Privacy Policy
What personal data Stack Finance sp. z o.o. collects from merchants, customers and visitors, why, who processes it, how long it is kept and your rights.
Effective 13 October 2026. Stack Finance sp. z o.o. (KRS 0001077664, REGON 527271484, NIP 7011181285, Hoża 86, apt. 210, 00-682 Warsaw, Poland) ("we") is the controller of the personal data described here, collected through nervixpay.live, the NervixPay desktop app, the API and the emails we send. Contact: seme@kryptostack.com.
What we collect
| Who | Data | Why |
|---|---|---|
| Merchants | Email address and password (stored as a hash by our authentication provider), sign-in provider identity if you use GitHub, Google or Telegram, business name, category, description, address, support contact details | To run your account, show your business on checkouts and receipts, and contact you |
| Merchants | Receiving wallet addresses and the signed ownership proofs you provide when you connect a wallet | To make sure payments go only to a wallet you control |
| Merchants | Identity or business documents and a selfie, only when we ask you to verify | To meet our verification obligations and prevent fraud |
| Merchants | Payment links, products, prices, embed settings, webhook endpoints, API keys and AI-agent credentials you create | To provide the Service you configured |
| Customers | The payment: amount, network, coin, the paying address and transaction hash as they appear on the public blockchain, and the order it belongs to | To confirm the payment to the merchant and show its status to you |
| Customers | Name and email address, only if you enter them for a receipt or to link the payment to a merchant account | To send your receipt and let the merchant attribute the payment |
| Merchants and customers | Support chat messages and attachments | To answer your request |
| Everyone | IP address, browser type, request time and the pages or endpoints you call, kept in short-lived logs | Security, abuse prevention and rate limiting |
We use session cookies that keep you signed in and protect forms against forgery. We do not use advertising or cross-site tracking cookies.
Why we may process it
- To perform our agreement with you (merchant accounts, checkouts, receipts, support).
- Our legitimate interests in keeping the Service secure, preventing fraud and improving it.
- Legal obligations, including record-keeping, identity verification and responding to lawful requests.
- Your consent, where you choose to list your business publicly or to receive a receipt by email. You can withdraw it at any time.
What is public
Blockchains are public by design: anyone can see the addresses and amounts of any transaction. On PayScan we publish confirmed payments with the amount, network, the item name the merchant wrote and a shortened receiving address. We never publish customer names or emails, invoice access codes, identity documents or full wallet addresses. A merchant's business name, description and website appear in the directory only after the merchant turns the listing on.
Who processes data for us
- Supabase (database and authentication), hosted in the European Union.
- Vercel (application hosting and content delivery).
- Resend (transactional email: receipts, confirmation codes, merchant notifications).
- Blockchain node and indexer providers, which receive wallet addresses and transaction hashes so we can verify transfers. They see what the blockchain already makes public.
- WalletConnect and TON Connect relays when you connect a wallet; they relay the connection, not your keys.
- An optional AI advisor that ranks setup guidance and classifies PayScan searches. It receives only coarse flags, never payment data, business names or documents.
We do not sell personal data. We share it only with these processors, with a merchant for the payments made to them, or when the law requires.
How long we keep it
- Account and business data: while your account exists, then as long as tax and record-keeping law requires.
- Payment records: for the life of the merchant account and the legal retention period, because they are the merchant's accounting records.
- Identity documents: only as long as the review and our legal obligations require.
- Support messages: 24 months after the conversation ends.
- Technical logs and rate-limit records: days, not months.
Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. Write to seme@kryptostack.com; merchants can also use Support chat. We answer within one month. If you are in the European Economic Area or the United Kingdom you may also complain to your data protection authority. Data recorded on a blockchain cannot be deleted by us or by anyone.
Security
Data travels only over encrypted connections. Every database table is protected by row-level security so a merchant can only ever read their own records. Administrators must use two-factor authentication. Wallet ownership is proven by signature, and changing where payments go requires a code sent to your verified email. NervixPay never holds private keys or funds.
Children
The Service is for businesses and adults. We do not knowingly collect data from anyone under 18.
Changes
We will post changes to this policy here and update the effective date. For material changes we will notify merchants inside their account.