Privacy Policy

This Privacy Policy explains how TEDR ("TEDR," "we," "us," "our") collects, uses, shares and protects personal data when you use TEDR Pay. TEDR Pay includes the website, the merchant dashboard, the public payment pages, the email notifications and the TEDR Pay API (together, the "Service").

It applies to:

• Sellers — businesses and individuals who register a TEDR Pay account to receive payments, and the people who use the account on their behalf;
• Payers — people who pay an invoice, including buyers, subscribers of a Recurring payment and donors, whether or not they have an account;
• Visitors — people who visit our website or contact us.

Capitalized terms not defined here have the meaning given in the TEDR Pay Terms and Conditions.

1. Who is responsible for your data

1.1 TEDR as controller. TEDR is the controller of personal data it processes to:

• run Seller accounts;

• process and screen payments;

• prevent fraud and meet legal obligations, including anti-money laundering and sanctions rules;

• run the website.

  1.2 The Seller as controller. When a Seller creates an invoice, it decides what personal data of its customers to include, such as a buyer's name, email address or order details. It also decides whom to add as a subscriber. For this data the Seller is an independent controller and is responsible for having a lawful basis to share it with us. Questions about how a Seller uses your data should go to that Seller. Its contact details are on the invoice.

  1.3 If you are a Payer, both TEDR and the Seller you pay receive information about your payment. Each uses it for its own purposes, as described in its own privacy notice.

2. Personal data we collect

2.1 Sellers

• Account data: email address, password (stored only as a secure hash), name, surname, username.
• Company data: company name, logo and description shown on invoices and receipts.
• Security data: confirmation codes, two-step sign-in settings (the authenticator secret is stored encrypted), sign-in history, active sessions, IP address, device and browser information, and approximate location derived from the IP address. We use this data to warn you about new sign-ins.
• Financial data:
  • balances;
  • invoices and their content;
  • payments received;
  • withdrawals;
  • payout wallet addresses;
  • returns of held funds;
  • fees.
• Settings: accepted coins and networks, payment tolerance, invoice defaults and notification preferences.
• Integration data: API key identifiers (the secret part is shown only once and not stored in readable form), webhook URLs, webhook delivery logs and API request logs.
• Verification data: where we ask you to verify your identity, your business or the source of funds (see section 2.6 of the Terms), we collect the documents and information you provide.
• Communications: messages to support, feedback and our replies.

2.2 Payers

• Payment data:
  • the invoice you pay;
  • the coin, network and amount;
  • the exchange rate;
  • the deposit address;
  • the transaction hash;
  • the sending wallet address;
  • the time and status of the payment.
• Contact data: the email address you enter to receive a receipt, or that the Seller adds when it sends you an invoice or adds you as a subscriber. It may also include your name, if the Seller includes it.
• Technical data: IP address, browser and device information when you open a payment page.
• Screening data: the risk result for your payment and the blockchain information it is based on (see section 4).

Payers do not need an account. We do not ask Payers for card details or wallet private keys and never store them.

2.3 Visitors and people who contact us

• Contact form: name, work email, topic, message and your consent to be contacted.
• Website usage: pages visited, referring page, browser and device information, collected through cookies and similar technologies (see section 12).

2.4 Sources

We collect data:

• directly from you;
• from the Seller, for Payers and subscribers;
• from public blockchains;
• from our payment infrastructure providers;
• from blockchain analytics providers;
• from public sanctions lists.

3. Why we use your data and on what legal basis

Where we rely on legitimate interest, we have weighed it against your rights. You can ask us for details of this balancing.

4. Payment screening and automated decisions

4.1 Every incoming crypto payment on a payment page is checked automatically after the network confirms it. To do this, we share the transaction and the related wallet addresses with a blockchain analytics provider. The provider returns a risk assessment. Before funds are returned, the receiving address may be checked in the same way.

4.2 Based on this assessment, the Service decides automatically whether to credit a payment or block it. A blocked payment is not credited to the Seller. If a check cannot be completed, our team reviews it.

4.3 These decisions are needed to meet our legal obligations and to perform the contract with the Seller. If you believe a decision about your payment is wrong, contact us (section 14). You can ask for a person to review it, explain your point of view and contest the decision.

4.4 We do not disclose the details of a risk assessment, including scores, categories or the provider's report. This may be restricted by law, and disclosure could help people get around financial crime controls. This may limit your right of access to this specific information as far as the law allows.

5. Public blockchain data

Crypto transactions are recorded on public blockchains. Anyone can see transaction amounts, wallet addresses and times, and these records cannot be changed or deleted. We cannot erase information from a blockchain, including after you exercise your rights under section 10. We only control the data we hold in our own systems.

6. Who we share data with

We do not sell personal data and do not share it for cross-context behavioral advertising.

We share data only as needed for the purposes in section 3:

• The Seller you pay. When you pay an invoice, the Seller sees the payment details for its invoice, including:

  • the amount, coin and network;
  • the status;
  • the transaction hash;
  • the email address you entered.

  The Seller is not told the details of a risk assessment.

• Service providers that process data on our behalf under contracts that require confidentiality and security:

  • hosting and cloud infrastructure;
  • payment and crypto infrastructure;
  • blockchain analytics;
  • email delivery;
  • customer support tools;
  • website analytics.

• TEDR affiliates that help us operate the Service, under the same safeguards.

• Authorities and regulators, including financial intelligence units, law enforcement and courts, where the law requires it or to protect rights, property and safety. We may be legally prohibited from telling you about such a disclosure.

• Professional advisers, such as auditors and lawyers, under a duty of confidentiality.

• A buyer or successor in a merger, acquisition or sale of assets. The successor continues to protect the data as described in this Policy.

7. International transfers

Our team and service providers may be located in countries other than yours. Some of these countries may not offer the same level of data protection. When we transfer data out of the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the safeguards (section 14).

8. How long we keep data

9. How we protect data

We use technical and organizational measures appropriate to the risk, including:

• encryption in transit and at rest;
• hashed passwords and encrypted secrets;
• confirmation codes and optional two-step sign-in for sensitive operations;
• signed API requests and webhooks;
• access controls and logging;
• staff confidentiality obligations.

No system is completely secure. Keep your password, authenticator app and API keys safe, and contact us immediately if you suspect unauthorized access. If a personal data breach is likely to put you at high risk, we will notify you and the competent authority as the law requires.

10. Your rights

10.1 Depending on where you live, you may have the right to:

• access your personal data and get a copy;

• correct inaccurate or incomplete data;

• delete your data;

• restrict or object to processing, including processing based on legitimate interest and all direct marketing;

• data portability — receive the data you gave us in a structured, machine-readable format;

• withdraw consent at any time, without affecting earlier processing;

• not be subject to a solely automated decision with legal or similarly significant effects, and to get human review (section 4);

• lodge a complaint with your local data protection authority.

  10.2 Some rights are limited by law. In particular, we may have to keep financial and compliance records for the period in section 8 even if you ask us to delete them, and we may not be able to disclose screening details (section 4.4).

  10.3 How to use your rights. Sellers can update most account data and delete the account in the dashboard settings. For other requests, contact us (section 14). We may ask you to confirm your identity first. We respond within one month, or within the period required by your local law. If the request is complex, we may extend this as the law allows and tell you why.

  10.4 Payers. If your request is about data the Seller added to an invoice, we may forward it to the Seller or ask you to contact the Seller directly.

  10.5 California and other US states. We do not sell or share personal information as these terms are defined in US state privacy laws, and we do not use sensitive personal information to infer characteristics about you. You will not be treated differently for using your privacy rights.

11. Children

The Service is not intended for anyone under 18. Sellers must be at least 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it, unless the law requires us to keep it.

12. Cookies

12.1 Our website and dashboard use:

• strictly necessary cookies, which keep you signed in, protect forms and remember your cookie choice;

• with your consent where required, analytics cookies, which help us understand how the site is used.

  12.2 Public payment pages use only cookies needed for the payment to work.

  12.3 You can change your choice at any time in the cookie banner or your browser settings. Blocking necessary cookies may stop parts of the Service from working. Details are in our cookie notice.

13. Changes to this Policy

We may update this Policy from time to time. We publish the new version here with a new "Last updated" date. We tell Sellers about material changes by email or in the dashboard before they take effect.

14. Contact

For privacy questions or to use your rights, contact support@tedr.com with "Privacy" in the subject line.