This policy explains what personal data Axozo Tech LLC collects when you use Chainquay, why, who else sees it, how long it is kept and what rights you have.
1. Controller
The data controller is Axozo Tech LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, reachable at [email protected].
2. What we collect
- Merchant accounts: email address, password (stored only as a hash), business name, two-factor settings, payout wallet addresses, team members' emails and roles, API keys (stored only as a hash) and webhook endpoints.
- Security records: IP address, approximate location derived from it, browser and device information for each sign-in attempt and active session, and an audit log of changes made in the account.
- Payments: the amounts, currencies, exchange rate, blockchain addresses and transaction identifiers of every payment, settlement and refund, and any order reference, description, customer email or metadata the merchant attaches to a payment.
- Customers paying a merchant: the hosted checkout page records the payment status only. We do not require customers to create an account. A merchant may pass the customer's email to us so that it appears on the payment record.
- Support and contact: the content of support tickets and contact-form messages, and the email address they come from.
- Technical: server logs with IP addresses and requested URLs, kept for security and debugging.
3. Why we use it
- To provide the Service: detect payments, settle funds, deliver webhooks, send transactional email (account confirmation, password reset, support replies, low-balance alerts) and show the dashboard.
- To keep accounts and funds safe: login protection, fraud and abuse prevention, audit trail.
- To meet legal obligations such as accounting, tax and, where applicable, anti-money-laundering rules.
- To answer your questions.
Legal bases under GDPR, where it applies: performance of a contract, legitimate interests in security and service quality, and legal obligation. We do not sell personal data and do not use it for advertising.
4. Public blockchains
Blockchain transactions are public by design. Addresses, amounts and transaction identifiers are visible to anyone and cannot be deleted by us or anyone else.
5. Who else sees data
- Infrastructure and email providers that process data on our behalf under contract (Vultr for servers, Cloudflare for networking and robot checks, Resend for email, Cloudflare R2 for encrypted backups).
- Blockchain data providers (TronGrid, Tronscan, mempool.space and similar) receive the public addresses and transaction identifiers we look up.
- Authorities where the law requires it.
6. Cookies and local storage
The dashboard stores your session token in your browser's local storage so you stay signed in. The hosted checkout and website set no tracking cookies. Cloudflare may set a cookie needed for its robot check on the sign-up and contact forms.
7. Retention
Account and payment records are kept for as long as the account exists and afterwards for the period required by accounting and tax law (up to 7 years). Security logs are kept for 12 months. Backups are encrypted and rotated after 30 days.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. Write to [email protected]; we answer within 30 days. Some data cannot be deleted while a legal retention period runs or because it is on a public blockchain.
9. International transfers
Our servers are located in the United States. Some providers listed above may process data in other countries under appropriate safeguards such as standard contractual clauses.
10. Changes
We will post updates here and, for material changes, notify account holders by email.