Legal
Privacy Policy
What personal data Ravelo collects when you visit our site, run a merchant account or pay through a Ravelo checkout; why we use it, who receives it and how long we keep it.
Last updated
01Who is responsible
[Legal entity name], of [Registered address], decides why and how personal data is used for merchant accounts, the website at ravelopay.app, and the dashboard at app.ravelopay.app, and so is the controller of that data. Questions and requests go to [Privacy contact email]. Our data protection officer, if one is appointed, is at [Data protection officer email, if one is appointed].
When a merchant uses Ravelo to take a payment, the merchant decides what it collects from its own customer and why. For the payer data the merchant sends us or that arrives with a payment, we process it on the merchant's behalf, and the merchant's own privacy notice applies. We also use some of that data for our own security and screening duties, and then we are responsible for it.
02What we collect
| Group | Examples | From |
|---|---|---|
| Account and team | Name, work email, role, language and display preferences, invitations | You and your administrators |
| Sign-in and security | Passkey public keys, sessions, device and browser details, IP address, security events | You and your device |
| Business verification | Business details, ownership, representatives' identity details and documents, results of checks | You, public registers, verification and screening providers |
| Payments and payouts | Amounts, assets, networks, wallet addresses, transaction hashes, timestamps, order references, refunds, payout destinations | You, your customers' payments, the blockchain and our payment provider |
| Screening | Address and transaction risk results, sanctions matches, case notes, review decisions | Our screening tools and reviewers |
| Integration | Webhook endpoint URLs, delivery logs, API request metadata (not secrets) | Your systems |
| Support and communication | Messages, attachments, call notes, notices we send | You and our team |
| Website | Pages requested, IP address and basic technical logs | Your browser |
03How and why we use it
| Purpose | Basis (to be confirmed by counsel) |
|---|---|
| Provide the service: accounts, payments, payouts, balances, webhooks, support | Contract |
| Verify businesses, screen deposits and addresses, apply country rules, keep required records | Legal obligation and legitimate interest |
| Keep the service secure, detect fraud and abuse, keep an audit trail | Legitimate interest |
| Send service and security emails, and notices about these policies | Contract and legitimate interest |
| Run the website and improve it from technical logs | Legitimate interest |
| Respond to legal requests and defend claims | Legal obligation and legitimate interest |
We do not sell personal data, and we do not use it for advertising. We make no decision about you solely by automated means that has a legal effect on you, except that a screening tool may place a payment on hold; a person reviews every hold before it is released or returned.
04Who receives it
We share data only as needed to run the service, and with these kinds of recipient:
| Recipient | Why | Data |
|---|---|---|
| 2328 (payment provider) | Creates payment requests, receives deposits, runs payouts and its own risk screening | Order references, amounts, assets, addresses, transaction data |
| Resend (email delivery) | Sends sign-in, security and service emails | Recipient email address, message content |
| [Screening and blockchain-analytics provider] | Sanctions and blockchain-analytics screening | Wallet addresses, transaction hashes |
| [Identity verification provider, if used] | Identity and business verification | Identity details and documents |
| [Hosting and infrastructure provider] | Hosting, delivery of the website and storage | Technical data, stored records |
| Professional advisers, auditors, insurers | Advice and audit | As needed, under confidentiality |
| Authorities and courts | Where the law requires or allows | As required |
| A buyer or successor | If the business is sold or reorganised | As needed, under confidentiality |
This website serves its fonts and every other file from our own domain, so reading it sends no request to a third party. The dashboard and the hosted checkout load their typeface from Google Fonts, so your browser contacts Google, which receives your IP address, when one of their pages loads. None of them uses third-party analytics or advertising tools.
Blockchains are public. Transactions and addresses recorded on a blockchain are visible to anyone and cannot be edited or erased by us or anyone else.
05International transfers
Our providers and team may be in other countries. Where data leaves the country or region it was collected in, we use the transfer tools the law of that place provides, such as standard contractual clauses, and we ask recipients to keep it protected. The countries concerned are [Hosting and infrastructure provider], to be listed before launch.
06How long we keep it
Retention is set per kind of data in a configuration that our staff can change only with a second person's approval. At the date of this page the periods are:
| Data | Kept for |
|---|---|
| Sign-in sessions | 90 days |
| Webhook delivery logs | 90 days |
| Audit records of account and staff actions | 10 years (3,650 days) |
| Financial, ledger and screening records, and verification documents | [Retention period for financial and compliance records] |
| Account and team data | While the account is open, then as needed to meet the periods above |
| Support messages | As long as needed to resolve the matter and handle later claims |
We keep data longer where a law, a dispute or an investigation requires it, and delete or anonymise it when the period ends. Data recorded on a public blockchain cannot be deleted.
07Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable form, withdraw consent you gave, and complain to your data protection authority. Write to [Privacy contact email]. We may need to confirm who you are first. We may refuse or limit a request where we must keep the data, for example to meet record-keeping and screening duties, or where it would reveal another person's data, and we will tell you why.
If you are a customer of a merchant, send requests about your order to that merchant first.
08How we protect it
- Each merchant's data is separated from every other merchant's.
- Sensitive actions need a passkey confirmation, and sensitive changes by our staff need a second person's approval.
- Secrets and personal data are kept out of logs and URLs.
- An audit trail records who did what.
09Children
The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.
10Changes and contact
When we change this policy we update the date above and, for material changes, tell account owners by email. Contact: [Privacy contact email]. See also the Cookie Policy.