Privacy Policy

1. Who we are

GenesisPay is non-custodial payment infrastructure operated by Genesis Technologies FlexCo, Gerhard-Bronner-Straße 1/109, 1100 Vienna, Austria (“GenesisPay”, “we”, “us”). We are the controller for the processing described in this policy unless a section says otherwise. This policy covers genesispay.finance, our checkout and payment pages, the dashboard, our APIs, our published SDKs, the GenesisPay MCP server and Sign in with GenesisPay.

We are a technical service provider, not a bank or a payment institution. Payments are stablecoin transfers directly between wallets. Buying stablecoins with money (top-ups) and selling them for money (cash-out) is provided by the licensed provider Rampnow under its own licences, terms and privacy policy; it acts as a separate controller for the data you give it (sections 4.8 and 6).

Privacy questions and requests: [email protected]. We have not appointed a data protection officer, because the conditions of Art. 37 GDPR do not apply to us; the address above reaches the people responsible for data protection.

Two things make GenesisPay different from a conventional payment processor, and both matter for your privacy. First, we are non-custodial: payments move directly from payer to seller, and we cannot spend or freeze what is in your wallet. Second, payments settle on a public blockchain, where data cannot be altered or deleted (section 5).

2. Who this policy covers

• Sellers — businesses and individuals who accept payments through GenesisPay, including people who apply for a merchant account.
• Payers — people who pay a GenesisPay payment link, subscription or invoice, with or without an account.
• Agent owners — people who set up an agent account so that an AI agent or assistant can find and pay for things under limits they set.
• Recipients of a Send and invoice recipients whose email address or wallet another user enters.
• Visitors — anyone browsing our website or documentation.

3. Where your data comes from

Most data comes from you: what you enter, and what your browser, wallet or agent sends us. Some comes from others (Art. 14 GDPR):

• Privy tells us your email address and, if you sign in with Google, the name on your Google account, which we use as your display name.
• Cloudflare tells us the approximate location (country, city and coordinates rounded to about 11 km) it derives from your IP address.
• The Base blockchain tells us whether and when a payment settled.
• Rampnow tells us the status of a top-up you make with it (4.8).
• Your AI assistant sends the purchase instruction for each purchase it makes for you (4.7): it copies your approval sentence and computes the conversation fingerprint. We cannot verify that it copied them faithfully.
• Other users may enter your data: a seller who invoices you, or a user who sends you money by your email address.

You do not have to give us any data. But we cannot open an account, run a payment or review an application without the data marked as needed for it; optional fields are marked as optional.

4. What we process, why, and for how long

For each activity below we list the data, the purpose, the legal basis under Art. 6(1) GDPR, and how long we keep it. “Contract” means Art. 6(1)(b) (providing the service you asked for, or steps you asked for before a contract); “legal obligation” means Art. 6(1)(c); “legitimate interests” means Art. 6(1)(f), which you may object to (section 9); “consent” means Art. 6(1)(a), which you may withdraw at any time.

4.1 Account and sign-in

Data

Email address; display name (taken from your Google account if you sign in with Google, otherwise none); the sign-in method and its identifier; the address of the embedded wallet Privy creates for you; and, for a sign-in through Privy, the identifier of that Privy session (not a password or token) and when it last signed you in. Payers can also sign in by signing a message with their own wallet, which gives us only the wallet address.

Why

To create and secure your account and keep you signed in. Sign-in runs through Privy, which creates a self-custodial embedded wallet for you if you do not have one. Privy holds that wallet’s key material under its own security model; we never see your private key. We keep the Privy session identifier so that signing out your other devices (or logging out within 15 minutes of signing in, which also ends your other devices’ sessions) also stops a Privy session on those devices from signing in to GenesisPay again: such a device has to sign in afresh.

Legal basis

Contract. Rate-limiting sign-in attempts by IP address: legitimate interests (preventing abuse).

How long

For as long as your account exists. There is no self-service account deletion yet; write to us and we will close your account and delete what we are not required to keep within 30 days of closure, except settlement evidence (section 4.2). Privy session identifiers and their sign-in times are kept for as long as your account exists, so that signing out other devices cannot be undone; they are deleted when you close your account.

4.2 Payments and checkout

Data

The payment link or product; amount, currency and stablecoin; payer and seller wallet addresses; the signed payment authorisation; transaction hash; timestamps; the network used; and the approximate location the checkout was opened from (country, city and coordinates rounded to about 11 km, derived by Cloudflare — never your IP address itself).

Why

To prepare, verify and broadcast your payment, prove it happened, and show it to both parties. Sellers see the approximate location in their earnings view, to understand where their buyers are.

Legal basis

Contract; bookkeeping duties: legal obligation; settlement evidence (wallet address and signed payment terms): legitimate interests (proving that a payment was or was not settled, and preventing a signed payment from being replayed); the approximate location: legitimate interests (fraud prevention and seller insights) — the location is coarse (city level) and never your IP address, and you can object to it (section 9).

How long

Completed payments: as long as bookkeeping law requires (section 8). Checkout attempts that expire or fail, or whose transfer arrived after the payment window closed: after 30 days we remove their approximate location, and also the wallet address unless the attempt is kept as settlement evidence — because a payment was prepared, signed or submitted from it, or it belongs to an agent (x402) payment or a settlement flow that must stay provable. Billing details entered on them are removed after 30 days if no document was issued. Settlement evidence (the wallet address and signed payment terms) is kept like the data on the blockchain (section 5).

4.3 Receipts and invoices

Data

Recipient name and email address, billing name and address you enter at checkout (optionally saved to your account — you can delete the saved profile at any time), the seller’s business details, amounts and document numbers.

Why

To email receipts and invoices through Resend. When a seller enters a buyer’s details on an invoice, the seller decides to invoice that person and is responsible for having the right to do so; we process the data to deliver it.

Legal basis

Contract; issuing and keeping tax documents: legal obligation.

How long

Issued invoices and receipts: 7 years after the end of the business year, as Austrian tax and commercial law requires (§ 132 BAO, § 212 UGB).

4.4 Seller business profile and verification (KYB)

Data

Legal business name, registration number and register court, registered address and seat, founding date, tax registration, website, industries, countries of operation, a description, and documents you upload — such as a certificate of incorporation, registries, articles of association and the ID or passport of a controlling person. Your notes, and the reviewer’s decision and notes.

Why

To verify a business before it receives live payments. Documents are uploaded directly to private Cloudflare storage and are only accessible to authorised GenesisPay staff through short-lived links. If verification needs attention, we email you the reviewer’s notes.

Legal basis

Contract with the seller, and legitimate interests (preventing fraud and keeping prohibited businesses off GenesisPay).

How long

Verification decisions are never overwritten, so each decision stays on record. Verification records and documents are kept for 5 years after the business relationship ends, then deleted.

4.5 Merchant applications (waitlist)

Data

What kind of business you run, your website or shop URL, what you sell, the country your business is based in, and your expected monthly volume (as a range). We link the application to your account, so the reviewer also sees your email address and display name. We do not visit or crawl your website automatically.

Why

We open merchant accounts in waves. A person at GenesisPay reads every application and decides whether we can serve your business now — for example whether it fits our acceptable-use rules. The reviewer records an internal reason for the decision; it is used to keep decisions consistent and accountable and is not shown or emailed to you (you can request it — section 9). We email you the decision through Resend. Approval only lets you finish setting up a merchant account; business verification (4.4) is a separate, later step.

Legal basis

Steps you asked for before a contract (contract); recording the reviewer and reason: legitimate interests (consistent, auditable decisions).

How long

We keep your applications and their decisions as a history while your account exists, so a later application can be judged fairly. A rejected application is deleted 2 years after the decision.

4.6 Agent accounts, wallets and spending limits

Data

The agent account’s name; its wallet address; your spending policy (per-payment, daily and monthly caps) and allowlist; API keys (stored only as hashes, with when they were last used); every agent payment with its target URL, the description the agent gave, amount, status and transaction hash; the request body the agent sent to a seller for a paid POST request; every approval decision you make; and a log of changes to these controls and to your seller API keys: what changed, the old and new value, and who changed it (you, our staff or your connected store) and how they were signed in.

Why

To let your agent pay within the limits you set, to stop it when it should not, and to give you a complete audit trail. An agent wallet is your wallet: it is owned by your Privy account, and you can withdraw from it at any time. With your consent when you create it, GenesisPay is added as a restricted additional signer that can only sign stablecoin payment authorisations, and only when our server-side checks of your limits and allowlist pass. You can revoke that signer at any time. We record when you gave and when you revoked this delegation.

Legal basis

Contract; the audit trail and security checks: also legitimate interests.

How long

For as long as the agent account exists; payment records as in section 8. A POST request body is kept as long as the payment record it belongs to. The control log is kept after an agent is archived and after your account is closed, as the record of who authorised spending, for 7 years after the end of the business year in which the change was recorded.

Saved shipping details. You may save one shipping address for your agents to use when they buy physical goods for you: the recipient’s first and last name, the postal address and, if you add them, a phone number and an email for the shop (otherwise your account email is used). We store it encrypted, together with a keyed fingerprint of the address and name that tells us whether an address is new, whether you have confirmed it, and whether you or an agent last changed it. Your connected agents can read and update it as part of their normal access to your agent account (4.7). An address you save yourself in the dashboard counts as confirmed. We send it to a seller only when an order is placed for you, so that the seller can deliver it (section 6). You can change or delete it at any time in Settings, and it is deleted when you close your account. Legal basis: contract. How long: until you delete it or close your account.

4.7 Connecting an AI assistant

You can connect an AI assistant — ChatGPT or Codex (OpenAI), or Claude (Anthropic) — to your agent account, so it can find products and, where the connection allows, pay for them. You choose the provider and you control the connection. Here is exactly what happens.

Chat starter prompt. From “Connect an assistant” you can open a new chat with a short prompt, which asks the assistant to remember that you shop with GenesisPay and to check GenesisPay shops first when you want to buy something. We put the prompt in the link that opens the chat. The prompt contains no key, wallet address or other account data. Because the assistant may store it as a memory, it can influence later chats until you delete that memory in the assistant’s settings.

Connecting the GenesisPay tools (MCP). In a terminal or desktop app you run our open-source MCP server (@genesis-tech/genesispay-mcp) on your own device with an agent API key. When the assistant uses a GenesisPay tool, the tool result goes into the conversation and so to the AI provider. Depending on the tool, that can include:

• your agent account’s name, wallet address, network, status and USDC balance;
• your spending caps, whether the allowlist is on (not its entries), and how much the agent has spent today and this month;
• search, shop and trending results — public listings of sellers’ products;
• purchase requests and outcomes: the amount, our fee, the seller’s wallet, the status, the transaction hash, a link to approve an over-limit payment, the reason a payment failed or was refused, and the content you bought (the seller’s response, up to 50,000 characters per tool result; stored responses can be read in further chunks);
• the status of an earlier payment, including the agent account’s internal identifier, the URL paid, the description the agent gave and its timestamps;
• your saved shipping details (4.6): the recipient’s name and the full postal address, so the assistant can read the address back to you before an order; the email and phone number are shown only partly.

Apart from those saved shipping details, the tools never send your email address, your name, or the entries of your allowlist. What you type into the assistant, and any personal data you choose to share there, goes to the provider as well. We receive from the assistant only the tool requests: search terms (which we do not store), the URL to pay, the maximum amount, a short description, a request identifier that prevents paying twice, the identifier of a payment to look up, for a paid POST request, the body sent to the seller (stored with the payment, see 4.6), and, when you ask the assistant to save one, a shipping address (stored as your saved shipping details, see 4.6).

Stored service responses. To resume a purchase after a session interruption, GenesisPay retains complete successful JSON responses up to 1 MiB for seven days from first capture. Only the owning agent can retrieve them. After seven days the content is inaccessible; scheduled deletion clears its body and digest. Account closure removes it. Reading a response does not restart the period. Payment records follow their separate retention rules. External images linked inside a response remain subject to the provider’s retention.

Purchase reviews. If you ask your assistant to prepare a review, we receive the payment identifier, your stars and your comment. We check the purchase and keep a private draft for 24 hours. Your assistant shows the product, a randomly assigned pseudonym, stars and exact comment before you instruct it to publish. Published reviews show that information, a publication date and a verified-purchase label; they do not expose your wallet address, email or payment identifiers. The same pseudonym is used for your reviews of one seller. Your comment is public, so do not include personal information you do not want to share. AI may help phrase your opinion; it does not choose your stars or authorize publication.

Review publication requires a separate permission for the agent. Connecting an assistant for payments alone does not grant it. Internally we retain the connection between the review, your account and the verified purchase to prevent duplicate votes and abuse. Withdrawal removes the stars and comment; account closure also removes your review records and pseudonyms. Expired draft content is removed by scheduled deletion. Published content remains until withdrawal or closure; a moderation decision may hide it earlier. The minimal record preventing a second vote remains until account closure. Financial purchase evidence follows its separate retention rules. Your AI provider receives review tool requests and responses in your conversation and applies its own retention policy.

Purchase instructions. For each new purchase your assistant sends a purchase instruction: the item (the address of the resource, or the product, quantity and shipping option), the maximum total you agreed to including fees, a reference to your saved shipping details for physical goods (never the address itself), your approval sentence as you wrote it (up to 500 characters; some emoji and scripts count as two or more) and a SHA-256 fingerprint of the visible purchase conversation. The fingerprint is computed by the assistant’s GenesisPay software: on your own device when you run our MCP server, inside whatever runs your agent when it uses our SDK, or briefly in our server’s memory when you use a remote connection (below), where the conversation is discarded at once and never logged or stored. We use the instruction to refuse a purchase that does not match it or exceeds your maximum, before any money moves, and as evidence if you dispute the purchase. Legal basis: performing the contract for the purchase you asked for (Art. 6(1)(b) GDPR); keeping the approval sentence and the fingerprints as dispute evidence: our legitimate interest in resolving disputes about what was authorised (Art. 6(1)(f) GDPR). We encrypt your approval sentence. Only you — and the staff member who prepares a copy of your data at your request — can see the instruction: on your Approvals page while the purchase waits for you, in your dispute case and in that copy. Sellers do not see it, and our support case views do not show it. We delete the approval sentence 180 days after the purchase unless a dispute about it is open; the other fields and the fingerprints stay with the payment record (section 8). One of those fingerprints covers the whole instruction, sentence included, so a short sentence that someone guesses could still be checked against it. A fingerprint cannot be turned back into your conversation, but anyone holding the conversation can check it against the fingerprint — keep your chat if you may need it as evidence.

Sign in with GenesisPay (remote connections). Web chats that cannot run our MCP server — currently Claude and ChatGPT — connect to genesispay.finance/mcp instead. You sign in with GenesisPay (a sign-in from the last 15 minutes is required), choose one agent account, and approve the connection on a screen that shows the app as unverified, the address it will send you back to, and the agent’s limits and balance. The assistant then receives the same tool results as above, for that one agent only. We email you each time a new app is connected (section 4.14).

We store, for each remote connection:

• the app’s registration: the name the app gives itself (we do not verify it), its identifier — either one we issue, or the web address of a metadata document the app publishes — the addresses it may send you back to, and how it authenticates. If an app uses a secret, we store only a hash of it. We fetch a published metadata document from the app’s own server, keep only these fields, and do not store the document itself;
• the connection: your account, the agent account, when you approved it, which version of the consent text you saw, when it expires, when it was last used and renewed, and when and why it ended;
• a connection history — connected, renewed, revoked, and a replayed credential detected — which cannot be edited, and is deleted when its retention period ends;
• credentials: access (valid 15 minutes), renewal (lapses after 30 days without use) and one-time approval codes (60 seconds), all stored only as hashes. A connection lasts at most 90 days; after that you approve it again.

We do not store the IP address or device of the app or of your browser for a connection; IP addresses are used only briefly to limit request rates (section 4.11).

What the provider can never do. Connecting an assistant gives the provider neither custody of your money nor the power to sign for you. Every payment still passes our server-side checks: an allowlist miss is blocked, and anything over your caps waits for your own approval in the dashboard.

You stay in control. Revoke the agent API key (Keys tab of your agent) or, for remote connections, the app under “Connected apps”; access ends on the next request. A remote connection also ends when the app disconnects itself, when you revoke GenesisPay’s signer for that agent (which ends all of its connections), when you approve the same app for the same agent again (the new connection replaces the old one), automatically if one of its credentials is used twice (a sign of theft), and after 90 days. When a connection is revoked, payments it started that still wait for your approval are refused. You can also pause the agent. Revoking stops future access; it cannot recall what the provider already received.

The provider is responsible for its own processing. The provider you connect is an independent controller: it processes your conversation and tool results under its own terms and privacy policy, which may include storing them, using them to improve its models depending on your settings there, and transferring them outside the EU. We do not control this and are not responsible for it. We send tool results to the provider only because you connected it and asked it to use GenesisPay. Please read the provider’s policy:

• OpenAI (ChatGPT, Codex)
• Anthropic (Claude)

Legal basis

Contract — you ask us to make your agent account available to the assistant you choose (Art. 6(1)(b) GDPR). You end it at any time by revoking the connection or key.

How long

API keys: until you revoke them (keys do not expire on their own). Remote connections: until revoked, and at most 90 days. Connection records, hashed credentials and the connection history: 1 year after the connection ends. An app’s registration: 1 year after its last connection ends. What the provider keeps: see its policy.

4.8 Top-ups, cash-out and Send

Data

For a top-up we send Rampnow only your GenesisPay wallet address, the network (Base), the token (USDC), the currency, a suggested amount and an order reference (a random identifier we create). We do not send your email address, name, postal address, phone number or any other personal data. Rampnow then sends us signed status updates for the order: its order ID, our reference, the status, the type of payment method, the money and token amounts and currencies, the fees, the wallet address the tokens go to and the blockchain transaction hash. We keep these in a top-up record linked to your account. For a cash-out we open Rampnow’s sell page with your wallet address, the network, the token and the payout currency filled in. For a Send, the recipient (an email address of a GenesisPay user or a wallet address) and the amount.

Why

Top-ups and cash-outs happen on Rampnow’s own page, which we open in a new browser tab. Rampnow is a separate controller: what it asks of you — email address, identity checks, card or bank details — you give to Rampnow directly, and we never receive it. We keep the top-up record to show where funds in your wallet came from and to handle support requests, disputes and our accounts. To cash out, you send USDC from your GenesisPay wallet to the deposit address Rampnow shows you, using Send. We do not record the sell order in your account and are not a party to the payout; if Rampnow notifies us about a sell order, we keep only a technical log entry (its order ID, status and any transaction hash) that is not linked to your account. Which top-up options are shown depends on your approximate country from Cloudflare, which we use for that decision and do not store. For a Send to an email address we look up the matching GenesisPay account and store only that account, never the email address you typed; the recipient is not notified by us. A Send is an on-chain payment and therefore public (section 5).

Legal basis

Contract; bookkeeping duties: legal obligation; top-up records: legitimate interests (proving where funds came from and handling disputes); regional availability of top-ups: legal obligation and legitimate interests.

How long

Top-up and Send records: as payment records (section 8).

4.9 Cashback (where offered)

Where we offer cashback, we record the qualifying payment, your wallet, the amount granted and claimed, and why a payment did not qualify (for example, paying yourself or reaching a monthly cap). Legal basis: contract. Kept as payment records (section 8).

4.10 Discovery and public shop pages

Sellers’ shop names, descriptions, products and prices are published in Discovery so people and agents can find them. “Trending” ranks products by recent sales, but never shows who bought them or how many buyers there were. Product images are stored in public Cloudflare storage. Legal basis: contract with the seller.

4.11 Security, logs and error alerts

Data

Structured server logs with non-secret identifiers (link, attempt, account and chain IDs, transaction hashes, wallet addresses, failure reasons). By design our logs contain no email addresses, names, postal addresses or secrets. We use IP addresses only in memory or as a keyed hash to limit request rates; our hosting and network providers process IP addresses to deliver traffic. For remote AI connections (4.7) we log only the connection, app and agent identifiers, the tool used, the outcome and how long it took — never what the assistant asked for or received — and, when we fetch an app’s metadata document, the app’s host name. For Sign in with GenesisPay (4.15) we log the site’s identifier and the outcome, never your sign-in ID, email address or credentials. Error messages are sent to our on-call chat.

Legal basis

Legitimate interests (keeping the service secure, available and correct).

How long

Up to 30 days.

4.12 Optional product analytics

If you explicitly allow it, we use PostHog EU Cloud to understand which broad parts of GenesisPay are used, such as documentation, checkout or dashboard products. We send only that page category under a random browser identifier and, when you arrive from Claude or ChatGPT, that fact (never the address you came from). This is pseudonymous data: it can link coarse usage across visits from the same browser, but we do not associate it with your GenesisPay account. We do not send full URLs or route parameters, payment amounts, wallet addresses, transaction hashes, account details, form contents or customer information. We have disabled autocapture, session replay, error capture, surveys, feature flags and person profiles. We also instruct PostHog not to use your IP address for geolocation. Nothing is sent to PostHog before you consent, and you can withdraw consent below at any time. Legal basis: consent (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). Kept for the duration of the analytics pilot; we review the need at least every 12 months and delete or aggregate data no longer needed.

With your permission, we also use Microsoft Clarity for heatmaps and masked session recordings on public marketing, documentation, blog, legal and Explore pages. Clarity receives browser and device information, public-page URLs and referrers, and interactions such as clicks and scrolling. Page text is masked. It is not loaded on account, sign-in, authorization, onboarding or payment pages. We do not send account identifiers to Clarity, and we deny advertising storage through its consent API. Nothing is sent to Clarity before your new analytics choice; an earlier PostHog-only grant does not enable it. Withdrawal stops recording, removes its first-party identifiers and reloads the page to unload the recorder. Microsoft normally retains recordings for 30 days and heatmap data for 13 months (including recordings marked as favorites). See Microsoft's privacy statement. Legal basis: consent, as above.

We do not use advertising trackers, pixels or ad networks. Wallet software brings its own connections: if you connect an external wallet, that wallet’s SDK (for example MetaMask or WalletConnect) contacts its vendor’s endpoints, including telemetry, under that vendor’s privacy policy. That happens only on pages where you connect or pay.

4.13 Cookies and browser storage

We only set what the service needs, plus your analytics choice. Nothing below is used for advertising. Privy and connected wallet software set their own strictly necessary storage to keep you signed in and connected.

In local and session storage we keep your analytics choice, drafts you have not finished (such as a verification form or a spending-mandate proposal), checkout progress so a reload does not lose your payment, and whether you dismissed the getting-started guide. Only after you allow analytics do PostHog and Clarity use first-party storage for their pseudonymous identifiers and consent state. The analytics prompt therefore offers an equally direct allow and decline choice.

4.14 Emails we send

We send only emails that belong to something you did: receipts, invoices, verification results, merchant-application decisions and, when you connect an app to an agent (4.7), a “New app connected” notice to your account’s email address with the app’s name, the address it sends you back to, the time, and a link to the agent where you can disconnect it. We do not send marketing email or newsletters.

4.15 Signing in to sellers’ sites (Sign in with GenesisPay)

Some sellers let you sign in to their own website or app with your GenesisPay account. This is separate from connecting an AI assistant (4.7). Signing in to a site gives it no access to your agent accounts, no way to move your money and no power to make or approve a payment; every payment is still one you approve yourself.

The approval screen. When a site sends you to GenesisPay, you sign in with your email address (through Privy). A sign-in with your own wallet, or with the shared demo account, cannot approve a site. Before anything is shared, we show you the site’s name and the seller’s business name (both chosen by the seller), the address the site will send you back to, and exactly what the site will receive. Nothing is shared until you choose Continue. Once you have approved a site, later sign-ins to it that ask for no more than you approved go through without the screen, until you disconnect it.

What the site receives. Only what the screen lists:

• always — a sign-in ID for you, and when you last signed in to GenesisPay. The sign-in ID is a code we compute for you and that seller. Every site of the same seller gets the same ID, so the seller recognises you each time; different sellers get different IDs, so they cannot use it to recognise you across sellers. On its own it reveals nothing else about you;
• if the site asks for your profile — your display name, if your account has one, and your GenesisPay username;
• if the site asks for your email — your email address and whether it is verified. We mark it verified only if it is the email address you sign in to GenesisPay with through Privy;
• if the site asks for your wallet — the address of your GenesisPay wallet.

The site receives this in a signed sign-in token and can ask us for it again while your connection is active. We never give it your balance, your agent accounts or your payments to anyone else.

Payments to that seller. When the seller checks a payment it received with us, and the payment came from your GenesisPay wallet while your connection to one of the seller’s sites is active, we tell the seller your sign-in ID — that is, which signed-in account paid. Independently of that, the wallet address you pay from is public on the Base blockchain (section 5), and the seller sees it with every payment (section 6). Together, this lets the seller link the wallet you pay from to your account with it, even if you did not share your wallet address. The approval screen tells you this. We do not confirm your sign-in ID for a payment made by an agent account or from another wallet, or once your connection has ended; the seller still sees the paying wallet.

We store, for Sign in with GenesisPay:

• the site’s registration, which the seller sets up on its Developers page: the seller’s account, the site’s name, the addresses it may send you back to, a hash of its secret, and when it was created, last used, given a new secret, or disabled and by whom;
• your sign-in ID for each seller you approved, so it stays the same every time;
• the connection: your account, the site, what you approved, which version of the approval text you saw, when you approved it, when it was last used, and when and why it ended;
• credentials: one-time approval codes (60 seconds, with the return address and a one-time value the site sent), access credentials (15 minutes) and renewal credentials (they lapse after 30 days without use and after 90 days at most; the site then sends you through GenesisPay again), all stored only as hashes;
• a history — site registered, secret changed, site disabled, approved, disconnected, a credential used twice — which cannot be edited, and is deleted when its retention period ends.

We do not store the IP address or device of the site or of your browser for a sign-in; IP addresses are used only briefly to limit request rates (section 4.11).

You stay in control. Disconnect a site at any time under “Connected apps” (genesispay.finance/account/apps, also in your dashboard settings). Access ends at once: the site can no longer get your information from us, its credentials stop working, and we no longer confirm your payments to it. A connection also ends when the seller or GenesisPay disables the site, when you approve the same site for more information (the new connection replaces the old one), automatically if one of its credentials is used twice (a sign of theft), and when your account or the seller’s account is closed. While a seller’s account is suspended, its sites cannot sign you in or get your information. A connection does not expire on its own.

The seller is responsible for what it receives. The seller is an independent controller for the information we send it: it processes that information under its own terms and privacy policy, and we do not control what it does with it. Disconnecting stops anything new reaching the seller from us; it does not delete what the seller already received. Ask the seller for that.

If you are a seller. When you register a site, we process the registration listed above, and show the site’s name and your business name (or display name) to the people who sign in.

Legal basis

Contract — you ask us to sign you in to the site and to share what you approve, including confirming to that seller which signed-in account paid it (Art. 6(1)(b) GDPR). You end it at any time by disconnecting the site. Registering a site: contract with the seller. Detecting reused credentials and keeping the history: legitimate interests (security, and being able to show who approved or ended a connection).

How long

Connections: until they end as described above. Connection records, hashed credentials, the history and your sign-in ID for a seller: 1 year after your last connection to that seller ends. Unused sign-in codes and access credentials are deleted 1 day after they expire. A site’s registration stays while the seller keeps it active; once the seller disables it (or its account is closed), it is deleted 1 year later. A site we disable for misuse is kept so it cannot return. What the seller keeps: see its privacy policy. A copy of your data (section 9) includes the sites you approved, what each may receive, and when you approved and disconnected them; for a seller, the sites it registered.

5. Blockchain data — public and permanent

When a payment or Send settles, the payer’s wallet address, the recipient’s address, the token, the amount and the transaction hash are recorded on the Base blockchain. That record is public, replicated across the network, and cannot be modified or erased — by us, by you, or by anyone. A wallet address is pseudonymous, but it can become personal data if it is linked to you elsewhere. Do not pay from a wallet whose transaction history you are not comfortable being public. Rights that depend on changing or deleting data (rectification, erasure) cannot be exercised against a public blockchain; they remain fully available for the data we hold in our own systems, except settlement evidence (section 4.2).

6. Who receives your data

We do not sell personal data and we do not share it for advertising. We share it only with the recipients below. Processors act on our instructions under a data-processing agreement (Art. 28 GDPR). Independent controllers receive data because you chose to use them, and process it under their own terms and privacy policies.

We also share data with:

• The other party to your payment — a seller sees the payment details of their payers (amount, wallet address, transaction hash, approximate location, and any details the payer provides) and may receive them by webhook in their own systems; if the payer signed in to the seller’s site with GenesisPay, the seller can also learn which signed-in account paid (4.15); a payer sees the seller’s business details on the checkout, receipt and invoice.
• A seller you buy physical goods from through an agent — when an order is placed, the seller receives the recipient’s name, the shipping address, the email and, if saved, the phone number (4.6), and processes them as an independent controller to deliver the order. Nothing is sent before an order is placed. Sellers never receive your purchase instruction, approval sentence or conversation fingerprint (4.7).
• The public — through the Base blockchain (section 5) and Discovery (4.10).
• Authorities and courts — where we are legally required to disclose data, or to establish or defend legal claims.

7. International transfers

Our database and application run in the EU. Some processors are based in the United States (see the table in section 6). Where personal data leaves the EEA, we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards. When you connect an AI assistant or use a top-up or wallet provider, that provider decides where your data goes under its own policy. AI assistant providers are usually based in the United States; we send them tool results only at your request, because you connected the assistant and asked it to use GenesisPay (Art. 49(1)(b) GDPR), and where the provider is certified under the EU–US Data Privacy Framework, that adequacy decision applies as well. When you sign in to a seller’s site with GenesisPay, we send what you approve to that seller, wherever it operates, at your request (Art. 49(1)(b) GDPR). Data written to a public blockchain is, by its nature, replicated globally.

8. Retention overview

9. Your rights

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data deleted (Art. 17) — except what we must keep by law, settlement evidence (section 4.2), and what is on a public blockchain;
• restrict processing (Art. 18);
• receive data you gave us in a portable, machine-readable format (Art. 20);
• withdraw consent at any time, without affecting earlier processing (Art. 7(3)) — for analytics, use the controls in section 4.12.

Right to object (Art. 21). Where we rely on legitimate interests, you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data for legal claims.

Write to [email protected]. We answer within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity, for example by writing from your account’s email address. Exercising your rights is free.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You may also complain to the authority where you live or work.

10. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects about you or similarly significantly affect you (Art. 22). Merchant applications and business verification are decided by a person. Agent spending limits and allowlists are rules you configure: we apply them automatically, and over-limit payments wait for your own decision. Which top-up options are shown in your region follows fixed regulatory rules, not a profile of you.

11. Security

The strongest protection is structural: we never hold your funds and never store the private keys of a payer’s wallet, so there is no pool of customer money or keys to breach. Beyond that, traffic is encrypted in transit (TLS), API keys and connection credentials are stored only as hashes, session cookies are signed, verification documents are kept in private storage, agent spending limits are enforced server-side, and access to production systems and the staff console is restricted and logged. No system is perfectly secure; if a breach affects your data, we will notify you and the authority as the GDPR requires.

12. Children

GenesisPay is not directed at children. You must be at least 18 years old (or the age of majority where you live) to use the service.

13. Changes and change log

When we change this policy we update the date at the top and add an entry below. For material changes we notify account holders by email or in the dashboard before the change takes effect.

• 21 October 2026 — Added purchase instructions sent by connected AI assistants: item, maximum total, delivery reference, your approval sentence and a fingerprint of the conversation — never the conversation itself (summary, 3, 4.7, 6, 8).
• 16 October 2026 — Optional product analytics may also record that you arrived from Claude or ChatGPT, never the address you came from (4.12, 6).
• 12 October 2026 — Set the retention period for the log of agent-control and seller API-key changes: 7 years after the end of the business year in which the change was recorded, including after archive or account closure (4.6).
• 10 October 2026 — We now keep the identifier of each Privy sign-in session and when it last signed you in, so that a sign-out on another device also ends it; kept for as long as your account exists and deleted when you close it (4.1).
• 10 October 2026 — Late-transfer checkout attempts: approximate location and billing details removed after 30 days (4.2, 8).
• 9 October 2026 — Named the log of changes to your agent controls and seller API keys, who made them and how they were signed in, and that it is kept after an agent is archived and after account closure (4.6).
• 8 October 2026 — Rampnow is now the only provider for top-ups and cash-out; MoonPay and Privy’s funding window are no longer used. Described what we send Rampnow (no personal data), the order status updates we receive and keep as a top-up record, and how cash-out works (1, 3, 4.8, 6, 8).
• 6 October 2026 — Added optional Microsoft Clarity heatmaps and masked public-page recordings, a new analytics consent choice, and the associated recipient and browser-storage disclosures (4.12, 4.13, 6).
• 2 October 2026 — Added Sign in with GenesisPay: what a seller’s site receives when you sign in to it, the sign-in ID that differs per seller, how a payment to that seller is linked to your sign-in, what we store, how you disconnect, and how long we keep it (1, 4.11, 4.15, 6, 7, 8).
• 2 October 2026 — Added saved shipping details for agent purchases of physical goods: one encrypted address, readable and updatable by your connected agents, sent to a seller only when an order is placed, deletable at any time and deleted on account closure (4.6, 4.7, 6, 8).
• 27 September 2026 — Added seven-day storage of captured service responses, retrieval in chunks, expiry and account-closure deletion (4.7, 8). Added purchase review drafts, pseudonyms, separate publication permission, withdrawal and retention (4.7, 8). Clarified that wallet addresses and signed payment terms are kept as settlement evidence, on which legal basis, and that this evidence is an exception to deletion and erasure; and that expired checkout attempts and old payment records are de-identified rather than deleted (4.1, 4.2, 5, 8, 9).
• 26 September 2026 — Clarified that the connection history is deleted when its retention period ends (4.7).
• 26 September 2026 — Added connecting AI assistants (4.7), including remote connections for web chats and the “New app connected” email, merchant applications (4.5), agent wallets and delegation (4.6), top-ups through Privy and Send (4.8), approximate checkout location (4.2), a full recipient table (6), a cookie table (4.13), a retention overview (8) with fixed periods, and this change log. Named the on-ramp providers (MoonPay, Rampnow) instead of an unnamed partner. Top-ups are no longer described as unavailable in the United Kingdom.
• 31 August 2026 — Added optional, consent-based product analytics.
• 13 August 2026 — First published.

14. Contact

Genesis Technologies FlexCo
Gerhard-Bronner-Straße 1/109, 1100 Vienna, Austria
[email protected]

See also our Terms of Service.