Privacy Policy

01Who we are and what this covers

Settle operates a non-custodial stablecoin payment platform. This policy explains what data we handle when you use our website, the merchant dashboard, or a hosted checkout page, and the choices you have.

Where we decide why and how data is processed — for merchant accounts, platform security, and abuse prevention — we are the controller. Where we process data about a merchant’s customers on that merchant’s behalf, the merchant is the controller and we act as their processor under our Data Processing Addendum.

02Data we collect

Product updates: when you subscribe, we store your email address, signup source, and the time and version of your consent in Supabase. We use this information to send the product updates you requested. It does not create a merchant account or start a payment. Every email includes a one-click unsubscribe link, and you can also request deletion by contacting support@settlep2p.com.

Merchant accounts: email address (for login and notifications), business name, and the settings you configure — payout wallet addresses and networks, brand colour, checkout and storefront content, uploaded logos and product images, webhook URLs, and API keys. If you invite teammates we store their email address and role.

Optional profile: a display name (a pseudonym is fine), what you do, your country or region, and a preferred contact handle — only if you choose to add them. They are used to personalise your dashboard and to reach you if you ask us to; they are not shown to your customers, your teammates, or on any public page. We do not ask for your legal name, date of birth, phone number, or home address to open an account.

Terms acceptance: the version of the Terms of Service you accepted and the time you accepted it. We do not store your IP address with this record.

Payment sessions: when a customer opens a payment link or invoice we store the invoice details (amount, currency, chain, token), the email or name the customer chooses to provide (optional — merchants can enable anonymous checkout), and the on-chain transaction hash and payer address once payment settles. The latter come from public blockchains and are used to reconcile and prove payment.

Orders, subscriptions, and refunds: where a merchant asks for them, the order details a customer enters — chosen options and quantity, a shipping address, an optional phone number, and order notes. For subscriptions, the subscriber email and renewal status. For refunds, the refund transaction hash and the destination address.

Address suggestions: when a customer types into an order page’s address search, the text typed is sent from our servers to an OpenStreetMap-based lookup service to suggest matching addresses. The customer’s IP address is not forwarded, and the lookup text is not stored by us.

Visit counts: a salted, irreversible hash of the visitor’s IP address — never the IP itself — plus referring page and browser user-agent, deduplicated per day so merchants can count payment-link visits. The hash cannot be reversed and is not used to profile anyone or to follow them across sites.

Dispute messages: the content of messages exchanged between a merchant and a customer in a dispute thread.

Operational logs: security and abuse-prevention records such as rate-limit events, webhook delivery results, an audit trail of actions taken in a merchant account, and server error reports. Error reports record the page or route and the error message — never request bodies, form contents, or query strings.

03What we deliberately do not collect

We do not collect wallet private keys or seed phrases — we never see them and could not act on them if we did. We do not collect payment card or bank account details. We run no third-party advertising, no social pixels, no session-replay tooling, and no external analytics scripts, including on checkout pages. Customers can pay without creating an account, and merchants can switch off email collection entirely.

04How we use data, and our legal bases

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data or share it for cross-context behavioural advertising.

05Who we share data with

We rely on a small number of infrastructure providers — currently Supabase (accounts, database, and image storage), Vercel (application hosting), Alchemy and Helius (blockchain data and settlement detection), Resend (transactional email), and komoot’s Photon service (OpenStreetMap address suggestions on order pages). We also fetch public coin prices from CoinGecko to estimate network fees; no personal data is sent with those requests. Each provider processes data only as needed to deliver its function. You can request the current list, with the data each one handles, at any time by writing to support@settlep2p.com.

We may also disclose data where required by valid legal process, to protect our rights or the safety of others, or in connection with a merger or acquisition — in which case we will give notice before your data becomes subject to a different policy.

06Blockchain data is permanent

Payments settle on public blockchains, where transaction details — amounts, wallet addresses, timestamps, hashes — are permanently and publicly visible by design, replicated worldwide. Settle cannot delete, amend, or restrict on-chain data, and neither can anyone else. We associate on-chain transactions with invoices solely to reconcile payments. Please take this into account before paying: a wallet address may be linkable to other activity you have conducted with it.

07International transfers

Our providers may process data outside your country, including in the United States. Where personal data originating in the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, the transfer is made under Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable.

08Retention

You can clear any optional profile field yourself at any time in Settings. Merchant account data is retained while your account is active and for up to ninety days after closure, except where longer retention is required for tax, accounting, or legal purposes. Invoice and settlement records are retained for the period required by applicable financial record-keeping rules. Visit-count hashes are retained in aggregated form only. Data already written to public blockchains cannot be deleted.

09Your rights

Depending on where you live, you may have the right to access a copy of your personal data, to correct inaccurate data, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it. Where we rely on legitimate interests you may object at any time.

Exercise any of these by writing to support@settlep2p.com. We will respond within the period required by applicable law and will not discriminate against you for making a request. If you are a customer of a merchant rather than a merchant yourself, contact that merchant first — they control your data — and we will assist them. You also have the right to complain to your local data protection authority.

10Security

We apply technical and organisational measures appropriate to the risk, including TLS in transit, encryption at rest, database-enforced tenant isolation via Row Level Security, HMAC verification of webhooks, and strict separation of privileged keys from anything shipped to a browser. Our Security Policy describes these in detail and explains how to report a vulnerability.

11Children

The service is not directed to children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact support@settlep2p.com and we will delete it.

12Cookies

We set only strictly necessary and functional cookies, all of them for signed-in merchants: to keep your session alive, remember which business you are working in, and remember whether you are viewing live or test data. There are no advertising or analytics cookies anywhere on the platform. See the Cookie Policy for the full list.

13Changes and contact

If this policy changes materially we will announce the update on the site and, where we hold your email address, notify you. Continued use after changes take effect constitutes acceptance. Questions go to support@settlep2p.com.