PayTo.us ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use and protect it, and the rights you have in relation to it when you use our payment platform, dashboard, payment pages, and related services.
Where we determine the purposes and means of processing your personal data, we act as a data controller. Where we process Buyer data on behalf of a Merchant, that Merchant is the controller and we act as a data processor — see our Data Processing Agreement for details.
1. Information We Collect
Information You Provide
- Account data: name, email address, and password (stored only as a cryptographic hash).
- Merchant/business data: business name, website, products, and payout details.
- Payment data: processed by our Payment Processor (Stripe). We do not store full card numbers; we may retain limited details such as the last four digits, card brand, and expiry for reference.
- Transaction data: order details, amounts, invoices, and purchase history.
- Communications: messages you send us through the contact form, email, or support channels.
Information Collected Automatically
- Usage data: pages visited, features used, and timestamps.
- Device data: browser type, operating system, and IP address.
- Cookies: see our Cookie Policy.
2. How We Use Your Information
- To provide, operate, and maintain the Platform and process payments;
- To create and manage accounts, orders, invoices, subscriptions, and payouts;
- To prevent fraud, secure the Platform, and comply with legal and card-network obligations;
- To provide customer support and respond to your requests; and
- To send service-related and, where permitted, marketing communications.
3. Legal Bases for Processing
Where applicable law (such as the GDPR) requires it, we rely on the following legal bases: performance of a contract; compliance with legal obligations; our legitimate interests in operating and securing the Platform; and your consent, where requested. You may withdraw consent at any time.
4. How We Share Information
We do not sell your personal data. We share it only as needed:
- Payment Processor: Stripe, to process payments and payouts and to prevent fraud.
- Service providers: hosting, analytics, and email providers acting on our instructions.
- Merchants and Buyers: transaction details are shared between the parties to a sale to complete and support it.
- Legal and safety: when required by law or to protect rights, property, or safety.
- Business transfers: in connection with a merger, acquisition, or sale of assets.
5. Payment Data and Security
Card payments are handled by our PCI-DSS-compliant Payment Processor. Sensitive cardholder data is transmitted directly to the Payment Processor and is not stored on our servers. We apply administrative, technical, and organizational safeguards — including encryption in transit and access controls — to protect personal data, though no method of transmission or storage is completely secure.
6. Data Retention
We retain personal data for as long as your account is active and as needed to provide the service, then for the period required to comply with legal, tax, accounting, and dispute-resolution obligations. When data is no longer needed, we delete or anonymize it.
7. Your Rights
Depending on your location, you may have the right to access, correct, delete, or port your personal data; to object to or restrict certain processing; and to lodge a complaint with a supervisory authority. To exercise these rights, contact us using the details below. We will respond within the timeframes required by applicable law.
8. International Data Transfers
Your data may be processed in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
9. Children’s Privacy
The Platform is not intended for individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can remove it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email. The "last updated" date above reflects the latest revision.
11. Contact Us
For privacy questions or to exercise your rights, contact us through our contact form or email privacy@payto.us.