JoPay Labs Privacy Policy

This Privacy Policy explains how JoPay BV, acting in its JoPay Labs (“Labs”, “we”, “us”) capacity, collects, uses, and shares information when you use the Labs interface — the website, applications, merchant dashboard, partner portal, and related operator services (collectively, the “Interface”). Operated by JoPay BV, registered in the Netherlands. Labs is the data controller for Interface-collected personal data.

This policy covers the Interface. It does not cover the JoPay Protocol itself — the immutable smart contracts that record payments on public blockchains. The Protocol is autonomous code with no operator and no data controller; a description lives in the JoPay Protocol v1 spec, and a plain-English explainer lives at /about.

If you have questions, contact us at privacy@jopay.app.

1) What we collect

2) What the Protocol records vs what Labs records

3) How we use your information

Labs uses Interface data to:

• Provide and operate the Interface (account access, payment link creation, tracking)
• Route you to the correct portal (Labs or your partner) when you log in
• Communicate with you (service messages, support responses)
• Improve the Interface (analytics, debugging, performance)
• Prevent fraud, abuse, and security incidents
• Comply with legal obligations that apply to Labs as an Interface operator

4) Legal bases (EEA/UK)

If you are in the EEA/UK, Labs processes personal data under one or more of these bases:

• Contract (to provide the Interface services you request)
• Legitimate interests (security, fraud prevention, basic service improvement)
• Consent (marketing analytics cookies and tracking, where required)
• Legal obligation (compliance, record-keeping)

5) How we share information

Labs may share information with:

• Service providers (hosting, analytics, email delivery, customer support tools)
• Partners (if you are onboarded/managed by a partner, to provide support and Interface services)
• Compliance and verification providers (if KYC/KYB is required for Interface features like cash-out or higher limits)
• Legal authorities (if required by law)

We do not sell your personal data.

6) Cookies and analytics

The Interface uses cookies and similar technologies to:

• keep you signed in (where applicable),
• understand usage,
• improve site performance.

You can control cookies through your browser settings. We use analytics cookies only when you consent. We may also use limited third-party cookies for anti-bot and spam reduction on public forms.

7) Data retention

Labs retains Interface personal data only as long as necessary for:

• providing the Interface,
• legal and compliance obligations that apply to Labs,
• resolving disputes and enforcing agreements.

Retention periods may vary by data type.

On-chain data: information recorded by the Protocol on public blockchains is retained by the blockchain indefinitely, not by Labs. Labs cannot set a retention period for on-chain data.

8) Security

Labs uses reasonable administrative, technical, and physical safeguards to protect Interface data. However, no method of transmission or storage is 100% secure.

Wallet security: You are responsible for securing your wallet and private keys. Labs does not store private keys and cannot recover a wallet whose keys have been lost or compromised.

9) International transfers

Your Interface information may be processed in countries other than your own. Where required, Labs uses appropriate safeguards for international transfers (e.g., Standard Contractual Clauses).

10) Your rights (EEA/UK)

Depending on your location, you may have rights regarding Interface data Labs holds about you, including rights to:

• access, correct, or delete your personal data,
• object to or restrict processing,
• data portability,
• withdraw consent (where processing is based on consent),
• lodge a complaint with a supervisory authority.

Scope of rights: These rights apply to data Labs controls as operator of the Interface. Labs cannot erase or alter records kept by the JoPay Protocol on public blockchains — those records are outside Labs’ control and are public by design of the blockchain itself. A request to Labs to “delete a blockchain transaction” cannot be honoured by Labs because Labs does not control the blockchain.

To exercise rights, contact privacy@jopay.app or submit a request below.

11) Children

The Interface is not intended for children under 18. Labs does not knowingly collect data from children.

12) Partner and third-party services

Partners and third parties (wallets, networks, cash-out providers) may process data under their own policies. Your use of those services is governed by their terms and privacy policies. The blockchains the Protocol runs on are public networks not operated by Labs.

13) Changes to this policy

We may update this Privacy Policy from time to time. We will post updates and revise the “Last updated” date and disclosure version.