Privacy Policy

1. Who we are

This Privacy Policy explains how CoinAvio (“we”, “us”) handles personal information when you use coinavio.com, the merchant dashboard, the hosted checkout and the API. CoinAvio is responsible for this information. You can reach us at support@coinavio.com.

2. Information about merchants

When you create and use a merchant account, we process:

• Account details: your email address; your password, stored only as a one-way hash; your two-factor authentication secret, stored encrypted; and, if you sign in with Google, your Google account identifier and email address.
• Business details you submit when you apply: business or store name, website and a description of what you sell, plus any information you send us during the review.
• The sites and domains you add, and their verification status.
• Payment records: invoices with their amounts, order references, descriptions and any metadata your integration sends; payment addresses; transaction hashes; sending addresses; and confirmations.
• Withdrawal addresses and withdrawal history.
• Integration settings: API key identifiers (secrets are stored only as hashes), webhook URLs and delivery logs.
• Security information: IP addresses, browser and device details (user agent), sessions, remembered devices, sign-in attempts and security events.
• Messages you send us by email or through the contact form.

Avoid putting buyers’ personal information in invoice descriptions or metadata unless your integration needs it.

3. Information about buyers

Buyers do not need an account or an email address to pay. When you pay an invoice, we process the invoice and the merchant it belongs to, the coin and network you choose, the payment address issued to you, your transaction hash and sending wallet address as recorded on the blockchain, and your IP address and browser details, which we use for security and to prevent abuse, such as limits on how many payment addresses can be requested.

The merchant you pay can see the invoice and its payment details. If you contact us, we also process your message and email address. The merchant is responsible for any information it collects from you on its own website.

4. How we use information

• To provide the Service: creating and processing invoices, crediting balances, processing withdrawals, and sending emails about your account, such as verification links, security alerts and withdrawal confirmations. This is necessary to perform our agreement with merchants.
• To review merchant applications and verify domains.
• To keep accounts and payments secure, detect fraud and abuse, and protect sign-in. This is in our legitimate interest and in yours.
• To meet legal obligations, including anti-money-laundering and sanctions screening, record keeping and responding to lawful requests.
• To answer support requests.
• To understand how the website is used, through cookieless, aggregated analytics.

We do not sell personal information and do not use it for advertising. We only email you about your account and the Service; we will ask for your consent before sending marketing email.

5. Public blockchain data

Transactions on public blockchains, including sending and receiving addresses and amounts, are visible to anyone and cannot be changed or deleted by us or anyone else. To screen payments and withdrawal destinations, we send wallet addresses, not names or email addresses, to a blockchain analytics provider. See the AML & Compliance Policy.

6. Service providers and sharing

We use these providers to run the Service. They process information only to provide their services to us.

• OVH: hosting of our servers and databases in the European Union.
• Cloudflare: content delivery, DNS, security, routing of email sent to our addresses, and cookieless Web Analytics.
• Resend: delivery of the emails we send.
• Google: sign-in, only if you choose to sign in with Google, and the mailbox where messages to our support address are delivered.
• A blockchain analytics provider: risk screening of wallet addresses.
• Blockchain infrastructure providers: node and API services we use to read public blockchain data and send transactions.

We share payment details with the merchant involved in a payment. We may also disclose information when the law or a valid order requires it, to protect the safety and rights of our users or the Service, or as part of a reorganisation or transfer of the Service, in which case this policy continues to apply.

7. International transfers

Our providers may process information in countries other than yours, including outside the European Union. Where the law requires it, we rely on the safeguards these providers offer, such as standard contractual clauses.

8. How long we keep information

• Account and business details: while your account is open, and afterwards for as long as they are needed for the records below.
• Payment, withdrawal and compliance records: for as long as the law requires, including after an account is closed.
• Security logs, sessions and sign-in records: for a limited period, after which they are deleted or anonymised.
• Support messages: as long as needed to handle your request and keep a record of it.

9. Cookies and browser storage

We only use cookies that the Service needs to work:

• Sign-in cookies that keep you signed in to the dashboard.
• A remembered-device cookie, only if you choose “Remember this device” when you sign in. It lasts up to 30 days.
• A short-lived cookie that protects the Google sign-in flow.

Your light or dark theme preference is saved in your browser’s local storage, and the dashboard may keep short-lived technical state in session storage so that it can recover an interrupted action. Cloudflare Web Analytics does not use cookies. We do not use advertising or cross-site tracking cookies, so we do not show a cookie consent banner.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict some processing. To make a request, email support@coinavio.com from the email address on your account. Buyers should include the invoice ID. We may need to verify your identity before we act.

We may keep information that the law requires us to retain, such as payment and compliance records, even after a deletion request, and we cannot delete data recorded on public blockchains. You can also complain to your local data protection authority.

11. Security

• Connections to the Service are encrypted with TLS.
• Passwords and API key secrets are stored only as hashes, and two-factor secrets are encrypted.
• Withdrawals require email confirmation and, when enabled, a two-factor code. We email you about security-relevant changes, such as a new withdrawal address.
• You can review your sessions and remembered devices, and sign them out, in Settings.

No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

12. Children

The Service is for businesses and is not directed at children. Merchants must be at least 18 years old.

13. Changes to this policy

We may update this policy. The date at the top of this page shows the current version. We will tell merchants about material changes by email or in the dashboard before they take effect.

14. Contact

Questions and requests about privacy: support@coinavio.com or the contact form.