Privacy Policy
Effective November 7, 2026
Who we are
ChainPay is a payment orchestration platform operated by ChainPay LLC ("ChainPay", "we"). Businesses ("merchants") use ChainPay to accept payments from their customers by card, bank transfer (ACH), digital wallets, Zelle, Cash App, crypto and other methods.
This policy covers two groups of people:
- Merchants: the businesses and their staff who sign in to the ChainPay dashboard.
- Customers: the people who pay a merchant through ChainPay's checkout, receipts or the merchant's own site.
For customer data, the merchant decides why it is collected, and ChainPay processes it on the merchant's behalf. Each merchant's own privacy policy also applies to its customers.
What we collect from merchants
| Data | Why |
|---|---|
| Name, email, country, and the profile Google shares when you sign in with Google | Your account and sign-in |
| Sign-in codes we email you, second-factor settings, and session records with IP address and browser | Signing you in and keeping your account secure |
| Business details: company name, website, support email, city, region, country, refund policy, terms link | Receipts and dispute evidence |
| Payout details: crypto wallet addresses, Zelle tag | Paying you |
| Credentials for providers you connect, such as Stripe, Square or Amazon Pay (stored encrypted) | Running payments on your own provider accounts |
| Admin actions and API requests, with IP address and browser | Security, audit and troubleshooting |
What we collect from customers
| Data | When | Why |
|---|---|---|
| Email address, and name if given | At checkout | Sending the receipt, and the merchant's records |
| IP address, approximate country, browser, language, time zone, screen size, platform, and a fingerprint made from them | When paying at checkout | Fraud prevention, local currency, and evidence if the payment is disputed |
| The terms shown and when they were accepted, and for bank payments the debit authorization shown | When paying, except for crypto | Evidence of what the customer agreed to |
| Sign-ins, page views and actions on the merchant's site, with IP address, country and browser | Only if the merchant adds ChainPay's evidence script to its site | Evidence that the customer used what they bought |
| Card brand, last 4 digits, network, wallet type and authorization code, read from the merchant's payment provider. Never the full card number. | Card and wallet payments | The receipt and dispute evidence |
| Billing name, country and address line | Card payments | Sent to the merchant's card processor with the card |
| Bank account name, last 4 digits, type and bank name, plus a Plaid token | Bank (ACH) payments | Making the payment (see Plaid below) |
| Wallet address and transaction IDs | Crypto payments | Confirming and settling the payment |
| Phone number, tax ID (CPF) or UPI ID, passed to the local provider and not stored by ChainPay | M-Pesa, PIX or UPI payments | Making the payment |
| The receipt as sent, and its delivery status | After payment | The customer's record of the purchase, and evidence |
How we use data
We use data only to run payments and the services around them:
- Making, confirming and settling payments, and sending receipts and payment notices.
- Signing merchants in and keeping accounts secure.
- Preventing fraud and giving merchants evidence when a payment is disputed.
- Meeting legal obligations, and answering lawful requests from authorities.
We do not sell personal data, share it for advertising, or use advertising or analytics trackers on our sites.
Who we share data with
We share data only with the providers needed to make a payment or run the service.
| Provider | What they receive | Why |
|---|---|---|
| The merchant you pay | Your payment, receipt and evidence records | It is their sale |
| Stripe, Square, Amazon Pay (on the merchant's own account) | The payment, your email and billing details, and dispute evidence the merchant submits | Card, wallet, buy-now-pay-later and Amazon Pay payments |
| Plaid | Your bank sign-in happens in Plaid's own window; we send the amount and your name | Bank (ACH) payments |
| Square (Cash App Pay) | The payment and your email | Cash App payments |
| EBANX, Safaricom (M-Pesa), Cashfree, Antom | The payment, and the phone number, tax ID or UPI ID that method needs | PIX, M-Pesa, UPI, Alipay and WeChat Pay |
| Stripe (ChainPay's own account) | The merchant's name and email | Billing merchants for ChainPay plans |
| Resend | Email addresses and email content | Sending sign-in codes, receipts and notices |
| Sign-in only | Sign in with Google | |
| Cloudflare | Website traffic and backups | Delivering the site and keeping backups |
| Hetzner | All data we store | Hosting our servers |
| Blockchain networks and their data providers | Wallet addresses and transactions, which are public on-chain | Crypto payments |
| A timestamp authority (DigiCert by default) | A cryptographic hash only, never personal data | Proving when evidence was recorded |
Zelle payments are made in the customer's own banking app straight to the merchant. ChainPay shows the merchant's Zelle details and receives no bank data.
Plaid and bank account data
For bank (ACH) payments, ChainPay uses Plaid to connect the customer's bank account. You sign in to your bank inside Plaid's window, and ChainPay never sees your bank login. Plaid's own privacy policy applies to what Plaid collects: plaid.com/legal.
ChainPay stores the account's name, last 4 digits, type and bank name, and a token Plaid issues. ChainPay does not receive or store your full account or routing number. A bank account linked at ChainPay's checkout is used only for the payment it was linked for. The merchant can't see the account or charge it again.
Crypto payments never use or touch a bank account linked through Plaid.
Crypto payments
A crypto payment goes from the customer's own wallet to an address ChainPay creates for that payment, and from there to the merchant's own wallet, less ChainPay's fee. Blockchains are public: wallet addresses, amounts and transaction IDs can be seen by anyone and can't be erased. ChainPay does not convert crypto to or from bank money.
How long we keep data
- Receipts, checkout evidence, consent records and usage evidence are written once and never changed, so they can prove what happened. We keep them for 7 years after the payment, for disputes, refunds and record-keeping laws. Receipt links stay valid for at least 120 days, as card network rules require.
- Merchant accounts are kept while the account is open, and for 7 years after it closes.
- Database backups on our server are deleted after 14 days.
- Sign-in codes expire after 5 minutes.
Cookies and browser storage
The dashboard uses sign-in cookies and stores small settings in your browser, such as whether you dismissed the onboarding guide. Checkout, product and receipt pages set no cookies of their own. Payment providers' forms on the checkout page, such as Stripe, Plaid and Square, may set their own cookies under their own policies. We use no advertising or analytics cookies.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it, by writing to [email protected]. If you paid a merchant, you can also ask the merchant. We may keep records we need for disputes, fraud prevention or the law, and we will tell you when we do. Depending on where you live, for example in the European Economic Area, the United Kingdom or California, you may have further rights, including to object to processing or to complain to a data protection authority. We will answer any such request.
Security
All traffic uses HTTPS. Provider credentials merchants connect are encrypted. Evidence and receipts are fingerprinted, signed and timestamped, so a change would show. Card numbers never reach ChainPay: they go straight to the merchant's card processor.
Children
ChainPay is a business service and is not meant for anyone under 16.
Changes and contact
We will post changes on this page with a new effective date, and email merchants about significant ones. Questions:
ChainPay LLC, 18851 NE 29th Avenue, Aventura, FL 33180, USA. Email: [email protected]