Privacy Policy

This Privacy Policy describes how OrbChain ("we," "us," or "our") collects, uses, and protects information when you use our crypto payment gateway services, including our website, API, and merchant dashboard (collectively, the "Service").

1. Information We Collect

1.1 Account Information

When you register for an OrbChain account, we collect your email address. This is the only piece of personal information required to create an account and use our Service.

1.2 Technical and Usage Data

• API usage logs — request timestamps, endpoints accessed, response status codes, and request volume for rate limiting and abuse prevention.
• IP addresses — collected for rate limiting, abuse prevention, and geolocation-based access controls (sanctions compliance). IP addresses are not linked to merchant identity beyond the current session.
• Session data — JSON Web Tokens (JWT) stored as browser cookies for authentication purposes only.

1.3 Blockchain Transaction Data

By the nature of public blockchain networks, transaction data — including wallet addresses, transaction hashes, amounts, and timestamps — is publicly visible and permanently recorded on the blockchain. OrbChain processes and stores references to this data to operate the Service.

Lightning Network payments (when a merchant accepts the BTC_LN rail) have different privacy properties: only channel open and close transactions appear on the base Bitcoin blockchain, while individual Lightning payment hops are off-chain and onion-routed. OrbChain records its own internal transaction metadata for Lightning payments (invoice, payment hash, amount, timestamps) for the record-keeping obligations described in our AML Policy; that internal record is not published to the base blockchain.

2. How We Use Your Information

We use the information we collect exclusively for the following purposes:

• Service operation — processing payments, generating deposit addresses, executing payouts, and delivering webhook notifications.
• Abuse prevention — enforcing rate limits, detecting fraudulent patterns, blocking sanctioned addresses, and preventing misuse of the platform.
• Customer support — responding to your inquiries and troubleshooting issues with your account or transactions.
• Service improvement — analyzing aggregate, anonymized usage patterns to improve API performance and reliability.

3. Data Storage and Security

All data stored by OrbChain is encrypted at rest using industry-standard AES-256 encryption. Access to production systems and databases is strictly controlled through role-based access policies and multi-factor authentication.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include:

• TLS 1.3 encryption for all data in transit
• Database-level encryption at rest
• Role-based access control for internal systems
• Regular security audits and vulnerability assessments
• API key hashing — merchant API keys are stored as one-way hashes

4. Cookies and Tracking

OrbChain uses a single session cookie containing an encrypted JWT token for authentication when you are logged into the merchant dashboard. This cookie is essential for the Service to function and cannot be disabled while using the dashboard.

We do not use:

• Third-party tracking cookies
• Analytics cookies (Google Analytics, Mixpanel, etc.)
• Advertising or retargeting cookies
• Social media tracking pixels

5. Third-Party Data Sharing

OrbChain does not sell, rent, or share merchant data with third parties for marketing or advertising purposes.

By the inherent nature of blockchain operations, the following third-party infrastructure providers may process transaction data:

• Blockchain node providers — third-party services that relay transactions to their respective blockchain networks on our behalf.
• Blockchain networks — all transactions are broadcast to and recorded on public blockchain networks (Bitcoin, Ethereum, Tron, Litecoin, etc.), which are publicly accessible.

We may disclose data if required to do so by law or in response to valid legal process (subpoenas, court orders, or equivalent).

6. Data Retention

• Account data — retained for the duration of your active account. Upon account deletion request, your email and associated API keys are permanently removed within 30 days.
• Transaction records — retained for 5 years from the date of the transaction for regulatory compliance purposes, after which they are permanently deleted.
• API logs — retained for 90 days for operational and debugging purposes, then automatically purged.
• Blockchain data — transactions recorded on public blockchains are immutable and permanent by nature. OrbChain has no ability to modify or delete on-chain data.

7. Your Rights (GDPR and Similar Frameworks)

Regardless of your location, we extend the following rights to all OrbChain users:

• Right to access — request a copy of all personal data we hold about you.
• Right to rectification — request correction of inaccurate personal data.
• Right to erasure — request deletion of your personal data, subject to legal retention obligations.
• Right to portability — receive your data in a structured, machine-readable format.
• Right to object — object to our processing of your data for specific purposes.
• Right to restrict processing — request that we limit how we use your data.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.

8. Children

OrbChain's Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If you are under 18, you may not use the Service. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly.

9. International Data Transfers

OrbChain operates infrastructure across multiple jurisdictions. Your data may be transferred to and processed in countries other than your own. We ensure that appropriate safeguards are in place for all international data transfers in accordance with applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

For material changes that significantly affect how we process your data, we will make reasonable efforts to notify registered merchants via their account email address.

11. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: [email protected]