Privacy Policy
Last updated: November 14, 2026
This Privacy Policy explains what information PayGate (the "Service") collects, how we use it, and the choices you have. It applies to merchants who create an account and to the end users who complete a checkout through the Service.
1. Information we collect
Account information: when you register, we collect your name, email address, and password (stored as a salted hash, never in plain text). When you create an organization, we store its name and the roles of its members.
App and integration data: when you register an app, we store its name, slug, chosen auth strategy, webhook URL, and (if applicable) Firebase project configuration.
Payment provider credentials: when you connect Stripe or PayOS, your API keys/secrets are encrypted at rest using a dedicated encryption key. We never expose these credentials in plaintext through the dashboard once saved.
Transaction data: for each checkout session, we store the amount, currency, status, timestamps, and the external reference your application provided. We do not collect or store full cardholder data (card numbers, CVV) — that is entered directly with the provider (Stripe/PayOS) and never passes through our servers in raw form.
Usage and log data: like most web services, we log request metadata (timestamps, IP address, endpoint called) for security monitoring and debugging.
2. How we use this information
- To operate the Service: authenticate you, route checkout sessions to the correct provider, and render the hosted checkout page.
- To send transactional emails: organization invitations, password reset links, and similar account-related notices.
- To detect and prevent fraud, abuse, or violations of our Terms of Service.
- To provide support when you contact us.
- To improve the reliability and features of the Service.
We do not use your data for third-party advertising, and we do not sell your personal data.
3. How we share information
We share the minimum data necessary with the payment providers you connect (Stripe, PayOS) so they can process a transaction — for example, the amount, currency, and a description. We may also share information with infrastructure providers who help us operate the Service (e.g. hosting, email delivery, object storage for uploaded app icons), under confidentiality obligations. We may disclose information if required by law or to protect the rights, property, or safety of PayGate, our users, or the public.
4. Data retention
We retain account and transaction data for as long as your account remains active, and for a reasonable period afterward as needed for accounting, fraud prevention, and legal compliance purposes. Password reset tokens are single-use and expire automatically within one hour of being issued.
5. Security
Provider credentials and API secrets are encrypted at rest. Passwords are hashed, never stored in plain text. Access to production infrastructure is restricted to authorized personnel. No method of transmission or storage is 100% secure — if you believe your account has been compromised, contact us immediately using the details below.
6. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data. To exercise any of these rights, contact us using the details below — we will respond within a reasonable time.
7. Cookies and sessions
We use a session cookie to keep you signed in to the dashboard. We do not use third-party advertising or tracking cookies on this Service.
8. Children's privacy
The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.
9. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will make reasonable efforts to notify you (for example, by email or an in-app notice) before they take effect.
10. Contact
Questions about this policy, or requests regarding your personal data, can be sent to paygate@shplinks.com.