1. Introduction

This Privacy Policy describes the information NexaPay (“we”, “us”, “our”) collects through our website at nexapay.one, our merchant dashboard, our WooCommerce plugin and our API, and how we use and protect it. By using NexaPay, you confirm that you have read this policy.

NexaPay operates from Tallinn, Estonia, and is responsible, as data controller, for the personal data described in this policy. You can contact us about privacy at any time at [email protected].

NexaPay provides software: technical integration tools, a plugin and an API that let merchants connect their websites to independent payment and cryptocurrency providers that hold their own licences.

NexaPay is not a payment, banking, money transmission, custody, exchange or crypto brokerage service. It does not process payments, hold or transfer merchants’ or customers’ funds, or keep their digital assets; its only role is to provide software and technical integration.

2. Information We Collect

NexaPay only gathers what it needs to run the Service. Depending on how you use it, this may include:

• Account details — your email address, your login credentials, your business name (if you add it) and the wallet address or addresses where you receive payouts.
• Payment and payout details — information our software passes to providers or shows in your dashboard, such as order amounts, currencies, order references, payment status, payment addresses and public blockchain transaction IDs.
• Customer details at checkout — when a customer pays a merchant through a checkout that uses NexaPay, the merchant’s website may send us details such as the customer’s email address and the order amount, which we pass on to the relevant third-party providers so the payment can be processed.
• Support messages — what you send us by email or Telegram, together with the contact details you use.
• Technical data — server and security logs: your IP address, the browser and device you use, the pages and endpoints you access, and when.

We do not collect payment card numbers, bank account details or identity documents. When a provider asks a customer for card details or identity verification, that information goes directly to the provider and is handled under the provider’s own privacy policy.

3. How We Use Information

The information described above is used to:

• create and manage your account and provide the Service;
• connect checkouts to payment providers and show payment and payout status;
• answer support requests and other messages;
• send important service information, such as security alerts and changes to our terms;
• keep NexaPay secure and detect, investigate and stop fraud, abuse and activity prohibited by our Terms of Use, including enforcing account bans;
• fix problems and improve the Service;
• meet our legal obligations and respond to valid legal requests.

4. Legal Basis for Processing

Personal data is used only where the law allows it. Under the EU General Data Protection Regulation (GDPR), we rely on:

• Contract — to open and run your account and provide the Service you requested;
• Legitimate interests — to keep the Service secure, prevent fraud and abuse, enforce our Terms, handle support requests and improve NexaPay, where these interests are not overridden by your rights;
• Legal obligation — where the law requires us to keep or disclose information;
• Consent — where we ask for it; you can withdraw consent at any time.

5. Cookies and Tracking

We only use cookies and similar storage that are strictly necessary — for example, to keep you signed in and to protect the Service against abuse. We do not use analytics, advertising or profiling cookies, and nothing on our website follows you across other sites.

Because strictly necessary cookies do not require consent, we do not show a cookie banner. If we ever introduce other cookies, we will ask for your consent before setting them.

6. Data Sharing

Your personal data is never sold, rented or traded. We share it only:

• with licensed third-party payment, cryptocurrency and blockchain providers, and with the technology and API providers that connect us to them, as needed to process payments and payouts;
• with service providers that host or support our infrastructure, email and security, who may only use the data on our instructions;
• when the law, a court order or another valid legal request requires it;
• when needed to protect the rights, safety or property of NexaPay, our users or others, including to prevent fraud and enforce our Terms;
• as part of a business transfer described in section 12.

Some of these recipients may be located outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we do so only in ways permitted by data protection law.

7. Data Retention

We hold personal data no longer than needed — to run the Service, comply with the law, settle disputes and enforce our agreements. Account data is kept while your account is open and is deleted or anonymised within a reasonable time after it is closed, unless the law requires us to keep it longer. If an account is banned for prohibited activity, we keep the minimum information needed to enforce the ban. Server and security logs are deleted after a limited period.

Transactions recorded on public blockchains are public and permanent. Nobody — including NexaPay — can change or delete them.

8. Data Security

We protect personal data with appropriate technical and organisational safeguards designed to prevent it from being accessed without permission, lost, misused or changed. Even so, nothing transmitted or stored online can be guaranteed to be completely secure. Please keep your login details safe and tell us immediately if you suspect unauthorised access to your account.

9. Third-Party Links and Providers

Our website and checkout may send you to websites run by others, including the pages of payment providers where customers complete their payments. How those websites and providers handle personal data is outside our control, so please read their own privacy policies.

10. Your Rights

You have the right to ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is inaccurate;
• delete your data;
• restrict or stop how we use your data, or object to it;
• provide your data in a portable format;
• stop any processing that relies on consent you have withdrawn.

To use any of these rights, email [email protected], ideally from the address registered to your account. We may need to confirm your identity first, and we will reply within the time the law requires — normally one month. Some data may have to be kept for legal reasons or to enforce a ban, and data on public blockchains cannot be deleted by anyone.

You also have the right to complain to a data protection authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also contact the authority in the EU country where you live or work.

11. Children’s Privacy

NexaPay is for adults only. We never knowingly gather information from anyone under 18; if you think a child has shared personal data with us, let us know and we will delete it.

12. Business Transfers

If NexaPay is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred to the new owner as part of that transaction. This policy will continue to apply to that data unless you are told otherwise.

13. Changes to This Privacy Policy

This policy is reviewed regularly and may change. When it does, we will publish the new version on this page and update the “Last Updated” date above. If a change is significant, we may also notify account holders by email.

14. Contact Information

Questions about your personal data or this policy? Get in touch:

• Email: [email protected]
• Telegram: @NexaPaySupport_Bot
• Location: Tallinn, Estonia