Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how Bitpayway ("Bitpayway", "we", "us") processes personal data when you visit our websites, create an account in the dashboard, integrate with our API or pay an order in the checkout.

Who this policy applies to​

• Clients: businesses that use Bitpayway to receive payments, and the people who create and manage their accounts in the dashboard.
• Payers: the customers of our clients who pay an order in the checkout.
• Partners: people or businesses that receive part of a multi-destination payment.
• Visitors: anyone who browses our websites, including this documentation.

Data we collect​

Account data​

When you create an account, we collect your name, email address and password. We store the password only as a cryptographic hash, and we record whether your email address has been confirmed.

Business data​

For each business you create, we store its name, webhook URL, redirect URLs, the settlement wallet addresses registered for each stablecoin and network, and the API keys and webhook secret key generated for it.

Order and payment data​

When your application creates an order, we receive the description, amount, stablecoin, network and requestId it sends. When the order is paid, we record the payer's wallet address, the transaction hash, the amounts and the status of the payment.

Multi-destination payment data​

To split payments with a partner, we store the partner's wallet address and the identifier (externalId) your application assigns to that partner.

Support data​

When you open a support ticket, we store its subject, description and the messages exchanged with our team.

Technical data​

Every request to our websites carries technical data, such as the IP address, the browser and the page requested, which our infrastructure providers receive in order to deliver the page. Cloudflare uses the IP address to estimate your country, and we use that country only to show this documentation in Portuguese or English.

Data we do not collect​

We do not perform identity verification (KYC), and we do not ask for identity documents, bank details or payment cards. We never ask for, receive or store the private keys or recovery phrases of any wallet.

Public blockchain data​

Payments are transactions on public blockchains, such as Ethereum and Arbitrum. Wallet addresses, amounts and transaction hashes are recorded on the blockchain permanently and anyone can view them in a block explorer. Neither Bitpayway nor anyone else can change or delete them. A wallet address alone does not identify a person, but it can be linked to one when combined with other information.

How we use personal data​

We do not sell personal data, we do not use it for advertising and we do not send marketing emails without your consent.

Data clients send about payers and partners​

When your application sends us data about your payers or partners, such as order descriptions or partner identifiers, we process it to provide the service to you. You are responsible for having a legal basis to share that data with us and for informing the people it refers to.

Do not include names, email addresses, document numbers or sensitive personal data in order descriptions. The description is shown to the payer in the checkout and is not needed to process the payment.

Who we share data with​

• Service providers that process data on our behalf:
  • Cloudflare, which delivers and protects our websites and estimates the visitor's country.
  • Mailgun, which sends our service emails.
  • Google Fonts, which serves the font used in this documentation and receives the visitor's IP address and browser data.
  • The hosting providers that run our servers and databases.
• Clients: when a payer pays an order, the client that created the order receives the payment data (wallet address, transaction hash, amounts and status) through the dashboard, the API and the webhook.
• Authorities: when required by law, by a court order or by a request from a competent authority.
• Successors: if Bitpayway is involved in a merger, acquisition or sale of its business, the data may be transferred to the successor, which will remain bound by this policy.

When you connect a wallet, such as MetaMask or Coinbase Wallet, the wallet provider processes your data under its own privacy policy. Bitpayway has no control over that processing.

International transfers​

Some of our providers, such as Cloudflare, Mailgun and Google, process data outside Brazil, including in the United States. We transfer personal data abroad only when the transfer is necessary to perform our contract with you or when it is protected by appropriate safeguards.

Cookies and browser storage​

We do not use analytics, advertising or tracking cookies. Our websites store a small amount of data in your browser, only to work:

• This documentation remembers your language (bitpayway-locale), so it does not need to detect your country again.
• The dashboard stores your session tokens, your email address and your language, to keep you signed in.
• The checkout remembers the wallet you connected, so you do not need to connect it again on every page.
• Cloudflare may set strictly necessary cookies to protect our websites against bots and attacks.

You can clear this data in your browser settings at any time. You will then need to sign in or choose the language again.

How long we keep data​

• Account, business and support data: while your account is active. After the account is closed, we keep the data for as long as needed to comply with legal obligations, resolve disputes and enforce our agreements, and then delete or anonymize it.
• Deleted businesses: deleting a business removes it from your account and revokes its API keys, but its orders and payment records are kept. Orders created before the deletion can still be paid, and the records are needed for accounting and to resolve disputes.
• Technical data: our providers keep it for short periods, under their own policies.
• Blockchain data: it is permanent and cannot be deleted by anyone.

Your rights​

You can ask us to:

• confirm whether we process your personal data and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymize, block or delete data that is unnecessary, excessive or processed in breach of the law;
• transfer your data to another provider (portability);
• delete data processed with your consent, and revoke that consent;
• tell you with whom we share your data;
• review processing based on legitimate interest that you object to.

You can also file a complaint with the Brazilian National Data Protection Authority (ANPD). If you live in another country, you may have similar rights under your local law, and you can exercise them through the same channel.

To exercise your rights or to close your account, write to [email protected] from the email address of your account. We may ask for information to confirm your identity. Some data must be kept to comply with the law, and blockchain data cannot be changed. If your request is about an order you paid, we may involve the client that created the order, which is responsible for the purchase.

Security​

We protect personal data with measures such as encrypted connections (HTTPS), password hashing, access control to our systems and signed webhook notifications. No system is completely secure: keep your password, API keys and webhook secret key confidential, and tell us right away if you suspect unauthorized access to your account. If a security incident may cause relevant risk or damage to you, we will notify you and the ANPD as required by law.

Children​

Bitpayway is a service for businesses and is not intended for people under 18. We do not knowingly collect personal data from children or adolescents.

Changes to this policy​

When we update this policy, we change the date at the top of this page. If the change is significant, we will also notify clients by email before it takes effect.

Contact​

For questions, requests or complaints about privacy, write to [email protected]. This is our communication channel for data subjects and for the ANPD.