14 months.

You can ask us to delete anything we are not required to keep.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable format. Write to contact@velirapay.com; we answer within a month. If your data came to us through a merchant's checkout or invoice, you can also ask the merchant, and we will help them answer.

You also have the right to complain to the data protection authority where you live or work.

Cookies

VeliraPay needs a few cookies to work: a session cookie that keeps you signed in, remembers your language and, on payment pages, which payments this browser started and which links it opened; a security cookie that protects forms from being submitted by other sites; one that keeps you signed in for 13 months if you tick Remember me or sign in with a passkey; one that recognises a browser you signed in from before, for 13 months, so we can warn you when your account is used from a new one; and one that remembers your cookie choice for six months. Cloudflare, including its Turnstile check, may set its own for the same purposes. Your light or dark display preference stays in your browser. These are always on.

Your browser also keeps a few preferences on your device, which are not sent to us: your light or dark choice, the language you last picked for code examples, the coin you last paid with on a payment page and, until you close the tab, that you just sent a payment from a wallet. Paying through WalletConnect also keeps the details of that connection in your browser.

Everything else is off until you allow it in the cookie banner:

• Analytics: Google Analytics cookies (_ga and _ga_*), kept for up to 13 months, which tell visits apart and count how the site is used.
• Advertising: Google's advertising cookies (_gcl_*), kept for up to 13 months, which measure how people who saw our ads use the site.

You can change your choice at any time from Cookie settings, at the bottom of the site and in your account menu. Withdrawing your consent deletes the cookies it allowed.

Security

Everything travels over HTTPS. Passwords are stored as hashes, two-factor secrets are encrypted, webhooks are signed, and access to personal data is limited to what running the service needs.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change matters, account holders are told by email before it applies.