Privacy policy

Who we are

Stablevoy runs the website stablevoy.com, the API at api.stablevoy.com, the merchant dashboard and the WooCommerce plugin. You can reach us through the contact form on this site for anything in this policy.

What we collect and why

Merchants:

• Wallet addresses: the wallet you sign in with and your payout wallet. They are your account; there is no email or password.
• Store settings: store name, enabled networks, invoice limits, website, webhook URL and default return URL.
• API keys: stored only as a hash. The full key is shown once, when you create it.
• Webhook signing secrets: stored encrypted, so we can sign the events we send to your shop.
• Invoices and payments: amounts, your order reference, the deposit address, transaction hashes and the sending wallet of each payment.

Buyers paying an invoice:

• The wallet a payment comes from and its transaction. Both are public on the blockchain anyway; we record them to match the payment to the invoice.
• Every sending wallet is checked against the OFAC sanctions list. Payments from listed wallets are held and the invoice is marked on hold.
• We do not ask buyers for names, emails or addresses. Whatever the shop collects is between the buyer and the shop.

Everyone:

• Contact form messages: your name, email, topic, message and the page you came from. We use them only to answer you.
• Technical logs: IP address, browser user agent, the requested address and the time, kept to keep the service secure and to investigate problems.

What we do not do

• No analytics or tracking scripts, no advertising, no tracking cookies.
• No selling, renting or sharing of your data for marketing.
• No custody: we never hold your funds or your keys.

Cookies and browser storage

• Two session cookies, svy_at and svy_rt, set only after you sign in to the dashboard. They are httpOnly, so scripts cannot read them, and they end when you sign out or they expire.
• If you connect a wallet through WalletConnect, its software keeps the connection in your browser storage until you disconnect.
• The contact form uses Cloudflare Turnstile to tell people from bots instead of a puzzle; Cloudflare processes the check.

How long we keep data

• Technical logs: 30 days.
• Contact form messages: 180 days, then deleted automatically.
• Account, store, invoice and payment records: as long as the account exists and as long as accounting and anti-money-laundering rules require.
• Anything written to a public blockchain stays there for good. Nobody, including us, can change or delete it.

Who helps us run the service

These providers process data on our behalf, only for the purpose given:

• Cloudflare: DNS, content delivery and protection against attacks for the website and the API, the Turnstile check on the contact form, and forwarding of email sent to our addresses.
• Hetzner: the servers that run the API and store the data, in Germany.
• Resend: sending contact form messages to us by email, from its EU region.
• Reown (WalletConnect): relays the connection between this site and your mobile wallet, only when you choose WalletConnect.
• Alchemy: reading blockchain data to detect payments.
• Public blockchain endpoints (for example those of Base, Arbitrum and Polygon): your browser and wallet read the network through them when you connect a wallet.

Your rights

You can ask us what we hold about you, ask us to correct or delete it, or object to how we use it. Write through the contact form; we answer within 30 days. On a deletion request we remove your stores, keys and settings; records we must keep by law are kept until that duty ends, and data on public blockchains cannot be deleted by anyone.

If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.

Security

Connections are encrypted, API keys are hashed, webhook secrets are encrypted, and the website and the API accept connections only through Cloudflare. The funds themselves never pass through our systems: they go from the buyer to contracts that can only forward them to the merchant.

Changes

When this policy changes, the date at the top changes too. Significant changes are announced on this site before they take effect.