Privacy Policy

Merchant accounts

• Sign-in details: your email address and password (we store only a salted Argon2 hash, never the password itself); or, if you sign in with Google, the email address and name Google shares with us; or, if you sign in with a crypto wallet, your public wallet address.
• Business profile: the business name, website, and industry you choose to provide.
• Security settings: two-factor authentication secrets and recovery codes (encrypted at rest), and team members you invite by email along with their roles.
• Referral relationships: if you joined through another merchant's referral link, which merchant referred you.

Configuration you provide

• Payout wallet addresses for each blockchain, revenue-split and affiliate settings, subscription plans, coupons, and payment links.
• API keys (secret keys are encrypted at rest), webhook endpoints and signing secrets, and notification channels you connect, such as a Telegram bot, Discord, Slack, or Feishu webhooks.

Payment and blockchain data

• Order details a merchant sends us when creating a payment, such as the amount, currency, merchant order ID, metadata, and redirect URL.
• Public blockchain data about payments: payer wallet addresses, transaction hashes, amounts, tokens, networks, and timestamps. This information is publicly available on the blockchain; we index the parts relevant to payments made through the Service.
• For subscriptions, the subscriber's wallet address and the on-chain subscription vault associated with it.

Customers who pay through Finality

Customers do not need an account to pay. When you pay through a checkout page, we process your public wallet address and transaction data as described above, and we record anonymous checkout interactions (for example, that the page was viewed and which network or wallet was selected) using a random identifier stored in your browser. We do not ask payers for names, emails, or identity documents. If a merchant collects such information from you, that is governed by the merchant's own privacy policy.

Usage, device, and security data

• IP address, browser type, and request metadata, used for security, rate limiting, abuse prevention, and an audit log of sign-ins and sensitive account changes.
• Aggregated, cookieless website analytics provided by Cloudflare Web Analytics (for example, page views, referring sites, country, and device type).

Communications

When you contact us by email or Telegram, we keep the messages so we can help you. We send transactional emails such as verification codes, welcome messages, and security or account notices.

• To provide the Service: create accounts, generate payment addresses, detect and settle payments on-chain, run subscriptions, deliver webhooks and notifications, and show dashboards, invoices, and receipts.
• To keep the Service secure: verify email ownership, authenticate users, enforce two-factor authentication, detect fraud and abuse, prevent attacks, and keep audit logs.
• For risk and compliance screening: we check payer wallet addresses against public sanctions lists and other risk signals, and we may show merchants a risk assessment of the addresses that pay them. We may decline to relay settlement for payments linked to sanctioned addresses where required by law.
• To communicate with you: send verification codes, service and security notices, and responses to your requests. We do not send marketing emails without your consent, and you can unsubscribe at any time.
• To improve the Service: understand aggregate usage and fix problems.
• To meet legal obligations and to establish, exercise, or defend legal claims.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use automated decision-making that produces legal effects about you.

If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for); legitimate interests (to keep the Service secure, prevent fraud, screen for sanctions risk, and improve the Service, balanced against your rights); legal obligation (to comply with applicable law); and consent (where we ask for it, which you can withdraw at any time).

• Service providers that help us run the Service, under contracts that limit their use of the data: Cloudflare (content delivery, security, and analytics), Google (sign-in with Google), Resend (email delivery), and our infrastructure and hosting providers.
• Merchants: when you pay a merchant, that merchant receives information about the payment, including your wallet address, the amount, and the transaction hash. Merchants are responsible for how they use it.
• Destinations you configure: as a merchant, we send payment events to the webhook endpoints and notification channels you connect.
• Blockchain networks: settlement transactions are broadcast to public blockchains, where they become permanently visible to everyone.
• Legal and safety reasons: when required by law or valid legal process, or when needed to protect the rights, property, or safety of Finality, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Blockchains are public, decentralized ledgers. Wallet addresses, transactions, and amounts recorded on a blockchain are visible to anyone and cannot be changed or erased — by us or by anyone else. Requests to delete data from a blockchain cannot be fulfilled. We can delete the copies we hold in our own systems, subject to the retention rules below.

We do not use advertising or cross-site tracking cookies. Our website analytics are cookieless. We use your browser's local storage for things the Service needs to work, such as keeping you signed in, remembering your language and theme, and the anonymous checkout identifier described above. Cloudflare may set strictly necessary security cookies. If you choose to sign in with Google, Google may set its own cookies under Google's privacy policy.

If you sign in with Google, we receive your email address and name from Google and use them only to create and secure your Finality account. We do not request access to your Gmail, Drive, contacts, or any other Google data. Finality's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Account and configuration data is kept for as long as your account is active. When you ask us to delete your account, we delete or anonymize it within 30 days, except for information we must keep.
• Payment, settlement, and invoice records are kept as long as needed for accounting, tax, legal, and dispute-resolution purposes.
• Security and audit logs are generally kept for up to 12 months.
• Email verification codes expire after 10 minutes and are not stored after use.

We protect information with measures appropriate to the risk, including encryption in transit (TLS), Argon2 password hashing, encryption at rest for API secret keys and two-factor secrets, optional two-factor authentication and role-based team access, email verification for sensitive changes such as payout addresses, rate limiting, and restricted access to production systems. Because the Service is non-custodial, we never hold the private keys to merchant or customer funds. No system is perfectly secure, and you are responsible for keeping your passwords, API keys, and wallet keys safe.

Finality's servers are located in the United States, and our service providers may process data in other countries. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete, and correct personal information and to opt out of its sale or sharing — we do not sell or share personal information as those terms are defined by California law. We will not discriminate against you for exercising your rights.

To make a request, email [email protected] from the address associated with your account (or prove control of your wallet address). We will respond within the time required by law, usually within 30 days. You may also lodge a complaint with your local data protection authority.

Merchants decide what to sell, whom to sell to, and what information to collect from their own customers. For that information, the merchant is responsible as an independent controller, and the merchant's own privacy policy applies. If you are a customer and want to exercise rights over data a merchant holds about you, please contact that merchant directly; we will help where we can.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify merchants by email or in the dashboard before the changes take effect, and we will always update the "Last updated" date above.

Questions or requests about this Privacy Policy can be sent to Finality at [email protected]. You can also reach our support team on Telegram at @finality_support.