Privacy Policy

1. Who is responsible (controller)

For the hosted service at multicoinpay.com, MultiCoinPay Inc is the controller of the merchant-account and operational data described below. For a self-hosted deployment, the operator that runs the software is the controller and can service requests directly against its own database. Contact: [email protected].

2. Data we process

• Merchant account — email address and a salted password hash (for console login), and API keys (stored only as hashes).
• Merchant configuration — store names, watch-only extended public keys, webhook URLs and secrets (secrets encrypted at rest).
• Payment records — fiat and crypto amounts, on-chain receive addresses and transaction identifiers, and payer source addresses (public on-chain data) used for sanctions screening.
• Request metadata — the client IP address of API and checkout requests, used transiently to enforce geo-restriction and rate-limiting, and minimal server logs for security and debugging.

3. What we do NOT collect

MultiCoinPay does not collect Customer names, emails, phone numbers, card numbers, or off-chain identity documents. There is no advertising, no tracking pixels, no cross-site profiling, and we do not sell or “share” personal data for cross-context behavioural advertising (as those terms are defined under CCPA/CPRA). The hosted service may use Cloudflare Web Analytics to count page views: it is cookieless, sets no identifiers on your device, does not follow you between sites, and does not build a profile of you. We use no other third-party analytics.

4. Legal bases (GDPR)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service to Merchants); legal obligation and legitimate interests (sanctions screening, security, and abuse prevention — balanced against your rights); and, where required, consent. IP addresses are processed on the basis of legitimate interest to secure the Service and enforce geo/rate controls.

5. How we use data

We use the data above to operate and secure the Service, derive receiving addresses, observe and report payment status, deliver webhooks, screen payer addresses against sanctions lists, prevent fraud and abuse, comply with legal obligations, and communicate with Merchants about their account. We do not use it to build Customer profiles or for advertising.

6. Sharing & disclosure

We do not sell personal data. We share it only with: infrastructure sub-processors strictly necessary to run the Service (for example, our hosting provider; Cloudflare, which proxies all traffic to the Service and therefore processes request metadata including IP addresses; and blockchain RPC providers, which receive on-chain addresses/transactions but not Customer identity); and authorities or advisers where required by law, to protect rights and safety, or to enforce these terms. On-chain data (addresses, transactions, amounts) is inherently public on the relevant blockchain.

7. International transfers

Where data is transferred across borders (for example to a hosting or RPC provider in another country), we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses where required by applicable law.

8. Retention

Merchant and payment records are retained for as long as the account exists and as needed for financial and compliance record-keeping. Sanctions-screening results may be retained for the period required by applicable AML law (commonly five years). Deleting a Merchant removes its account, stores, keys, and payment records from the deployment, subject to records we must retain by law. Transient request metadata and security logs are kept for a short period.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent. Under the CCPA/CPRA (California) you have rights to know, delete, correct, and to opt out of sale/sharing — we do not sell or share personal data — and a right not to be discriminated against for exercising them. To exercise any right, contact [email protected] (for a self-hosted deployment, contact that operator). You may also lodge a complaint with your local data-protection authority.

10. Cookies

The Service uses a single essential, HttpOnly session cookie to keep you logged into the console; it is strictly necessary and not used for tracking or advertising. There are no third-party or analytics cookies — the page-view measurement described in Section 3 is cookieless by design. The public checkout pages set no tracking cookies. Because we rely on no non-essential cookies, no cookie-consent banner is required.

11. Security

Passwords are stored as scrypt hashes; API keys and webhook secrets are stored hashed or encrypted at rest; transport is over TLS. We minimise the personal data at risk by design. No system is perfectly secure; if a breach affects your rights, we will notify you and the relevant authority as required by law.

12. Children

The Service is intended for businesses and is not directed to children. We do not knowingly process the personal data of children.

13. Changes

We may update this Policy; the “Last updated” date reflects the current version. Where a change is material, we will take reasonable steps to notify Merchants.

14. Contact

Privacy questions or requests: [email protected]. General support: [email protected]. For a self-hosted deployment, contact the operator that runs it (the data controller).

Change history

• 2026-09-07 — Operating entity and governing law set to MultiCoinPay Inc (Cayman Islands).
• 2026-07-13 — First publication of the Terms of Service and Privacy Policy.

Where a change is material we take reasonable steps to notify Merchants; this list is the public record of what changed and when.