Who this notice covers
This notice is issued by the individual operating PayEasy™ in California, United States, under the PayEasy trading name. It covers visitors, seller applicants, seller account holders, customers using our checkout, and people contacting support. For privacy questions, contact [email protected] or @chris_payeasy on Telegram.
A seller is separately responsible for the information collected through its own store, its products, and its customer relationship. Stripe, Wise where used, Telegram, storefront platforms, and other providers may process data under their own privacy notices. This notice does not replace them or promise anonymity.
Information we handle
- Applications and messages: your name, business name, email, website, estimated monthly card volume in USD, Telegram or Discord handle, business description, support messages, application status, and review notes.
- Account and security records: seller identifiers, a salted password verifier, session records, API-key hashes and masked labels, access status, audit entries, and policy acknowledgements with their version and server-recorded time.
- Orders and funds: seller and checkout references, product display names, USD amounts, fees, verification results, relevant Stripe payment identifiers, refund or dispute adjustments, hold dates, balances, cashout requests, destination wallet addresses, transfer references, and reconciliation notes.
- Connected stores: platform choice, shop or store ID, encrypted platform API credentials, order identifiers, the price and title needed for checkout, and completion status. We request the information necessary to read and reconcile supported orders, rather than copies of delivered goods.
- Technical information: IP address, request time, requested path, browser and device information, response/error information, and information used by hosting and network-security services to protect and deliver the site.
Card entry occurs on Stripe-hosted pages. PayEasy’s application and checkout forms do not ask you to enter a full card number or CVC. Stripe may collect payment, contact, billing, device, and risk information directly. Do not send identity documents, private keys, recovery phrases, or unrelated sensitive data through our general forms.
Email verification and private alerts
When email verification is enabled, Brevo sends a one-time sign-in code to the email registered to the seller account. Brevo processes that address, the verification message, and delivery information to provide email delivery. We do not send passwords, API keys, order contents, or wallet details in sign-in-code emails. The message supplied by PayEasy contains no remote tracking images or tracking links; the email provider may separately maintain delivery and security records under its own privacy notice.
We store a keyed hash of the code, an opaque browser-proof hash, credential-version information, attempt counters, expiry times, and send-budget timestamps. The code expires after at most ten minutes and stops working after five incorrect attempts or one successful use. Challenge records are removed after two days by routine hourly housekeeping. If you select “Remember this device”, an opaque device token can authorise an email-code renewal for up to seven days from the password sign-in. It does not remove the code requirement. Sign-out or revocation can end remembered access earlier.
Application alerts and new cashout alerts are sent through Telegram to the operator’s fixed private chat. A cashout alert includes the seller business name, requested USD amount, destination wallet address, request identifier, status, and an administrator review link. Telegram processes that message to deliver the alert. The bot does not broadcast these alerts to a public channel, choose a recipient supplied by the seller, or send a login verification code. Private delivery is not a promise that the service provider processes no data.
Seller invitations and private documentation
When an administrator sends a seller invitation, Brevo receives the seller’s registered email, business name, a private one-time account activation link, and its expiry time. Sending to an address entered by someone else in the browser is not supported. We retain delivery attempt timestamps and status to prevent duplicate sends and apply retry limits; we store a hash rather than the raw activation token.
The documentation subdomain remains private to signed-in sellers. A single-use handoff ticket lasts at most 60 seconds and is bound to a temporary browser proof. Documentation receives its own host-only session cookie, limited by the expiry of the originating seller session. Signing out or revoking that session ends the associated documentation access.
Why information is used
We use information to review applications, operate accounts and checkouts, reconcile payments and seller funds, review cashout requests, handle support and disputes, connect authorised storefronts, secure the service, prevent abuse, and meet legal or provider obligations.
Where a law requires a legal basis, processing may be necessary to take requested steps before an agreement or perform it, meet a legal obligation, or pursue proportionate legitimate interests such as security and accurate financial records. Consent is used where legally required for a particular optional activity. Accepting the Terms is not consent to unrelated advertising.
Application review and cashout decisions can involve an administrator. A payment processor or security provider may make its own risk decisions. We do not claim that a PayEasy approval overrides those decisions.
Storage, security, and international processing
Information is held on the service’s server and with relevant providers. Passwords use salted one-way verifiers. PayEasy API keys are stored as hashes; connected-platform keys are encrypted on the server. Account cookies are protected with HTTPS-only and script-access restrictions. These safeguards reduce risk but do not make a service immune from compromise.
Providers and their infrastructure can process information outside your state or country, including in the United States and other locations where they operate. Applicable legal transfer requirements still apply. Information does not necessarily remain in California. The safeguards required for an international transfer depend on the applicable law and provider relationship.
Wallet addresses and completed transaction details can be recorded on a public blockchain. Once public, that record cannot ordinarily be erased by PayEasy, and other parties may copy or analyse it.
Retention and deletion
We retain records for as long as reasonably needed for the purposes above. Account operation, unresolved applications, transactions, refunds, disputes, cashouts, audit needs, statutory recordkeeping, and legal claims affect the retention period. An account closure does not immediately delete financial records.
Retention depends on the record’s purpose and applicable requirements rather than a single automatic deletion period. We assess deletion requests against those retention needs and restrict information that must remain. Backups and copies held by providers may persist under their own lawful retention arrangements; we do not promise that deleting a live record instantly erases every backup.
We review what must be kept and should remove or de-identify information when it is no longer needed, subject to applicable law. Tell us if an application should be withdrawn or a contact detail is wrong.
Your choices and privacy requests
Depending on where you live and which law applies, you may request access, correction, deletion, a copy of your information, or restrictions on certain processing. Applicable California rights may also include knowing the categories and sources of data, portability, and freedom from unlawful discrimination for exercising a privacy right. These rights are subject to legal conditions; this notice does not claim that every privacy statute applies to every interaction.
Send a request to [email protected] or @chris_payeasy on Telegram. State your connection with PayEasy and the request. We may need proportionate verification before disclosing or changing an account record, and will respond within the period required by applicable law. Do not send a password or an API key as proof of identity.
We do not operate a sale or targeted-advertising programme. Where applicable law requires recognition of an opt-out preference signal such as Global Privacy Control, we honour that requirement. A browser’s Do Not Track signal does not disable necessary payment, authentication, or security processing. The Cookie Policy explains browser controls.
You may also contact a competent privacy regulator where the law provides that right. Your seller is the first contact for its product, delivery, and store-specific data practices.
Children and changes to this notice
Seller accounts are for adults authorised to operate a business. We do not knowingly solicit children’s personal information for a seller account. If you believe a child has supplied information inappropriately, contact us so we can investigate and take action required by law.
We update this notice when the service or relevant requirements change and identify the revision date above. A material new use requires any additional notice or consent required by law. Privacy questions can be sent to [email protected] or @chris_payeasy on Telegram.
Questions about this policy?