This policy describes the data TOTOPAY processes when you use the merchant dashboard, hosted pay pages, and API. It is written for the product as shipped (USDT on BEP-20 and TRC-20). It is not a substitute for advice from counsel in your jurisdiction.
Who this applies to
This notice applies to merchants who create a TOTOPAY account, people who pay a hosted payment link, and visitors to marketing pages on totopay.net.
TOTOPAY is the service operator for gateway accounts, API traffic, and hosted checkout. Merchants are responsible for the customer data they send us (names, emails, metadata) under their own notices.
Categories of personal data
We store account registration data (name, email, password hash, optional 2FA secret), API key hashes and prefixes, session identifiers, IP addresses used for live-key allowlists and audit logs, payment and deposit records (amounts, networks, addresses, transaction hashes), webhook URLs and delivery logs, and support tickets.
Blockchain addresses and transaction hashes are public on-chain data. Combined with emails or metadata you submit, they can identify a person. Do not put secrets in payment metadata.
Purposes & lawful bases
We process this data to operate the payment gateway, authenticate API and dashboard access, detect abuse, collect subscription payments, and provide support. Contract performance and legitimate interests in securing the service are the primary bases we rely on.
We do not sell personal data. Marketing emails are limited to service and product notices unless you opt in to extras.
Retention & subprocessors
Account, ledger, and webhook records are kept for the life of the merchant relationship plus a retention window needed for disputes, tax, and security investigations. Backups follow the same classes of data.
Infrastructure may include cloud hosts, email delivery, and RPC providers. International transfers occur when those vendors or you are outside your home country.
Your rights
You may request access, correction, or deletion of account data by contacting support@totopay.net from the email on the account. We may refuse requests that would break legal retention or the integrity of the payment ledger.
If we cannot resolve a complaint, you may contact your local data protection authority.
Last updated: April 2026
This page is provided for general information only and does not constitute legal advice. Replace this text with counsel-reviewed language before production launch.