Skip to content

Legal

Privacy Policy

Last updated: September 23, 2026

1. Who We Are

Paymos is a stablecoin payment infrastructure for businesses, operated from the Republic of Seychelles (the "Service", "we", "us", "our"). This Privacy Policy explains what data we process when you visit our website or use the Service — as a merchant with an account, or as a visitor paying through a Paymos checkout — and the rights you have over that data.

This Policy is written to align with the principles of the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where you are located in a jurisdiction with its own data-protection law, that law may grant you additional rights.

By using the Service, you accept the practices described here. If you do not agree, discontinue use of the Service.

2. Scope

This Policy applies to:

  • —Merchants — businesses that register an account to accept payments.
  • —Checkout visitors — buyers who pay an invoice through a Paymos-hosted or embedded checkout, without a Paymos account.
  • —Telegram payers — buyers who pay an invoice in the Telegram bot, with no Paymos account either.
  • —Website visitors — anyone who opens paymos.io, whether or not they have a Paymos account.

It does not cover data processed offline or on third-party platforms we do not control.

3. Data We Collect

  • —Account data — email address, business name, and country provided at sign-up or in onboarding.
  • —Technical data — IP address, device and browser information (User-Agent), log files, and usage and performance data — collected while you use the Service.
  • —Blockchain data — wallet addresses, withdrawal-whitelist addresses, transaction history, and balances. This data is read from, or written to, public blockchains.
  • —Verification data — government-issued identity documents, proof of address, and related records, collected only if identity verification is triggered under our AML/KYC Policy.
  • —Telegram data — when you use the Telegram bot, Telegram gives us your user ID, username, and first and last name, and we keep the language you choose there. Signing in with Telegram also gives us your profile photo link. You type none of this.
  • —Support content — messages, attachments, and metadata you send through in-product or checkout support chat.
  • —Product analytics — page views, clicks, form interactions (not what you type), referrer and campaign tags, file downloads, and page-load speed, linked to a pseudonymous identifier in the paymos_did cookie. In the merchant dashboard, we record each session, text masked, and link it to your account.

Because paymos_did is shared by the website, checkout, and dashboard, when you sign in we also link your earlier activity in that browser to your account. Dashboard events carry an opaque identifier of that account and your merchant's public identifier.

We never ask for, and never store, your wallet private keys or seed phrase. Never trust anyone who asks you to enter them.

We process personal data on the following bases:

  • —Performance of a contract — to provide the Service you sign up for.
  • —Legitimate interests — to secure the Service, prevent fraud and abuse, and learn how people find and use our website, checkout, POS terminal, and dashboard. We do not ask for consent to product analytics; see the Cookie Policy.
  • —Legal obligation — to meet anti-money-laundering, record-keeping, and lawful-disclosure requirements.

5. How We Use Your Data

  • —Provide, operate, and maintain the Service.
  • —Secure accounts and detect fraudulent or abusive activity.
  • —Process account and transaction records when required for manual review, lawful disclosure, or enforcement of account limits (see our AML/KYC Policy).
  • —Respond to support requests and communicate with you.
  • —Improve Service quality and reliability.
  • —Learn how people find and use our website and the Service, through product analytics.

6. Blockchain Transparency

Payments and withdrawals settle on public blockchains. Transaction data on these networks — including sending and receiving addresses, amounts, and timing — is public, permanent, and outside our control. It can be read by anyone and, when combined with other information, may reveal identity.

We are not responsible for how personal data is processed within decentralized, permissionless blockchain networks. Paymos uses public blockchain data to reconcile payments, withdrawals, and balances; this operational use is not a sanctions-screening service for merchants.

7. Third Parties and Sub-Processors

We do not sell your personal data. We share it with service providers to run the Service, and with Amplitude for product analytics:

  • —Blockchain infrastructure & cross-chain settlement providers — routing and settling a portion of payments across networks.
  • —Email & hosting infrastructure — transactional email, hosting, and storage.
  • —Amplitude — our only analytics provider. Your browser sends events to our own site, and we forward each one to Amplitude with your IP address and your paymos_did identifier. Session recordings come from the dashboard only. No event carries an amount, fee, or balance.

A portion of payments is routed through third-party blockchain infrastructure and cross-chain settlement providers we do not own or control. Their processing is governed by their own terms.

Our servers also report four milestones to Amplitude: a new person's first sign-in, a new merchant, its first invoice (test and live counted separately), and its first live payment. Each carries the account identifier and the account's language; the first sign-in adds how you signed in, the new merchant its country and whether another merchant referred it. None carries amounts, wallet addresses, email addresses, or transaction hashes. The Telegram bot, the Merchant API, and webhooks send no analytics of their own, but milestones reached through them are still reported.

8. Disclosure

We may disclose personal data:

  • —To comply with a legal request, court order, subpoena, or official investigation.
  • —To law-enforcement or regulatory authorities where we have a good-faith belief it is required.
  • —In connection with a merger, acquisition, or restructuring.
  • —To affiliates and processors where necessary for operational purposes.

9. Retention

We keep personal data only as long as needed for the purposes above. Verification and transaction records are retained for at least five years from the end of the business relationship, in line with anti-money-laundering record-keeping requirements. Aggregated data that cannot identify you is kept as long as it is useful for reporting and analysis.

10. Your Rights

Subject to applicable law, you have the right to:

  • —Access the personal data we hold about you.
  • —Rectify inaccurate or incomplete data.
  • —Erase your data, where no legal obligation requires us to keep it.
  • —Restrict or object to certain processing.
  • —Portability — receive your data in a structured, machine-readable format.

To exercise any right, contact [email protected]. We respond within the timeframe required by applicable law.

11. International Transfers

We may process data in jurisdictions other than your own. Where we transfer personal data across borders, we apply safeguards appropriate to the data and the jurisdiction involved.

12. Security

We protect data with encryption in transit, access controls, and audit logging. Sign-in links and checkout chat sessions carry encrypted tokens, so the identifiers inside them cannot be read or changed outside the Service. Withdrawals are signed on isolated infrastructure and, by default, restricted to whitelisted destination addresses; if you ask us to turn the whitelist off, that restriction no longer applies. No system is perfectly secure, and you are responsible for safeguarding your account credentials.

13. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a minor has used the Service, contact us.

14. Changes

We may update this Policy. The current version is always on this page. We will notify merchants of material changes by email. Continued use after an update constitutes acceptance.

Questions: [email protected]