Privacy notice

Who we are

Perly Pay is a service of Perly: [To confirm: the legal entity's name, registered address and company number].

Questions about your data, or a request: the contact form, or hi@perly.io.

Two roles

For your account — your email, your team, your settings, your plan — Perly is the controller.

For your buyers — their email, name, what they bought, the addresses they paid from — the business is the controller and Perly is its processor. We use it only to run that business's checkout, receipts, refunds and screening, on its instructions.

We never hold money

Perly Pay is non-custodial. Payments go from the buyer straight to the business's own wallet. We only ever see public keys and public transactions; never a private key or a seed phrase.

What we collect from businesses

• Sign-in: your email and when you sign in. Supabase Auth, which runs sign-in, also records each session's IP address and browser (user agent), and the IP address of each sign-in.
• Your business: its name, website, country, support email, logo, colour and time zone; your team's emails and roles; your notification choices; which version of the Terms and this notice it accepted, when, and by whom.
• Your wallets: public keys (encrypted at rest) and the addresses made from them.
• Activity: an audit log of who did what in the business, with the IP address of the person acting.
• Developers: API keys (we keep only a hash), webhook addresses, and the webhook messages we send.
• Abuse limits: short-lived counters keyed by IP address or email, to slow down code guessing and bulk email.
• Your plan: Perly's invoices and receipts to your business.
• Telegram, when an owner connects it: the chat's id and the name Telegram shows for it, kept while it stays connected (Disconnect, /stop in the chat, or blocking the bot removes them), and the messages we send there — payment, refund, review, webhook and plan notices, wallet changes, and the codes that approve owner changes. These notices are never emailed.
• Messages to us: what you write in the contact form, the email to answer you at, the page you sent it from and, if you are signed in, your sign-in and business. From anyone, business or not.

What we collect about buyers

• Email, if the business asks for it (it can require it, make it optional, or not ask), and a name, if the payment link asks for one.
• What was bought: invoices, amounts, receipts, subscriptions, license keys, and the device names given to license activations.
• Country and language, and other details, when the business sends them.
• Blockchain data: the address paid to, the sending addresses, transaction ids, and a refund address if a refund is asked for; and the screening answers for those addresses.
• Portal sign-in: a buyer who signs in to manage subscriptions gets a sign-in account (email, sign-in times, and each session's IP address and browser).

Cookies and trackers

No advertising or analytics trackers on pay.perly.io or in the checkout. Cookies only keep you signed in and remember your choices in the dashboard.

Why

• To run the service: make payment addresses, watch the chains, and send receipts, invoices, sign-in codes and notices.
• To screen payments against sanctions lists, as the law and our Acceptable use policy require.
• To keep the service safe: sign-in checks, limits on guessing and on email, and an audit trail.
• To bill businesses for their plan.
• [To confirm: the legal basis for each purpose, with a lawyer]

Who processes it

• Supabase — database and sign-in: everything above. [To confirm: the hosting region]
• Hosting of pay.perly.io and its background worker: [To confirm: the host and its region]
• Resend — sends our email (receipts, invoices, reminders, refund requests, team invites, owners' security alerts): the address and the letter. [To confirm: whether sign-in codes go through Resend too]
• Telegram — delivers a business's notices and owner codes to the chat it connected: the chat id and the text of each message (amounts, networks, short invoice ids, the business's name; never a buyer's details); and tells Perly's admins, through a bot of their own, that a message came through the contact form: its kind and first words, email addresses masked — never the sender's own address, and nothing of a security report.
• Cloudflare Turnstile — the bot check on sign-in forms and the contact form. Cloudflare sees the visitor's IP address and browser while the check runs.
• TRM Labs — sanctions screening. It receives sending addresses and refund addresses, never names or emails.
• Blockchain data providers — onfinality.io for Base, Arbitrum, Optimism and Ethereum, and base.org on Base's test network. Where Perly turns them on: mempool.space and mempool.emzy.de for bitcoin, publicnode.com and the networks' own RPCs (arbitrum.io, optimism.io), or nodes Perly runs or rents. They receive addresses and transaction ids, never names or emails.
• No personal data sent: the bitcoin and ether prices are read on chain from Chainlink's feeds and Uniswap's pools, and the euro's from Chainlink and the European Central Bank (ecb.europa.eu, source: ECB); OFAC's list and ScamSniffer's list are downloaded from GitHub. We only read from them.
• We'll give 30 days' notice here before adding a processor.

How long we keep it

• IP addresses in the audit log: 30 days.
• IP addresses in sign-in records: 30 days.
• Sign-in sessions, with their IP address and browser: deleted after 30 days unused.
• Emails we sent (address and contents): 90 days.
• Telegram messages we sent: 90 days.
• Codes sent to Telegram, once expired: 1 day.
• Webhook messages and their delivery records: 90 days.
• Stored API answers (for Idempotency-Key retries): 2 days.
• Team invites, once accepted or expired: 30 days.
• Buyer portal links, once expired: 1 day.
• Buyer sign-in accounts (a sign-in that belongs to no business's team), unused: deleted after 90 days, unless a subscription on that email is still running.
• Messages sent through the contact form: 180 days.
• Security reports sent through the contact form: 1 year.
• Audit log (who did what in a business): 2 years.
• Business records (invoices, payments, customers, receipts, screening answers): while the business's account is open; deleted with the business. An issued receipt is never changed or deleted before that.
• Perly's own invoices and receipts to a business: [To confirm: as long as tax law requires]
• Addresses that bounced or complained: kept, so they are never emailed again.
• Backups: no longer than 30 days. [To confirm: once hosting is chosen]

Deleting

• A business: its owner can delete it in Settings → Delete this business. It is immediate: everything the business holds is deleted. It is refused while live money may still move (an open invoice or a refund being sent). If it was the owner's only business, their sign-in is deleted too.
• A person on a team: ask us, and we delete the sign-in. What they did stays in the business's audit log, without their name.
• A buyer: ask the business you paid; it can erase you from its customer page (Erase personal data). Or write to us through the contact form, and we'll pass it on to the business or act on its instruction. Your email, name and other details go from everything that business holds with us. Amounts, receipt numbers, transactions and screening answers stay, with no name or email on them: they are the business's books and the sanctions record.

Public blockchains

Payments are recorded on public blockchains by design. Anyone can see an address's transactions, and nobody — not us, not the business — can change or erase them. Erasing a buyer removes what links them to those transactions in our records, not the transactions themselves.

Your rights

Ask us for a copy, a correction or deletion at any time, through the contact form. Buyers: ask the business you paid — it controls your data, and we'll help it answer.

You can also complain to a data-protection authority: [To confirm: which one]