Privacy policy

BluPay processes account and payment information to operate its merchant dashboard, API, and hosted crypto checkout. This page describes the information involved in those product workflows and how to raise a privacy request.

Account and security information

Registration and account access use information such as your email address, password hash, verification records, and authentication sessions. Shop configuration includes merchant-provided business details, webhook URLs, and payment settings. Security and audit records support account access checks and investigation of platform activity.

Invoice and transaction information

Invoice records include amounts, currencies, networks, status, order references, payment addresses, and related blockchain transactions. An invoice may include a customer email address when provided. Merchant-configured webhooks send invoice and payment information to the merchant’s nominated endpoint.

Cookies and browser storage

Authenticated services use cookies and session records to maintain and verify account access. Checkout can use browser storage to remember a selected payment asset or network. Your browser can clear stored data; doing so may sign you out or reset saved choices.

Email, infrastructure, and blockchain services

Operating these workflows involves email delivery, hosting, and blockchain network connections. Payment and verification messages use the contact details supplied for that workflow. Ask through the Contact page for the providers, processing locations, and retention arrangements applicable to your account.

Public blockchain records

Blockchain addresses, transfers, and transaction hashes can be publicly visible on the relevant network. Do not put personal information or secrets in on-chain transaction data. BluPay cannot remove a confirmed transaction from a public blockchain.

Access, corrections, and privacy requests

Use the Contact page to request access to, correction of, or information about deletion of your account data. Provide the account email and a description of your request, without passwords or recovery phrases. Account deletion does not by itself erase public blockchain records. Ask for confirmation of the data controller, applicable retention periods, and the process available in your jurisdiction.

Protecting your information

Use a unique password, enable two-factor authentication, restrict API key permissions, and verify webhook signatures. Share only the customer data necessary for your payment workflow. If you suspect unauthorized access, contact support and rotate the affected credentials.