Privacy Policy

Effective date: 2 November 2026

This Privacy Policy explains how Orboni (“Orboni”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit orboni.com, create or use a merchant account, use our API or hosted payment pages, or contact us (together, the “Service”). It is provided in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and other applicable data protection laws. Terms not defined here have the meaning given in our Terms of Service.

1. Who is responsible for your data

1.1. Merchants and visitors. For personal data about our merchants, their staff, website visitors and anyone who contacts us, the controller is Orboni. You can reach us about anything in this policy at support@orboni.com.

1.2. Buyers. When you pay a merchant through an Orboni payment page, the merchant you are buying from decides why and how your data is processed and is the controller of it. We process that data on the merchant’s behalf, as its processor, only to provide the Service. Please read the merchant’s own privacy notice and send requests about your purchase to the merchant. If you contact us, we will pass your request on to the merchant where we can identify it.

2. Blockchain data is public

Payments made through the Service take place on public blockchains. Wallet addresses, transaction identifiers, amounts, timestamps and, on some networks, memos or tags are permanently recorded on those blockchains and visible to anyone. Neither we nor anyone else can change or delete them. A wallet address can sometimes be linked to a real person using other information. Please keep this in mind before you send or receive crypto-assets; it is a property of the technology, not of our Service.

3. What data we collect

3.1. Data you give us

Account data: name, email address, password (stored only as a one-way hash), two-factor authentication settings, language, time zone and country.
Sign-in with Google: if you choose it, your Google account identifier, name, email address and profile picture, as provided by Google.
Merchant data: business and display name, website, support email, wallet addresses and extended public keys (such as an xpub), enabled assets and networks, webhook endpoints, settings and API keys (secret keys are stored only in a form we cannot read back).
Billing data: invoices, the fees accrued by your payments, and the details of the payments you make to us.
Communications: the content of support chat messages, emails and any files you send us, and our replies.

3.2. Data collected automatically

Technical and usage data: IP address, approximate country derived from it, browser and device type, operating system, language, referring page, pages visited, the first page of a visit, campaign parameters in the link you followed (such as utm_source), times and durations of visits, and the date you were last active.
Logs and security data: API requests made with your keys, webhook delivery attempts and responses, sign-in events, errors linked to your account and actions taken by administrators.
Cookies: see Section 9.

3.3. Payment session data (processed for merchants)

When a merchant creates a payment session and a buyer uses the payment page, we process the price, currency, description, order reference, metadata and, if the merchant provides it, the buyer’s email address; the asset and network the buyer chooses; the payment address, memo or tag; the buyer’s IP address and browser data; and the public blockchain transactions that pay it, including the sending address. We process this data as a processor on behalf of the merchant (see Section 1.2).

3.4. Data from public sources

We read public blockchain data relating to the addresses used by the Service, and exchange rates from public price sources. These do not identify you by themselves.

4. Why we use your data and on what legal basis

To provide the Service — creating and running your account, detecting payments, sending webhooks and notifications, showing your dashboard — because it is necessary to perform our contract with you (Article 6(1)(b) GDPR).
To bill you — calculating fees, issuing invoices, collecting payment — for the performance of our contract and to comply with our accounting and tax obligations (Article 6(1)(b) and (c)).
To keep the Service secure and prevent fraud and abuse — rate limiting, detecting suspicious sign-ins, enforcing our Acceptable Use Policy, screening for sanctions and illicit use, investigating incidents — based on our legitimate interests in protecting our Service, our users and third parties (Article 6(1)(f)), and where required to comply with legal obligations (Article 6(1)(c)).
To provide support — answering your messages, including with the help of AI tools that translate messages and suggest draft replies to our staff, who review them before sending — for the performance of our contract and our legitimate interest in responding quickly and in your language (Article 6(1)(b) and (f)).
To improve the Service — understanding how the Service is used, measuring which pages and campaigns bring merchants, fixing errors — based on our legitimate interests (Article 6(1)(f)).
To communicate with you — service and security messages, changes to our terms, and, where permitted, information about new features — for the performance of our contract and our legitimate interests; you can opt out of non-essential messages at any time (Article 6(1)(b) and (f)).
To comply with the law and defend our rights — responding to lawful requests from authorities, keeping records, establishing, exercising or defending legal claims — based on legal obligations and our legitimate interests (Article 6(1)(c) and (f)).
Analytics and similar cookies, if we use them, only with your consent (Article 6(1)(a)), which you can withdraw at any time.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can ask us for details and you have the right to object (Section 8). We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, other than automated security measures such as blocking abusive traffic, which you can ask a human to review.

Providing account data is necessary to use the Service; without it we cannot open an account for you.

We do not sell your personal data and we do not share it for third-party advertising. We share it only as follows:

Service providers (processors) who act on our instructions under contracts that protect your data, including: DigitalOcean (hosting, servers in Germany); Cloudflare (content delivery, security and DNS); Google (sign-in with Google, if you use it); Resend (sending email); Anthropic (AI features used in our support tools); Telegram (internal operational alerts to our staff); and providers of blockchain data and node access, which receive the blockchain addresses and transactions we look up but not your name or email.
Merchants: if you are a buyer, the merchant you pay receives the payment session data described in Section 3.3.
Authorities and others where required: courts, law enforcement, tax and regulatory authorities, where we are legally required to or where we believe in good faith that disclosure is necessary to prevent fraud, protect anyone’s safety or rights, or establish, exercise or defend legal claims.
Professional advisers such as lawyers, accountants and auditors, bound by confidentiality.
A buyer or successor of all or part of our business, in a merger, acquisition, financing or reorganisation, who will be bound by this policy.

6. International transfers

Our main servers are in the European Union. Some of our providers, or their sub-processors, process data in other countries, including the United States. Where personal data is transferred outside the European Economic Area to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

Account and merchant data: for as long as your account is open, then deleted or anonymised within a reasonable period, except as described below.
Invoices and billing records: for the period required by tax and accounting law, generally five years from the end of the year in which the tax obligation arose.
Payment session records: for as long as the merchant’s account is open and as needed for billing, reconciliation and the defence of claims; the blockchain records themselves are permanent and outside our control.
Support chats: deleted automatically after 60 days without activity.
Visit and activity records: up to 180 days; error logs up to 90 days; administrator action logs up to 360 days; server logs typically up to 30 days.
Data needed for a legal claim, investigation or legal obligation: until it is resolved or the obligation ends.

8. Your rights

Under the GDPR you have the right to: access your personal data and receive a copy of it; have inaccurate data corrected; have data erased; restrict processing; receive data you provided to us in a portable format; object to processing based on legitimate interests, including profiling, and to direct marketing at any time; and withdraw consent at any time, without affecting processing that took place before. These rights are subject to conditions and exceptions set out in the law — for example, we may keep data we need for legal obligations or claims, and no one can erase data recorded on a public blockchain.

To exercise your rights, write to support@orboni.com from the email address of your account. We may ask you to confirm your identity. We will answer within one month, which may be extended by two further months for complex requests as permitted by law. You can update most account data and delete your account yourself in your account settings.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). We would appreciate the chance to address your concern first.

9. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary for the Service — keeping you signed in, protecting forms against cross-site request forgery, remembering your cookie choice, preventing abuse — and functional ones that remember your language, light or dark theme and sidebar state. These do not require consent. If we use analytics or advertising cookies, we will ask for your consent first through our cookie banner, and you can change your choice at any time. More details are in our Cookie Policy. You can also block or delete cookies in your browser, but parts of the Service may then stop working.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords and secret keys, two-factor authentication, access controls, network firewalls, signed webhooks and regular backups. We never ask for or store private keys or recovery phrases. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password, API keys and devices secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the competent authority and, where required, you, as the law requires.

11. Children

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Links to other services

The Service may link to or work with third-party websites, wallets, blockchains, block explorers and services that we do not control. Their own privacy policies apply, and we are not responsible for their practices.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the new version on this page with a new effective date and, if the changes are material, notify account holders by email or in the dashboard before they take effect.

14. Contact

For any question or request about this Privacy Policy or your personal data, contact us at support@orboni.com.