Privacy Policy

Privacy Policy

Last Updated: [March 15th, 2026]

This Privacy Policy explains how [HashKey Master Account] ("we", "us" or "our") collects, uses, discloses, and otherwise processes personal data when you access or use our services, websites, applications, APIs, dashboards, and related features (collectively, the "Service").

This Privacy Policy should be read together with our Terms of Service.

Scope and Roles

Depending on how you use the Service, you may be:

  • a Merchant (e.g., a business generating Payment Requests for customers);
  • a Payer (e.g., an end user who scans a QR code or follows a link to complete a payment using your own wallet); or
  • an authorized representative/administrator of a Merchant.

Important: We provides non-custodial technical and information services. we does not hold, store, receive, control, or transfer digital assets on your behalf, and does not control private keys or wallets. Any blockchain transaction is initiated by the Payer using their own wallet and recorded on the relevant blockchain network.

Personal Data We Collect

We may collect the following categories of personal data, depending on how the Service is used:

Data you provide directly

  • Account and profile data (Merchants/admins): name, business name, role/title, email, credentials, account settings.
  • Support and communications: messages, emails, records, and content you submit to customer support or account teams.
  • Compliance-related information (if applicable): information we request to comply with law and manage risk, such as business profile, proof of authority, or limited identity verification information. (We aim to request only what is reasonably necessary.)

Data generated through use of the Service

  • Payment Request data: Payment Request identifiers, invoice/order reference, requested amount, token type, network selection, merchant-provided recipient address (if any), and metadata you configure (e.g., memo/tag/reference).
  • Status Notification data: transaction hash, confirmation count/status labels, timestamps, and other network-derived indicators associated with a Payment Request (to the extent available).
  • Technical logs and device data: IP address, device identifiers, browser type, operating system, app version, API logs, timestamps, and diagnostic data.
  • Security and fraud signals: suspicious activity indicators, rate-limiting triggers, and audit logs.

On-chain and public blockchain data

Blockchain networks are public ledgers. We may retrieve and process public blockchain data (e.g., transaction hashes, wallet addresses, timestamps, and confirmations) to provide Status Notifications and operational support. We do not control blockchain networks, and on-chain data may be visible to anyone and may be irreversible.

Cookies and similar technologies

If you use our website or dashboards, we may use cookies/local storage and similar technologies for essential functionality, analytics, and security. You can control cookies through your browser settings, subject to the limitations described in Section 10.

How We Use Personal Data

We use personal data for the following purposes:

Provide and operate the Service

  • display Merchant-provided recipient addresses/payment instructions;
  • provide Status Notifications and service communications;
  • administer Merchant accounts and provide dashboards/APIs.

Security, integrity, and fraud prevention

  • detect and prevent malicious activity, unauthorized access, abuse, and technical failures;
  • maintain logs for debugging, incident response, and audit.

Compliance and risk management

  • comply with applicable laws and regulatory obligations (including AML/CFT and sanctions compliance where applicable);
  • respond to lawful requests and maintain appropriate records.

Support and communications

  • respond to inquiries, provide customer support, and send service-related notices (e.g., incident updates, feature changes).

Improve the Service

  • analyze usage, diagnose issues, and develop new features (using aggregated or de-identified data where feasible).

Business operations

  • billing and reconciliation (including Network Fee reimbursements, where applicable), account management, and internal reporting.

Legal Bases (where applicable)

Where required by applicable law, we process personal data based on one or more legal bases, such as:

  • performance of a contract (e.g., providing the Service);
  • legitimate interests (e.g., security, fraud prevention, product improvement);
  • compliance with legal obligations;
  • consent (e.g., certain cookies or marketing communications, where required).

How We Share Personal Data

We may share personal data in the following circumstances:

Service providers and vendors

We may share personal data with third-party service providers who support the Service (e.g., cloud hosting, security monitoring, analytics, customer support tooling), subject to contractual obligations consistent with this Privacy Policy.

Blockchain networks and third parties you choose

When you initiate or broadcast blockchain transactions, relevant details (e.g., transaction hash, wallet addresses) are processed by the blockchain network and may be publicly visible. We may also rely on third-party infrastructure (e.g., RPC providers, explorers) to retrieve network data for Status Notifications.

Merchants and Payers

  • Merchants may receive information necessary to reconcile payments (e.g., Payment Request references, transaction status indicators).
  • Payers may be shown Merchant-provided payment instructions and relevant transaction status information.

Legal and regulatory disclosures

We may disclose personal data if we believe in good faith that disclosure is necessary to comply with law, regulation, legal process, or lawful requests by authorities, or to protect the rights, property, and safety of us, our users, or others.

Corporate transactions

We may disclose personal data in connection with a merger, acquisition, reorganization, financing, or sale of assets, subject to appropriate safeguards.

Data Retention

We retain personal data for as long as necessary to:

  • provide the Service and maintain accounts;
  • comply with legal and regulatory obligations;
  • resolve disputes, enforce our agreements, and protect the Service.

Retention periods vary by data type and may be extended where required by law or for legitimate risk management. Public blockchain data may remain accessible on-chain indefinitely outside our control.

International Transfers

We may process personal data in multiple jurisdictions where we or our service providers operate. Where required by applicable law, we implement appropriate safeguards for cross-border transfers (such as contractual protections).

Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. However, no system can be guaranteed 100% secure, and blockchain networks are operated by independent third parties.

Your Rights and Choices

Depending on your location and applicable law, you may have rights to:

  • access, correct, update, or delete certain personal data;
  • object to or restrict certain processing;
  • withdraw consent (where processing is based on consent);
  • request portability of certain data.

To exercise rights, contact us using the details in Section 12. We may request verification of your identity and authority.

Cookies and Analytics

We may use cookies and similar technologies for:

  • essential site functionality and security;
  • analytics to understand usage and improve performance.

You can manage cookies through your browser/device settings. Disabling certain cookies may affect Service functionality.

Children

The Service is not intended for children. We do not knowingly collect personal data from children without appropriate authorization. If you believe a child has provided personal data, contact us and we will take appropriate steps.

Contact Us

If you have questions or requests regarding this Privacy Policy or our personal data practices, contact:

Email: [email protected]

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by applicable law (e.g., by posting an updated version with a new "Last Updated" date, or through Service notifications).