Privacy policy

From merchants:

• Account details: name, email, password (stored hashed), two-step sign-in settings.
• Business details: brand name, website, business category, expected monthly revenue, country.
• Identity verification: the ID document you upload and its country of issue.
• Payout details: your Solana wallet address and payout history.
• Integration credentials you connect (for example Komerza API keys), stored encrypted-at-rest and never shown back in full.
• Usage data: sign-in times, IP address, device and browser information.

From customers at checkout:

• Email address, country, order details and amount.
• Card and wallet details are entered directly into our Payment Processor's secure fields; we never see or store full card numbers.
• IP address, used to match your order and prevent fraud.

• To provide the Service and process payments and payouts — performance of a contract.
• To verify identity, prevent fraud and money laundering, and meet accounting and tax obligations — legal obligation and legitimate interests.
• To secure accounts and the platform — legitimate interests.
• To send service and security notices — performance of a contract.
• We do not sell personal data or use it for third-party advertising.

• Stripe, our Payment Processor, to process card and wallet payments.
• Our hosting, database and email infrastructure providers, under data processing agreements.
• Platforms you connect, such as Komerza, to look up and update your orders.
• The merchant you are buying from receives your order and payment details.
• Authorities, courts or regulators where required by law.
• Payout transactions are recorded publicly on the Solana blockchain by design.

Some providers process data outside the EEA, including in the United States. Where this happens we rely on adequacy decisions or the EU Standard Contractual Clauses.

Account data is kept while your account is active. Transaction and payout records are kept for at least 5 years after the end of the financial year, as required by Norwegian bookkeeping law. Identity documents are kept for up to 5 years after the business relationship ends to meet anti-money-laundering obligations. Other data is deleted or anonymised when no longer needed.

We use encryption in transit, access controls, private storage for identity documents, role-based staff access and optional two-step sign-in. No system is perfectly secure; we will notify you and the authorities of a breach where the law requires.

You have the right to access, correct, delete, restrict or object to processing of your data, and to data portability. Some data must be kept for legal reasons even if you ask us to delete it. To exercise your rights, email support@paytrail.cc. We reply within one month.

You may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the authority in your own country.

We only use storage that is strictly necessary for the Service: keeping you signed in and remembering security settings. Our Payment Processor may set cookies on checkout pages for fraud prevention. We do not use advertising or tracking cookies.

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

We may update this policy. Material changes are announced by email or in the dashboard.