Politique de confidentialité

This policy explains what personal data VeliraPay collects, why, who sees it and how long it is kept. It covers people who visit the site, merchants and their team members who use VeliraPay, and customers who pay through a VeliraPay checkout or receive an invoice.

Who is responsible

VeliraPay runs VeliraPay and is responsible for the personal data described here. You can reach us about it at the contact details in our legal notice.

For the details a merchant's checkout or invoices collect from their customers, the merchant decides what is asked and why, and we process those details on their behalf.

What we collect

If you have an account

• Your name, email address and password, which is stored only as a hash; your two-factor and passkey details; your language and display preferences.
• About the business: its name, logo, website, support email and brand colour, its payout addresses and payment settings, its API keys, webhook endpoints and the deliveries sent to them, and its team members and invitations.
• An activity log of what was done in the account, by whom and from which IP address, so you can see its history and be warned about changes such as a new payout address.
• Every charge, payout, invoice and payment link, with amounts, coins, deposit addresses and the ids of the blockchain transactions involved.
• Payments for Pro. Card payments are handled by Stripe; we keep only the card's brand and last four digits.

If you pay through a checkout or receive an invoice

• What the merchant asks for: your email address, your name and the answers to any questions on the payment page, or the details on your invoice.
• The payment itself: the amount, the coin, the address it was sent to and the transaction that carried it.

If you visit the site

• Your IP address, browser and the pages you request, which our servers log to keep the service working and secure.
• On the sign-in, sign-up and password reset forms, Cloudflare Turnstile checks that you are not a bot, using your IP address and signals from your browser.

Why we use it

• To provide the service you signed up for or are paying through: running accounts, taking and forwarding payments, sending webhooks, and sending the emails that go with them, such as receipts, invoices and security alerts. This is necessary to perform our contract with you or with the merchant.
• To keep the service and its users safe: the activity log, alerts about account changes, bot checks and rate limits. This is our legitimate interest in preventing fraud and abuse.
• To meet our legal obligations, such as keeping accounting records and answering lawful requests from authorities.

We do not sell personal data, show advertising, use tracking or analytics tools, or send marketing emails without your consent.

Payments on a blockchain are public

Every crypto payment is recorded on a public blockchain, where anyone can see the amount and the addresses involved, permanently. Nobody, us included, can remove or change it. Each charge gets an address of its own, so one payment does not reveal another, but anyone who knows an address can look up what it received.

Who we share it with

We share personal data only with the providers that help us run VeliraPay, who may use it only on our instructions, and only as far as each needs:

• Amazon Web Services, for file storage and background processing in the European Union, and the host named in our legal notice;
• our email delivery provider, to send receipts, invoices and alerts;
• Cloudflare, for the bot check on the sign-in forms;
• Stripe, when you pay for Pro by card;
• the blockchain data providers we read the chains through, such as NOWNodes, which see the deposit addresses we watch and the transactions we send, never a name or an email address.

A customer's details and payment are also shared with the merchant they pay. We disclose data to authorities only when the law requires it. The providers we fetch exchange rates from receive no personal data.

Some providers are based outside the European Economic Area, such as in the United States. Where they are, the transfer relies on an adequacy decision of the European Commission or on its standard contractual clauses.

How long we keep it

• Account details for as long as the account is open.
• Records of payments, payouts and invoices, and the activity log around them, for as long as accounting and anti-money-laundering rules require, which can be up to ten years.
• Server logs only as long as they help keep the service working and secure.

Once we no longer need something, we delete it or make it anonymous. You can ask us to do so sooner for anything we are not required to keep.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable format. Write to the contact details in our legal notice; we answer within a month. If your data came to us through a merchant's checkout or invoice, you can also ask the merchant, and we will help them answer.

You also have the right to complain to the data protection authority where you live or work.

Cookies

VeliraPay uses only the cookies it needs to work: a session cookie that keeps you signed in and remembers your language, and a security cookie that protects forms from being submitted by other sites. The Turnstile check may use its own for the same purpose. Your light or dark display preference stays in your browser. There are no advertising or tracking cookies, which is why there is no cookie banner.

Sécurité

Everything travels over HTTPS. Passwords are stored as hashes, two-factor secrets are encrypted, webhooks are signed, and access to personal data is limited to what running the service needs.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change matters, account holders are told by email before it applies.