Privacy notice

What we collect

Dashboard accounts (name, email, password hash), API request logs (IP address, request metadata), payment records created by merchants (amount, currency, customer identifiers and billing details supplied by the merchant, payment method tokens, processor responses) and webhook delivery logs.

Card data

Card numbers entered in the checkout SDK are transmitted directly to the apay vault and the processor. In the sandbox the vault is a mock store and only test cards must be used. Merchants receive tokens and masked data, never full card numbers.

Why

To provide the service, prevent fraud, meet card scheme and partner bank obligations, and support merchants.

Where

Data is processed on apay infrastructure in the European Union (Amsterdam) and by processors and partner banks in the markets you enable.

Retention

Payment records are kept for the period required by the partner processor and applicable law (typically 5 to 7 years). Sandbox data may be deleted at any time. Request deletion or a copy of your data at privacy@apay.to.