How we handle your data

This policy applies to three groups: visitors to our website, merchants who hold a Coinfat account, and paying customers who reach a hosted checkout page from a merchant's invoice or payment link.

Where a merchant uses Coinfat to collect payment, that merchant determines why their customer's data is collected and we process it to deliver the payment. The merchant's own privacy policy governs what they subsequently do with it.

We process personal data where it is necessary to perform our contract with you, where we have a legal obligation such as anti-money-laundering and sanctions screening, where we have a legitimate interest in securing and improving the service, and where you have given consent, which you may withdraw at any time.

From merchants we collect account details such as name, email address and password credentials, store configuration, business and contact details, and the identity documentation required for verification where it applies.

From transactions we collect invoice records, amounts and currencies, the assets and networks selected, blockchain addresses and transaction hashes, conversion and withdrawal history, and any customer name or email a merchant chooses to attach to an invoice.

We also collect technical data automatically, including IP address, browser and device information, pages visited, session and authentication activity, and error diagnostics. Note that blockchain addresses and transaction records are written to a public ledger that we do not control and cannot amend or erase.

We use strictly necessary cookies to keep you signed in, to protect against cross-site request forgery, and to remember your language and theme preference. These are required for the service to function.

Where we use analytics or performance cookies, we do so to understand how the service is used and to improve it. You can control non-essential cookies through your browser settings or any consent controls we provide.

We use personal data to create and administer accounts, to process payments and settle balances, to display invoices and checkout pages, to send transactional notifications and webhooks, to provide support, to meet legal and regulatory obligations, and to detect and prevent fraud, abuse and security incidents.

We send marketing communications only where you have asked to receive them or where we are otherwise permitted to, and every marketing message includes a way to opt out. Opting out does not stop transactional messages about your account or payments.

We do not sell personal data. We share it with service providers who process it on our behalf under contract, including hosting and infrastructure providers, identity verification providers, exchange rate and blockchain data providers, and communication providers.

We may also disclose personal data to regulators, law enforcement or other authorities where we are legally required to do so, and to a successor entity in connection with a merger, acquisition or transfer of our business.

Your personal data may be processed in countries other than your own. Where we transfer data across borders we put appropriate safeguards in place, such as standard contractual clauses or an equivalent recognised transfer mechanism.

We keep account and transaction records for as long as your account is open and thereafter for the period required by applicable financial, tax and anti-money-laundering law. Technical logs are kept for a shorter period appropriate to security and diagnostics.

When a retention period ends we delete personal data or irreversibly anonymise it. Records already written to a public blockchain cannot be deleted by us or by you.

We encrypt data in transit, restrict access to personal data to staff who need it, support two-factor authentication and multi-factor confirmation of sensitive actions, and let you review and revoke active sessions and API keys from your account.

No system is completely secure. You play a necessary part in protecting your account by using a strong unique password, enabling two-factor authentication, and keeping your API keys and webhook secrets confidential.

Subject to applicable law, you may request access to the personal data we hold about you, ask us to correct it, ask us to delete it, object to or ask us to restrict certain processing, request a portable copy, and withdraw consent where processing relies on it.

To exercise a right, contact us at privacy@coinfat.com. We may need to verify your identity before we act. You also have the right to complain to your local data protection authority. Some requests may be limited where we are legally required to retain the data.

The service is not directed at children and is intended for users who are of legal age to enter into a binding contract in their jurisdiction. We do not knowingly collect personal data from children, and we will delete it if we learn we have.

We may update this policy as the service and our legal obligations change. Where a change is material we will give notice through the dashboard or by email, and the revised policy takes effect on the date stated at the top of this page.

For privacy questions or to exercise a right, contact privacy@coinfat.com, or write to [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Our data protection contact is [DATA PROTECTION CONTACT].