This policy explains how Cradex handles personal data when you visit cradex.net, use the dashboard and APIs, or pay an invoice on a Cradex hosted checkout page.
1. Data we collect
We collect only what we need to run the services:
- Account data — name, email, phone (optional), password hash, two-factor settings.
- Business data — company name, website, country, industry, expected volume and contact details submitted for review.
- Transaction data — invoices, wallet addresses you configure, on-chain transaction hashes and amounts, balance history, gift card orders.
- Technical data — IP address, browser and device information, login sessions and security logs.
2. Customers paying on hosted checkout
People paying a merchant invoice do not need a Cradex account. We process the invoice details provided by the merchant, the network selected and the public blockchain data of the payment (sender address, hash, amount). We use a small browser storage entry to remember the preferred network.
3. How we use data
- to provide, secure and improve the services, including detecting payments and sending callbacks;
- to review Business applications and prevent fraud, abuse and sanctions violations;
- to send transactional emails such as security alerts, receipts and gift card deliveries;
- to comply with legal obligations and respond to lawful requests.
5. Security
Passwords are hashed, API keys and webhook secrets are encrypted at rest, gift card codes are stored encrypted and all traffic uses TLS. We support two-factor authentication and let you review and revoke active sessions at any time.
6. Retention
We keep account and transaction records for as long as your account is active and afterwards for the period required by accounting and anti-money-laundering rules, after which they are deleted or anonymised.
7. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Most profile data can be edited in Settings; for anything else, contact us and we will respond within 30 days.
9. International transfers
Our providers may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
10. Changes
We will post updates on this page and notify you of material changes by email or in the dashboard.
Contact
Questions about this document? Email [email protected] or use our contact page.