Privacy Policy

1. Who we are

Rothcroft LLC, registered at Albuquerque, Bernalillo County, NM 87110, USA, is the controller of the personal data described here. Contact us about privacy at [email protected].

This policy applies to merchants who use the WentPay dashboard and API, payers who sign in at the WentPay checkout, and visitors to our website. We handle personal data in line with applicable data protection laws, such as the EU and UK GDPR and Türkiye's Personal Data Protection Law No. 6698 (KVKK).

2. What we collect

From merchants:

• your name, work email, business name, website and business details you enter in settings;
• your password (stored only as a salted hash) and your authenticator secret (encrypted);
• the date, time, IP address and browser of sign-ins, active sessions and security-sensitive actions such as payout address changes and key rotations;
• which version of the Merchant Agreement and this policy you accepted, when, and from which IP address.

From payers:

• your email address and the one-time sign-in codes we send (kept only as hashes, and only for a few minutes);
• the wallet addresses you link, the wallet app you used, and the message you signed to prove ownership;
• the payments you make through WentPay: merchant, amount, asset, network, the address paid from and to, the transaction hash, and timing;
• which version of the Payer Terms and this policy you accepted, when, and from which IP address.

From everyone: basic technical logs (IP address, browser, pages requested and errors), which we use to run and protect the service.

We don't ask for, collect or store seed phrases or private keys, ever.

3. How we use it, and why we're allowed to

• To provide the service you signed up for: sign-in, matching your wallets to a merchant, preparing and confirming payments, and notifying merchants (performance of a contract).
• To keep accounts and payments secure, prevent fraud, and screen wallet addresses against sanctions lists (our legitimate interests, and legal obligations where they apply).
• To keep records we're required to keep, and to respond to lawful requests (legal obligation).
• To send service messages such as sign-in codes, payout address change alerts and receipts (performance of a contract).

We don't sell personal data, don't use it for advertising, and don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share it with

• The merchant you pay receives your email address and the payment details, so they can fulfil your order. They handle that information under their own privacy notice.
• Service providers who process data for us under contract: hosting and databases, email delivery, blockchain node providers and sanctions screening providers.
• Authorities, courts or others where the law requires it, or to protect the rights and safety of our users or of WentPay.
• A buyer or successor if our business is sold or reorganised, under this policy.

5. Blockchains are public

Payments are recorded on public blockchains. Wallet addresses, amounts and transactions on a blockchain can be seen by anyone, are permanent, and can't be changed or deleted by us or anyone else. When we delete your WentPay account, the link we kept between your email and your wallet addresses is removed, but the on-chain records remain.

6. International transfers

Our service providers may process data in other countries. Where data leaves your country's protection, we use the safeguards the law requires, such as standard contractual clauses.

7. How long we keep it

• Sign-in codes: until used, or 10 minutes at most. Sessions: until they expire or you sign out.
• Account data: while your account is open, then deleted or anonymised within a reasonable period unless we must keep it.
• Payment records, legal acceptance records and security logs: for as long as needed to meet legal, accounting and dispute obligations.

8. Security

Passwords and API secret keys are stored only as hashes; authenticator secrets and webhook signing secrets are encrypted; merchants must use two-step verification; and access to production data is limited to people who need it. No system is perfectly secure, so please keep your own email, devices and wallets secure too.

9. Your rights

Depending on where you live, you can ask to access, correct or delete your personal data, to receive a copy of it, to restrict or object to some uses, and to withdraw consent where we rely on it. Email [email protected]. You can also complain to your data protection authority, for example the KVKK Board in Türkiye or the supervisory authority where you live.

10. Cookies

We use only cookies that the service needs to work: a session cookie that keeps merchants signed in to the dashboard, and one that keeps payers signed in at the checkout. Both are HTTP-only and can't be read by scripts on the page. We don't use advertising or tracking cookies.

11. Children

WentPay isn't for anyone under 18, and we don't knowingly collect their data.

12. Changes to this policy

If we change this policy in a way that matters, we'll tell you before it applies, for example by email or at your next sign-in. The version you accepted is recorded with your account.