PaysumPrivacy Policy
Effective November 3, 2026
We collect what we need to run the platform, store it in the EU, never sell it, and only share it with the providers that help us run the Service. For buyer data in stores we act for the seller, who decides how it is used.
1. Who we are and our role
Paysum operates Paysum, a platform that lets sellers run online stores for digital products. This policy explains how we handle personal data. We act in two roles:
- As controller for data about our own users (sellers and their team members), visitors to our websites, people who contact us, and people who send abuse or copyright reports.
- As processor for data about buyers that we process on behalf of sellers when they use their stores. The seller is the controller for that data and decides how it is used. Our Data Processing Agreement governs that processing. If you bought from a store, read the seller’s privacy notice, and contact the seller first to exercise your rights.
You can reach us about privacy at [email protected].
2. Data we collect
Data you give us
- Account data: name, username, email address, password (stored only as a one-way hash), profile picture and settings. If you sign in with Google, GitHub or Discord, we receive your basic profile and email from that provider.
- Store data: store name, domain, products, descriptions, policies, team members and integrations you configure, including encrypted credentials for your own payment providers.
- Billing data: plan, invoices and fee records. Card details for plan payments are collected and held by Stripe, not by us.
- Crypto data: withdrawal addresses you provide, store wallet addresses, balances and transaction hashes. Blockchain transactions are public by design.
- Communications: support emails, chat messages, feedback and survey answers.
- Reports: when you report abuse or infringement, your name, email, organization, your report and any evidence you upload.
Data collected automatically
- Technical data: IP address, browser and device type, and session records (device, IP, user agent and last activity) so you can review and sign out of your sessions.
- Usage data: pages visited and actions taken in the dashboard, and error reports when something breaks.
- Cookies and local storage, as described in the Cookie Policy.
Buyer data processed for sellers
When someone buys from a store we process, for the seller: email address, name where provided, order and delivery details, IP address and country (used for fraud checks, tax and VPN detection), Discord ID where a product grants a Discord role, store account details if the buyer creates one, and payment status received from the payment provider. Card and bank details are entered directly with the payment provider and never reach our servers.
3. Why we use it and our legal bases
We process personal data under the EU and UK General Data Protection Regulation (GDPR) for these purposes:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account | Account and contact data | Contract (Art. 6(1)(b)) |
| Bill plans and platform fees | Billing data, transaction records | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| Provide stores, checkout and delivery for sellers | Buyer and order data | Processed for sellers under the Data Processing Agreement |
| Operate crypto wallets and withdrawals | Wallet addresses, transaction hashes, balances | Contract; legal obligation where screening is required |
| Keep the Service secure and prevent fraud and abuse | Technical, usage and order data | Legitimate interests (Art. 6(1)(f)) |
| Handle support, abuse and copyright reports | Messages, report details, evidence | Legitimate interests; legal obligation for notice-and-action duties |
| Send service and security emails | Contact data | Contract; legitimate interests |
| Product news and offers | Contact data, preferences | Consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Improve the Service | Aggregated usage data | Legitimate interests |
| Comply with law and defend legal claims | Any of the above, as needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, those interests are running a secure, reliable service and protecting our users, and we have balanced them against your rights. You can object at any time (see “Your rights”).
We do not sell personal data and do not use it for targeted advertising.
4. Fraud checks and automated decisions
Checkout can block or flag orders automatically, for example when a buyer appears to use a VPN or matches a fraud rule the seller has set. These checks protect sellers and buyers and are part of performing the purchase. They don’t produce legal effects beyond whether a single order goes through, and a blocked buyer can contact the seller for a human review. We do not use personal data for profiling that produces legal or similarly significant effects.
6. Where your data is stored
The Service is hosted in the European Union: our primary database is Supabase (AWS eu-west-1, Ireland) and the application runs on Vercel (Dublin, dub1).
Some providers (for example email delivery and error monitoring) are based in, or may access data from, the United States or other countries outside the European Economic Area. When data is transferred there, we rely on the European Commission’s adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
We keep personal data only as long as we need it for the purposes above:
| Data | Retention |
|---|---|
| Account and store data | While the account is open, then deleted within 30 days of closure |
| Orders, invoices and fee records | Up to 7 years, as accounting and tax law requires |
| Session and security logs | Up to 12 months |
| Error logs | Up to 90 days |
| Support emails | Up to 2 years after the conversation ends |
| Abuse and copyright reports | Up to 3 years after the case is closed |
| Backups | Overwritten on a rolling basis, at most 30 days |
We may keep data longer where needed for an ongoing legal claim or investigation. Buyer data is kept for as long as the seller instructs, and is deleted when the seller’s account is closed, subject to the periods above.
8. How we protect it
We use encryption in transit (TLS) for all traffic, one-way hashing for passwords, encryption for stored payment credentials and wallet keys, access controls on our database, rate limiting, optional two-factor authentication and restricted staff access. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires. See the Security Policy.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- receive data you gave us in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting earlier processing.
Email [email protected]. We will reply within one month, which may be extended by two months for complex requests, and may need to verify your identity first. Some rights are limited, for example where we must keep records by law.
If you are a buyer, the seller controls your order data. Contact them first; if you contact us, we will pass your request on to them.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe the law was infringed. We would appreciate the chance to address your concern first.
10. Notice for US residents
If US state privacy laws such as the California Consumer Privacy Act apply to you, you have similar rights to know, correct and delete your personal information, and not to be discriminated against for exercising them. We do not sell or “share” personal information for cross-context behavioral advertising. The categories, sources, purposes and recipients are described above. Use the contact details above to make a request, or have an authorized agent do it for you.
11. Children
The Service is not directed at children. Sellers must be at least 18, and we do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We will update this policy when our practices change and show the effective date at the top. For material changes we will notify account holders by email or in the dashboard before they take effect.