Privacy policy.

1In short

• We collect what we need to run a payment service, and no more.
• We don't sell personal data, and we don't show or sell advertising.
• This site has no analytics and no tracking scripts from other companies.
• Payments on a blockchain are public by nature: anyone can see an address, an amount and a time there. That is the network's record, not ours.

2What we collect

If you have a Nowgate account

• Your email address and your name, and your business's name and settings.
• What signs you in. Your password is stored only as a one-way hash, which we can't read back. Your second sign-in step is stored sealed, and a passkey's secret never leaves your device.
• Your sessions: when you signed in, and the internet address and browser you signed in from, so you can review them and end any you don't recognize.
• An activity trail of what was done in your account, by whom and from which internet address, so that your team can see who changed what.
• Your payments, payouts and refunds: amounts, coins, blockchain addresses and transaction IDs, and whatever order details you send with them.
• The addresses you pay out to, and the web addresses your webhooks go to.

If you pay a business through Nowgate

• The payment itself: the amount, the coin, the address it was sent to and its transaction ID.
• Your email address, only if you give it to get a receipt, or if you subscribe to something and the business needs to send you its invoices.
• You don't need an account with Nowgate to pay.

If you visit this site or the documentation

• Our servers keep a log of requests, as web servers do: the internet address, the time, the page and the browser.
• Anything you choose to write to us.

3How we use it

• To provide the service: taking payments, keeping balances, sending payouts and showing you all of it.
• To keep accounts safe: checking who is signing in, slowing down repeated guesses and warning you about changes to your account.
• To write to you about your account: verifying your address, resetting a password, telling you about a security change or a change to fees or terms.
• To send receipts and invoices that a customer or a business asked for.
• To find and fix faults, and to meet duties the law places on us.

We don't use personal data for advertising, and we don't build profiles of people.

4Cookies

Nowgate sets the cookies it needs to work, and one optional cookie, only if you accept it. None is used for advertising. The first time you visit this site or the documentation, we ask; you can change your answer at any time with Cookie settings, at the foot of every page of this site.

• Your answer: ng_consent remembers whether you accepted optional cookies, for a year, on every Nowgate site.
• Optional, on this site: if you arrive through a referral link and accept optional cookies, ng_ref remembers the referral code for 30 days, so the business that sent you gets the credit if you sign up. If you don't, the code goes only in the sign-up link you follow from that visit.
• In the dashboard: a session cookie keeps you signed in, and a short-lived one carries you through sign-in. Both are needed for the dashboard to work.
• At the point of sale: a cookie tells Nowgate which till a browser is, and which cashier is using it.
• Security: Cloudflare, which protects every Nowgate site, sets its own cookies when it checks that a visitor is a person, such as cf_clearance. They are needed to keep the sites safe.
• On checkout pages and in the documentation: no cookies of their own.

5Who sees it

• The business you pay sees your payment, and your email address if you gave it for a receipt or a subscription.
• Your own team sees your account's payments, payouts and activity, according to the role you give each person.
• Companies that work for us, such as the ones that host our servers, carry and protect our sites' traffic, and deliver our email, handle data only to do that work.
• The public can see what is on a blockchain: addresses, amounts and times. Nowgate doesn't publish who is behind them.
• Authorities, when the law requires us to hand something over.

We don't sell personal data to anyone.

6How long we keep it

• Your account's details: for as long as the account is open.
• A payer's or subscriber's email address: until 30 days after the receipt was sent or the subscription ended, then it is erased.
• The address an account email was sent to: erased from the record of that email 30 days after sending.
• Sessions that have ended: 30 days.
• Web server logs: about two weeks.
• Payments, payouts and the accounting records behind them: for the life of the account, and afterwards for as long as the law requires such records to be kept.

7How we protect it

Connections to Nowgate are encrypted. Passwords are stored as one-way hashes, and secrets such as API keys are stored hashed or sealed, never in a form we can read back. Every dashboard account signs in with a second step. The Security page describes how funds and accounts are protected.

8Your choices

• You can see and change your account's details, review your sessions and end them, in the dashboard.
• You can ask us for a copy of the personal data we hold about you, or ask us to correct or delete it. Some records, such as those of payments, we have to keep.
• If you paid a business through Nowgate and your question is about that purchase, the business is the one to ask first.

The contact page says how to reach us.

9Changes to this policy

When this policy changes, the date at the top changes with it. If a change matters to how your data is used, we'll tell account owners by email before it applies.