Scope and responsibilities
This Policy covers the Coinvay website, account service, checkout, APIs and related support. Coinvay determines the purposes of its own account administration, service security, billing and compliance processing. Merchants separately decide why they collect their customers’ order and contact information and are responsible for their own notices and lawful basis. Where Coinvay processes customer data solely on a merchant’s instructions, the applicable processing agreement and law govern that relationship. The role depends on the actual processing; this Policy is not a substitute for a required data-processing agreement.
Information you and your providers give us
Account information includes name, email, account identifiers, role, account status, plan and settings. Passwords are stored as hashes, not as retrievable plaintext. Security data may include encrypted authenticator setup secrets, recovery-code hashes, session records and connected sign-in identifiers. Google, Apple or enabled platform sign-in can provide an account identifier, basic profile and verified-email information. We do not request your Google/Apple password.
Merchant information includes receiving wallet addresses, ownership-verification signatures, uploaded business name/logo, integration settings and contact details. Operational records include invoices, order references, customer name/email when supplied, payment amounts, network and asset, quotes, transaction hashes, confirmations, shortfalls, subscriptions, payout requests and webhook delivery records. Support correspondence and information submitted during an abuse review may also be processed. Never submit wallet seed phrases, private keys or unnecessary sensitive personal data.
Security and technical information
For essential account security we keep the latest successful login time, IP address supplied by the hosting provider, coarse browser/device category, operating system and sign-in method. We do not retain a full user-agent string in this account login record. Authorised administrators can review these details to investigate access and abuse.
Essential cookies maintain sessions and protect OAuth flows. Rate-limit, authentication-challenge, security-audit, reliability and error records help prevent misuse and operate the application. Signup acceptance records contain the account identifier, accepted policy versions and document fingerprints, acceptance time and signup method. The acceptance record does not add a separate IP address or full browser fingerprint. The hosting provider may process connection metadata independently to deliver and protect the service.
Public blockchain and checkout visibility
Wallet addresses, transaction hashes, amounts and other on-chain data can be visible worldwide and persist independently of Coinvay. We obtain verification information from public networks and configured RPC/explorer services. A provider may receive wallet addresses, transaction hashes and requests needed for verification.
A person with a checkout or subscription-management link may see the information that link makes available. Treat these links as confidential access links. Do not put identity documents, sensitive notes or secrets into a public invoice or blockchain transaction. Deleting a Coinvay record cannot erase an independent blockchain, another party’s wallet or a recipient’s copy.
Purposes and legal bases
We process data needed to create and operate an account, provide checkout, verify payments, manage a plan, deliver requested messages and respond to support under the contract or steps requested before entering it (GDPR Article 6(1)(b), where applicable). We use proportionate security, reliability, fraud-prevention, record-protection and abuse-investigation processing for legitimate interests in protecting users and the service (Article 6(1)(f)), subject to your rights and a balancing assessment.
Where a specific legal obligation applies, we process or disclose the necessary information to comply with it (Article 6(1)(c)). Where optional browser analytics or another optional activity requires consent, we use that consent (Article 6(1)(a)) and let you withdraw it. Reading this Privacy Policy is an acknowledgement of information, not blanket consent to every processing activity or a waiver of your rights. We do not rely on signup agreement alone as a legal basis for indiscriminate disclosure.
Optional analytics and cookies
You can choose Only essential and still use Coinvay. Optional analytics and advertising measurement have independent, unchecked choices. Signup agreement is not consent to either category. With permission, Coinvay’s first-party analytics can record public page categories, coarse device/browser groups, campaign labels and checkout interactions. Its random visit identifiers are stored hashed, and its events exclude form values, full URLs, checkout capability tokens, customer information, wallet addresses, API keys and raw IP addresses. Built-in payment intelligence remains separate from external advertising integrations.
All external integrations start disabled and require an administrator’s separate manual activation. With analytics consent, an enabled Google Analytics 4 integration measures approved public Coinvay pages and selected merchant milestones. With advertising consent, enabled Meta Pixel, Google Ads or Reddit Pixel integrations measure Coinvay marketing and merchant acquisition. These services may set or read provider cookies and receive public-page visits, opaque event identifiers, selected milestone names and the connection metadata inherent in a browser request, such as an IP address and browser information. These cookie identifiers are pseudonymous personal data, not anonymous data. Each provider processes received information under its own policies and account configuration.
We do not install Coinvay advertising scripts on merchants’ websites, plugins, hosted checkout, invoices, payment links, customer payment screens or private dashboards. Private merchant milestones are verified by Coinvay’s backend: account registration, completed onboarding, first working API integration, first API key, first confirmed live merchant payment, and a confirmed Coinvay plan payment. A minimal event can wait for a consented public visit before a browser SDK is called. Optional GA4 or Reddit server delivery uses a genuine provider cookie identifier collected after consent, stored encrypted within Coinvay. Coinvay links the consent record to the merchant internally to check the event; it does not export its account identifier.
Coinvay’s explicit external event payloads exclude names, email addresses, phone numbers, wallet addresses, blockchain transaction hashes, payment/invoice identifiers, amounts, API keys, authentication tokens, webhook payloads, KYC documents, support messages, private URLs and query strings. Advanced matching, user-provided data sharing, enhanced conversions, personalized advertising and Google Signals are disabled in the application. Administrators must keep automatic and enhanced collection disabled in their provider accounts. Merchant transaction volume is not Coinvay revenue; this release sends neither merchant amounts nor platform revenue. A paid-plan milestone is non-monetary.
You can reopen Privacy preferences to change or withdraw either choice. Permission lasts at most 180 days before a renewed choice is required. Withdrawal blocks new optional delivery for that consent record, cancels its unsent provider events, removes stored provider matching identifiers for the withdrawn category, clears accessible provider cookies and reloads a public page when necessary to stop loaded SDKs. Essential account, payment and security functions continue. A request already in flight cannot be recalled, and withdrawal does not automatically erase data already received by a provider. Provider deletion requests can also be made through that provider; contact privacy@coinvay.com for help. First-party browser observations are removed as implemented by the existing revocation controls; aggregate counts can remain.
External measurement consent records expire within 180 days. Unsent conversion events expire after 72 hours; local event/delivery diagnostics and setup-test records are retained for up to 30 days before the maintenance runner removes them. Removal occurs during maintenance, so expiry is a transmission cutoff rather than a promise of immediate physical deletion. Account security, operational audit and legal acceptance records follow the separate retention purposes below. Uncertain or failed tracking delivery is not retried automatically where a duplicate cannot safely be excluded.
Who can receive information
Access is limited to authorised personnel and service providers who need information for their tasks. Providers can include Cloudflare-backed hosting, D1 database and upload storage, the configured SMTP/email service, blockchain RPC/explorer services and enabled identity or analytics providers. A merchant receives the customer/order/payment information necessary to manage its own transactions. A merchant’s webhook endpoint receives the configured payment notification. We do not sell personal information. Optional advertising measurement is limited to Coinvay acquisition and requires the separate advertising choice described above; the application disables personalization and advanced matching.
We may share limited relevant information with professional advisers, courts, regulators, law enforcement or other competent bodies where disclosure is required by law, a valid legal request, or another lawful and necessary basis, for example to investigate credible crime or protect legal rights. We assess authority, scope, necessity and applicable safeguards; account agreement does not authorise unrestricted access. Where lawful and appropriate we notify affected users; a legal prohibition or risk of prejudicing an investigation may prevent notice. Records may be preserved while a valid request or legal hold is assessed.
International processing
Our providers and public blockchain networks may process information outside Estonia and the EEA. Public networks are globally replicated. For transfers of personal data subject to GDPR restrictions, an applicable transfer mechanism is required, such as an adequacy decision or appropriate contractual safeguards, together with any necessary supplementary measures. Information about the relevant provider arrangements and safeguards can be requested from privacy@coinvay.com. We do not promise that all information remains within Estonia.
Retention and account closure
Active account settings and operational records are retained while needed to provide and secure the service. The latest account login record is retained for up to 90 days and the application removes older login records during subsequent login maintenance. Raw first-party analytics events default to 30 days and aggregate counts to 730 days; administrators can change those configured periods, currently within 7–365 days for raw events and the application’s aggregate limits. Short-lived sessions, challenges and tokens expire according to their security purpose; expiry does not always mean immediate physical deletion.
Financial, invoice, audit, subscription and policy-acceptance records may remain after closure where needed for legal obligations, dispute resolution, fraud prevention or establishing contractual rights. The application does not currently automatically erase every operational record on a single fixed schedule. Retention is reviewed against the purpose and applicable requirements; it is not a promise to retain everything indefinitely. Contact privacy@coinvay.com for deletion or a retention assessment. A documented legal hold may delay deletion of relevant records. Provider backups can persist through their normal retention cycle and should not be used to reintroduce data into ordinary use after a valid deletion.
An administrator’s archive/delete-access action is not a claim that every related database record has been erased. Public blockchain records and third-party copies cannot be deleted by Coinvay. We do not apply a universal five-year AML retention period merely because an account uses cryptocurrency; any statutory period depends on the legal obligation actually applicable.
Your data rights and requests
Where applicable, you can request access and a copy, correction, deletion, restriction and portability; object to legitimate-interest processing; and withdraw consent for optional processing. Rights can have legal exceptions. Email privacy@coinvay.com from your account address with the request and enough information to identify the relevant account. We may seek proportionate identity verification, but never your wallet private key or seed phrase. Do not send identity documents unless requested through an appropriate secure channel.
Under GDPR, we normally respond within one month; a lawful extension for complexity or multiple requests will be explained within that period. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or another competent supervisory authority, including where you live or work. Contacting us first is helpful but does not remove your right to complain.
Security, children and automated decisions
We use access controls, password hashing, protected sessions, available multi-factor authentication and encrypted storage for selected application secrets. No online service can guarantee absolute security. Protect your email and wallets, enable MFA and tell support promptly if you suspect compromise. Where legally required, we notify the competent authority and affected people of qualifying personal-data breaches.
Coinvay accounts are intended for adults aged 18 or older. We do not knowingly invite children to create merchant accounts. Contact privacy@coinvay.com about information submitted by a child. Payment-matching rules and plan limits perform operational checks; this Policy does not claim a deployed automated AML risk-scoring system. If an automated restriction appears incorrect, request review through support.
Updates and contact
We publish the effective date and version and provide appropriate notice of material changes. Previous policy text is archived below. For privacy, disclosure or data-rights questions contact privacy@coinvay.com; for payment or account help contact support@coinvay.com. A new signup records a Privacy Policy acknowledgement. An existing user’s ordinary login does not create a new acknowledgement or give retroactive consent.
Cookie choices
Optional analytics is separate from your signup agreement.