Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data EpPay collects, why, who receives it, how long we keep it and what rights you have. It covers the eppay.io website and merchant dashboard, the EpPay API, the EpPay wallet app, the "EpPay - Crypto Order Sync" app for Shopify, and the e-mails we send to businesses about EpPay. It is written to meet the information duties of the EU and UK General Data Protection Regulation (GDPR, Articles 13 and 14) and of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK, Article 10).

1. Who is responsible

The controller (in KVKK terms, veri sorumlusu) is ZincirX Inc., a Delaware corporation, c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA ("EpPay", "we", "us"), which operates EpPay. For anything about your data, write to info@eppay.io with "Privacy" (or "KVKK") in the subject line.

When you pay a merchant through EpPay, the merchant decides which details its payment page asks for and what it does with your payment. For those details the merchant's own privacy notice also applies, and you can contact the merchant as well as us.

2. What we collect and why

2.1 Merchant accounts

  • Account details: your name and e-mail address; the wallet addresses (and their networks) you set to receive payments; an optional profile photo; and, if you sign in with Google, Apple or Facebook, the account identifier that provider gives us. If you turn on two-factor authentication, we store its settings.
  • Sign-in: the website has no passwords. It signs you in with a single-use link that we e-mail to you (valid once, for 15 minutes), the EpPay app's QR code, Google, Apple or Facebook. For each sign-in link we keep a hash of it (never the link itself), when it was requested and used, and the IP address and browser that asked for it. While you are signed in, your session records your IP address and browser. The EpPay mobile app can still sign in with a password, Google, Apple or your wallet.
  • Linked phone: if you link the EpPay app to your account, we store a code derived from your phone's device identifier (it does not reveal the identifier), the platform, and the result of the device check that Google (Play Integrity) or Apple (DeviceCheck) performs for us.
  • API use: your API keys and a log of the API requests made with them: the endpoint, the request and response content with keys, passwords and other secrets removed, the IP address and browser or client, the result and the time. We also keep daily usage totals for your dashboard.
  • Products: the products, prices, descriptions and images you add.

We use this to run your account and the Service (contract), to keep the Service and your account secure and to detect abuse, for example by alerting you and us when invoices on your key look like an attack (legitimate interests), and to send you sign-in links, verification and security messages.

We do not ask merchants for identity documents. If we ever introduce identity verification, we will update this policy before it applies to you.

2.2 Payments

  • For each invoice: the amount, token and network; the receiving address; the payer's wallet address and the transaction hashes; the platform fee, its recipient and any referral partner's address; the status and times; an optional message; and the IP address of whoever created the invoice.
  • If a payment page asks for them, the buyer's name, e-mail address, phone number and delivery address. They are stored with the payment, shown on that payment's page to anyone who has its link, and visible to our administrators. Do not share a payment link you do not want others to open.

We use payment data to create invoices, check payments on the blockchain, collect our fee, show payments to the merchant and notify the merchant's server (contract, and the merchant's and our legitimate interests); to detect and stop fraud and abuse (legitimate interests); and to keep records the law requires (legal obligation). The notification to the merchant's server includes the payer's wallet address and the transaction hash.

Blockchains are public. Every transfer, with its wallet addresses, amount and time, is recorded permanently on a public blockchain that anyone can read. Neither we nor anyone else can change or delete it.

2.3 The Shopify app

When a merchant installs "EpPay - Crypto Order Sync", we store the shop's myshopify.com domain, the access and refresh tokens Shopify issues to us and when they expire, and the shop's wallet and network settings. For each payment we store the Shopify order ID, the amount, currency, status, network and transaction hash. The app only marks orders as paid; it does not read customers' names, e-mail addresses or delivery addresses from Shopify. When the merchant uninstalls the app, or Shopify sends a shop data deletion request, we delete the shop's record and its payment rows. The EpPay invoices created for the shop's orders, which include the paying customer's wallet address and transaction hash, remain in our payment records (section 2.2). When Shopify sends a customer data request, we list what we hold for that customer's orders; when it sends a customer deletion request, we remove the order ID from the shop's payment rows and the payer's wallet address, IP address, note and any contact details from those invoices, keeping only the amount, time and transaction hash. The access and refresh tokens are stored encrypted.

2.4 The EpPay wallet app

  • Your recovery phrase, private keys and address book are created and stored on your phone in encrypted form and are not sent to us.
  • The app reads balances and sends your transactions through blockchain nodes, so the node providers receive your IP address and wallet addresses.
  • The camera is used to scan QR codes, and fingerprint or face unlock is checked by your phone; neither the images nor your biometric data are sent to us.
  • If you create an account or sign in, we process the account data in section 2.1, plus the wallet addresses you add to your account.
  • The app contains no advertising or analytics tools.
  • "Delete Account" in the app deletes your EpPay account on our servers, as deleting it on the website does (section 6), and then removes the wallet from your phone. In versions released before 4 November 2026 it only removes the wallet from the phone; you can then delete the account in your profile on the website or write to us.
  • If you open a third-party provider from the app to buy crypto-assets, that provider's privacy policy applies.

2.5 Website visitors

Our server records each request: IP address, browser, the page requested, the referring page and the time. We use these logs to run and secure the website (legitimate interests). Our pages load their fonts, code libraries and images from eppay.io itself, and QR codes are drawn on our server, so opening a page sends nothing to other companies, unless you accept analytics cookies (section 8). Cookies and analytics are described in section 8.

2.6 Business contacts we write to

We look for businesses that might want to accept stablecoin payments and send an e-mail about EpPay to their general business mailbox. If your company received one, this is how we got the details (GDPR Article 14):

  • Sources: information companies publish themselves, mainly their public websites. We use AI services (Google Gemini and Anthropic Claude) to suggest businesses, read their public websites and find the general contact address they publish. Where enabled, we also use Hunter.io to find and check the general addresses published for a company's domain.
  • Data: the company's name, website, general business e-mail address (such as info@, sales@ or contact@ on its own domain), country, industry and published phone number; a score and notes produced by AI about how well EpPay may fit the business; the e-mails we send and whether they were delivered or a link in them was clicked (our e-mails contain tracked links, but no tracking pixel); replies; and whether the address bounced or asked not to be contacted. We do not write to personal addresses, do not use people's names and do not contact businesses in Türkiye.
  • Earlier records: until 4 November 2026 we also took names and addresses from public profiles and posts on developer and start-up sites (GitHub, Product Hunt, Hacker News, Dev.to, Indie Hackers). We no longer collect them, and those records are marked so that they are never e-mailed. You can ask us to delete them at any time.
  • AI: our e-mails are written with the help of Google Gemini. Replies are sorted by AI, which also drafts answers; a person approves each answer before it is sent, and an answer drafted with AI says so.
  • Why: to offer our service to businesses (legitimate interests, GDPR Article 6(1)(f)).
  • Your choice: you can object at any time, without giving a reason, with the one-click "Unsubscribe" link in any of our e-mails or by writing to info@eppay.io. We then stop e-mailing the address and keep it on a suppression list only so that we do not contact it again.

2.7 Support and other messages

When you write to us, we keep your message and our reply to answer you and to keep a record of what was agreed (contract and legitimate interests).

4. Who receives your data

We do not sell personal data, and we do not share it for advertising. We share it only as follows:

  • Hostinger: our servers (in Vilnius, Lithuania) and our e-mail.
  • Google: Sign in with Google, the Gemini AI service, Play Integrity device checks and, only if you accept analytics cookies, Google Analytics.
  • Apple (Sign in with Apple, DeviceCheck) and Meta (Facebook Login), when you use them.
  • Anthropic: the Claude AI service, used to research businesses we may contact.
  • Hunter.io, where enabled: to find or check the general business addresses published for a company's domain (section 2.6).
  • Shopify, for shops that use our Shopify app.
  • Blockchain node providers (public RPC services for each network, and our own SciMatic node), which we and the EpPay app query to read and send transactions, and the public blockchains themselves.
  • Merchants: the merchant whose invoice you pay receives the payment details, including your wallet address, and can open its payment page, which shows any contact details you entered there.
  • Authorities and advisers, where the law requires it or to establish or defend legal claims, and professional advisers bound by confidentiality.
  • A buyer of our business, if the Service is sold or transferred, under the same protections.

5. Where your data is processed

Our servers are in Lithuania, in the European Union. ZincirX Inc., which operates EpPay, is a United States company. The recipients in section 4 are based in, or process data in, these countries:

  • Google, Apple, Meta and Anthropic: the United States, and other countries where they operate (Google Analytics for visitors in the EEA and Switzerland is provided by Google Ireland Limited);
  • Shopify: Canada and the United States;
  • Hunter.io (where enabled): France;
  • Hostinger: Lithuania;
  • Blockchain node providers: servers in many countries, usually the one closest to you; public blockchains are copied to computers around the world.

For people in Türkiye, this means that the data we hold about you is stored and processed outside Türkiye.

6. How long we keep data

We keep personal data while your account exists and, after that, only as long as we need it for legal, tax, accounting or fraud-prevention reasons or for a legal claim. Apart from the cases below, we do not yet delete records automatically on a fixed schedule. You can ask us at any time to delete your data by writing to info@eppay.io; we will delete it unless we have to keep it for one of those reasons.

  • Your account, with its API keys, API request log, usage totals, products, linked wallets and sign-in links, is deleted when you delete the account in your profile or we delete it at your request. A linked phone's code is kept, without your account, so that a blocked phone cannot link again.
  • Sign-in link records are deleted automatically 30 days after the link expires.
  • API request log entries are deleted automatically after 90 days.
  • Phone codes of phones that never linked an account are deleted automatically after 90 days without use.
  • Technical logs of our search for businesses (section 2.6) are deleted automatically after 90 days.
  • Records of failed background tasks are deleted automatically after 30 days, and password reset requests after 24 hours.
  • Sessions end when they expire after a period without activity.
  • Payment records (section 2.2), including buyer details entered on a payment page, are transaction records: they are kept after the merchant deletes their account.
  • Shopify shop data is deleted when the app is uninstalled or Shopify asks us to delete it.
  • Business contacts and our e-mails to them (section 2.6) are kept until you object or ask us to delete them. After an objection we keep only your e-mail address, on our suppression list.
  • Server logs are kept as long as needed to run and secure the Service.
  • Analytics: Google keeps analytics data for 14 months.
  • Blockchain records are public and permanent and are outside our control.

7. Your rights

Depending on where you live, you have the right to ask us for access to your data and a copy of it; to correct it; to delete it; to restrict how we use it; to receive it in a machine-readable format; and to object to our use of it based on legitimate interests. You can always object to marketing e-mails. Where we rely on consent, you can withdraw it at any time without affecting what was done before.

Under Article 11 of the KVKK you may also ask whether your data is processed, for what purpose and whether it is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to have corrections or deletions passed on to them; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

To use these rights, write to info@eppay.io. We may ask you to confirm your identity, for example by replying from the e-mail address on your account. We answer within one month (GDPR) and at the latest within 30 days (KVKK Article 13), free of charge. We cannot delete or change records on a public blockchain.

You may complain to a data protection authority, in particular in the country where you live or work. In Türkiye this is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

8. Cookies and analytics

Strictly necessary cookies, which need no consent: the session cookie (eppay_crypto_payment_gateway_session) and the form-security cookie (XSRF-TOKEN), both of which expire after 120 minutes without activity, and, in browsers that ticked the former "Remember me" box, a remember_web_… cookie that keeps you signed in (new sign-ins no longer set it). We also remember your language choice during your visit.

The first time you open one of our public pages (the home page, this policy, support, the terms and the about page) or the sign-in and sign-up screens, a banner asks for your consent. "Reject all" and "Accept all" are equally prominent, and "Preferences" lets you choose each optional category; nothing optional is switched on in advance, and the site works the same whatever you choose. These tools never run in the dashboard, on payment or checkout pages, or on any page that shows account, invoice or wallet data. Your choice is kept in your browser's local storage (zx_consent: your choice and its date) for six months, after which we ask again. You can change it or withdraw your consent at any time from the "Cookie settings" link at the bottom of the page; withdrawing stops the tools and deletes the cookies they set on eppay.io.

Analytics — Google Analytics 4, provided by Google Ireland Limited (for visitors in the EEA and Switzerland) and Google LLC (USA). It measures the pages you visit (with the query string and identifiers removed from the address), page titles, the page you came from, when and how long you visit, interactions such as scrolling and outbound link clicks, your browser, device and language, and an approximate location (country, city) derived from your IP address; Google Analytics 4 does not log or store IP addresses. No name, e-mail address, wallet address, account or user ID is sent to Google, and Google signals and ad personalisation are switched off. It sets the _ga and _ga_<ID> cookies, which stay in your browser for up to 2 years; Google keeps the analytics data for 14 months and then deletes it. The data is processed by Google, including on servers in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Legal basis for these optional tools: your consent (GDPR Art. 6(1)(a) and ePrivacy Directive Art. 5(3); for visitors in Türkiye, explicit consent under KVKK Art. 5(1)). Refusing or withdrawing consent does not affect your use of the site.

Cookie settings

We do not use advertising or conversion-tracking pixels. You can also block or delete cookies in your browser settings; the strictly necessary ones are needed to sign in.

9. Security

Among other measures, connections to our website and API are encrypted (HTTPS); sign-in links are single-use, expire after 15 minutes and are stored only as a hash; Shopify access tokens are stored encrypted; the admin area requires a strong sign-in; secrets are removed from our API request logs; we check Shopify's signature on every Shopify webhook; and we sign the payment notifications we send to merchants. No system is completely secure. If a personal data breach is likely to put you at risk, we will inform you and the competent authorities as the law requires. Keep your e-mail inbox, API keys and recovery phrase safe.

10. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. AI scoring of business contacts (section 2.6) only helps us decide whom to e-mail. Our systems flag unusual invoice patterns, but a person decides whether to block an account.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, write to info@eppay.io and we will delete it.

12. Changes to this policy

We will publish any update on this page with a new "Last updated" date. If a change is material, we will also tell account holders by e-mail or in the dashboard before it applies.

13. Contact

E-mail: info@eppay.io (subject "Privacy" or "KVKK")
Post: ZincirX Inc., c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA

This policy is available in English and Turkish. If the versions differ, the English version applies.