Privacy Policy

Effective date: 12 October 2026
Last updated: 12 October 2026

This Privacy Policy explains how Creptapay (“Creptapay,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use our websites, dashboard, hosted checkout, payment links, APIs, plugins, and related services (together, the “Services”).

The Services include, among others:

• creptapay.com
• app.creptapay.com
• pay.creptapay.com (hosted checkout and payment links)
• api.creptapay.com
• docs.creptapay.com

This Policy should be read with our Terms of Use. By using the Services, you acknowledge this Policy. If you do not agree with it, do not use the Services.

If you have questions, contact us at [email protected] or [email protected].

1. Who this Policy covers

We process information about:

Creptapay is the controller of merchant and team-member account data.

For payer information that a merchant submits, or that is collected on a checkout started by that merchant, the merchant is usually the controller and Creptapay processes it as a processor on the merchant’s instructions. We act as a controller of payer information where we must use it ourselves for fraud prevention, sanctions and anti-money-laundering checks, security, or to run the payment.

2. Information we collect

2.1 Account and profile

When you register or manage an account we collect:

• Full name
• Business name and country
• Email address
• Phone number (if provided)
• Password (stored hashed, never in plain text)
• Two-factor authentication status and the secret used to check your codes
• Team roles and invitations
• Email and push-notification preferences (for example new payments, payouts, failed payments, weekly reports)

2.2 Business verification (KYB)

Before a business can process live (production) payments and receive payouts, we require Know Your Business verification. This may include:

• Business name, type, registration number, contact phone, and business address
• Registration certificate
• Government-issued identity document
• Proof of address
• A liveness recording (a short camera capture used to confirm a real person is completing verification)
• Review notes and approval, rejection, or resubmission decisions from our team

2.3 Payout accounts and payouts

Depending on the payout method you choose:

• USDC wallet payouts: the wallet address on the Base network
• Nigerian bank payouts: bank name, bank code, account number, and the account name returned by the bank
• Kenyan M-Pesa payouts: M-Pesa phone number and the registered name
• Name checks: the result of comparing the account name with your business name and owner name
• Payout account changes: when the change happened, who made it, and any resulting payout hold
• Payout records: payout ID, amount, method, coins used, exchange rate, local currency amount, status, on-chain or bank reference, failure reason, and environment (sandbox or production)

2.4 Payments, invoices, payment links, and customers

To run checkout, invoices, payment links, subscriptions, balances, and reporting we process:

• Customer name, email, and phone (when the merchant or checkout provides them)
• Invoice, payment link, and payment references, line items, amounts, currency, description, status, and expiry
• Deposit addresses, networks, stablecoin, amount paid, exchange rate, local currency equivalent, and transaction hashes
• Sending wallet addresses seen on the blockchain
• Balances by stablecoin and environment
• Platform fees and whether the merchant or the payer paid the fee
• Underpayments, overpayments, and other unmatched deposits
• Refund and payout history

Blockchain records (addresses, transaction hashes, amounts) are public by design. We keep copies needed to run the Services; we cannot make a confirmed on-chain transfer private.

2.5 Developer and integration data

If you use APIs, webhooks, or plugins we process:

• API keys (secret keys are stored in a protected form) and related metadata
• IP addresses you add to an API key allowlist, and IP addresses of refused API calls
• Webhook URLs, delivery attempts, payloads, response codes, and logs
• Plugin and integration events

2.6 Security, device, and usage

We automatically collect:

• IP address, browser and device information, and approximate location derived from IP
• Dates and times of access, pages and API endpoints used, and error logs
• Authentication cookies and session tokens
• Browser push-notification subscriptions, if you turn push notifications on
• Security and risk signals about payments, balances, and account activity

2.7 Communications

We collect the content of emails, support requests, and other messages you send us, and the delivery status of emails we send (verification codes, password resets, security alerts, payment and payout notices, weekly reports).

2.8 Information we do not collect

We do not ask payers for card numbers or bank login details. Payments on Creptapay are stablecoin transfers to a deposit address, not card payments. We never ask for the private keys or recovery phrases of anyone’s wallet.

3. How we use information

We use information to:

• Create and secure accounts, including email verification, password reset, and two-factor authentication
• Provide hosted checkout, payment links, invoices, subscriptions, customer records, balances, transactions, payouts, alerts, and the dashboard
• Keep sandbox and production environments separate
• Complete KYB review and decide whether a business may process live payments
• Check that a payout bank account or M-Pesa number belongs to the business or its owner
• Screen payout wallet addresses against sanctions lists
• Convert stablecoins and send local currency payouts through our Licensed Partner (Section 6)
• Protect payout accounts, for example by asking for a two-factor code, pausing payouts after a change, and emailing the account owner
• Detect fraud, abuse, under- and overpayments, and unusual activity
• Calculate and collect fees
• Send operational emails and push notifications, and, where you opt in, weekly summaries
• Provide APIs, webhooks, and plugin integrations
• Comply with anti-money-laundering, counter-terrorist-financing, sanctions, tax, and other legal duties
• Monitor, debug, improve, and secure the Services
• Enforce our Terms of Use and protect Creptapay, merchants, and payers

We do not sell personal information, and we do not use it for third-party advertising.

4. Legal bases

Where a privacy law requires a legal basis, we rely on one or more of the following:

• Contract: to provide the Services you request
• Legal obligation: KYB, anti-money-laundering and sanctions checks, record-keeping, tax, and responses to lawful requests
• Legitimate interests: to secure accounts, prevent fraud, protect payouts, improve the product, and run our business, balanced against your rights
• Consent: where we ask for it (for example push notifications or optional emails), which you may withdraw at any time
• Vital interests or public interest: only where needed to protect someone’s safety or meet a public-interest duty

We process identity documents and liveness recordings because they are necessary for KYB and to protect the payment system against impersonation.

5. Cookies and similar technologies

We use cookies and browser storage that are needed to run signed-in sessions. On the merchant dashboard these include:

These cookies are encrypted in the browser, marked SameSite=Lax, and set Secure on HTTPS. If you choose “remember me,” they last seven days; otherwise they end when you close the browser.

Checkout and payment links use strictly necessary storage to keep a payment session working.

We do not use advertising cookies. You can block cookies in your browser, but if you block authentication cookies you will not be able to stay signed in.

6. How we share information

We share information only as needed to run the Services:

• Our Licensed Partner: crypto services on Creptapay, including stablecoin conversion and local currency payouts, are provided by a digital asset exchange licensed by Nigeria’s Securities and Exchange Commission (SEC). We share the business details, payout account details, and payout amounts it needs to carry out payouts and its own compliance checks.
• Verification and screening providers: to confirm bank account names and to screen wallet addresses against sanctions lists
• Banks and mobile money operators: when we send an NGN bank payout or a KES M-Pesa payout
• Infrastructure providers: who host our servers and databases, store files (including KYB documents and liveness recordings), send email and push notifications, provide blockchain node access, and deliver internal operational alerts, under contracts that limit their use of the data
• Blockchain networks: when a payment is received or a USDC payout is sent; that data is public
• The merchant, when you are a payer: the merchant sees the payment status, amount, reference, network, transaction hash, and the customer details they or the checkout collected
• Team members of a business, according to the access that business grants
• Professional advisers (lawyers, accountants, auditors), under confidentiality
• Regulators, law enforcement, and other authorities, if required by law, court order, or regulation, or to protect rights, safety, or the integrity of the Services
• A buyer or successor, if we merge, sell, or reorganise the business, subject to this Policy or equivalent protection

Staff who review KYB submissions can see the documents and liveness recording you upload. Our internal alerts are designed to leave out passwords, keys, and other secrets.

7. International transfers

We and our providers may process and store information outside your country, including in cloud regions outside Nigeria and Kenya. Where the law requires, we use appropriate safeguards, such as contractual protections with providers, and transfer only what is needed for the purposes in this Policy.

8. Retention

We keep information only as long as needed for the purposes above, including:

• Account data while the account is open, and for a reasonable period after closure to handle disputes and legal claims
• KYB documents, liveness recordings, and payout account checks for as long as anti-money-laundering and record-keeping rules require (usually at least five years after the business relationship ends)
• Payment, balance, invoice, webhook, and payout records for accounting, tax, audit, and dispute handling
• Support correspondence for as long as needed to resolve the issue and improve support
• Server and security logs for a shorter operational window, unless they are needed for a security investigation

On-chain data stays on the blockchain even after we delete our copies.

9. Security

We use technical and organisational measures appropriate to a payments product, including:

• HTTPS across the Services
• Hashed passwords and protected storage of secret API keys
• Two-factor authentication, required to change a payout account when it is on
• A 24-hour live payout hold and an email to the account owner when a payout account is replaced
• Optional IP allowlisting for secret API keys
• Signed webhooks so merchants can verify that a webhook came from us
• Encrypted session cookies in the dashboard
• Access controls for staff and team roles
• Separate sandbox and production environments
• Monitoring and alerting for payments, payouts, and webhooks

No method of transmission or storage is completely secure. You are responsible for keeping your password, API keys, and two-factor device confidential, and for checking that payout wallet addresses, bank details, and M-Pesa numbers are correct.

If we become aware of a personal data breach that affects you, we will notify you and the relevant authority where the law requires.

10. Your rights

Depending on where you live, including under Nigeria’s Data Protection Act 2023 and Kenya’s Data Protection Act 2019, you may have the right to:

• Be informed about how we use your information
• Access a copy of your personal information
• Correct inaccurate information
• Delete information, subject to legal retention duties
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Receive information you provided to us in a structured, machine-readable format
• Lodge a complaint with a data protection authority

Merchants can update much of their profile, notification settings, customers, and payout details in the dashboard. To exercise other rights, email [email protected]. We may need to verify your identity, and we aim to respond within 30 days.

If you are a payer, contact the merchant you paid first, because they control most customer records. We will help the merchant where we are their processor.

We may decline a request that is unlawful or excessive, or that would stop us keeping records required for payments, KYB, anti-money-laundering, or fraud prevention.

11. Children

The Services are for businesses and adults. We do not knowingly collect personal information from children under 18. If you believe a child has given us information, contact [email protected] and we will delete it where we are not required to keep it.

12. Merchants’ responsibility for payer data

If you are a merchant, you must:

• Have a lawful basis and your own privacy notice for the customer information you send to Creptapay
• Collect only what you need to invoice, bill, or check out a customer
• Not submit children’s data or sensitive personal data unless you have a lawful basis and we have agreed in writing
• Respond to payer privacy requests about data you control

13. Automated decisions

KYB review is carried out by our team using the information you submit, including the liveness recording. Production access may be refused or limited if verification is incomplete, inconsistent, or fails our checks. You can ask us to review that decision.

We also use automated rules for payment amounts and expiry, network detection, payout account name matching, sanctions screening, and risk signals. These rules run checkout and payouts. Where an automated check blocks a payout account or a payout, you can contact us and a person will review it.

14. Changes

We may update this Policy. We will change the “Last updated” date at the top and, for material changes, notify merchants by email or in the dashboard. If you keep using the Services after an update takes effect, the revised Policy applies.

15. Contact

Creptapay
Support: [email protected]
Privacy and general: [email protected]

If you are in Nigeria, you may contact the Nigeria Data Protection Commission about an unresolved privacy complaint. If you are in Kenya, you may contact the Office of the Data Protection Commissioner.