Privacy Policy

• Account data — name, email, and authentication identifiers, handled through our authentication provider.
• Business configuration — business name, website domain, logo, and payment configuration including wallet addresses and extended public keys (xpubs). Xpubs can only derive receiving addresses; they cannot move funds.
• Billing data — paid plans are processed by our payment processor; PaySovra does not store full card numbers.
• Usage data — order counts, API activity, and security events (for example sign-ins and configuration changes).

When a customer pays through a PaySovra checkout surface we process the payment session itself: amount, selected asset and network, the receiving address, the on-chain transaction hash, and payment status. Wallet addresses and transaction hashes are public blockchain data by nature.

If a merchant enables it, a checkout surface may also collect the customer's email address and shipping details. That data is collected on the merchant's behalf, is scoped to that merchant only, is used solely for order fulfillment and receipts, and is never shared across merchants or used to build cross-merchant profiles.

• We never hold, custody, or transmit funds.
• We never sell personal data or share it with advertisers.
• We never use customer data from one merchant for any other merchant.
• We do not run third-party advertising trackers on checkout surfaces.

Our marketing website uses self-hosted, privacy-respecting analytics that do not use cookies and do not track visitors across other sites. Aggregate statistics (page views, referrers) cannot be tied back to an individual.

We rely on a small set of processors to operate the Services: an authentication provider, a managed database host, blockchain infrastructure providers (to read public chain data), an email delivery service (for receipts, invoices, and security alerts), and a billing processor for paid plans. Each receives only the data needed for its function.

Blockchain transactions are recorded on public networks that PaySovra does not control. Anyone can observe amounts, addresses, and timing on-chain. PaySovra features such as address rotation reduce the linkability of a merchant's payment activity but cannot make public blockchains private.

Sensitive configuration is protected with industry-standard controls, including encryption in transit, signed webhooks, scoped API keys, and re-verification before changes to payment-routing settings. No system is perfectly secure; we notify affected users of breaches as required by law.

We retain payment records while a merchant account is active because merchants need them for accounting and order history. Customer contact details collected for an order can be deleted on request — customers can ask the merchant they purchased from, or contact us directly at privacy@paysovra.com and we will handle it with the merchant. Deleted accounts are purged of personal data within a reasonable period, except records we must keep by law.

Depending on where you live (including under the GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email privacy@paysovra.com. We do not discriminate against anyone for exercising privacy rights.

We will post any changes to this policy here and, for material changes, notify merchants by email or dashboard notice. Questions: privacy@paysovra.com.