AssetPay — Merchant of Record

Last updated: June 12, 2026

1. Who we are

AssetPay ("AssetPay", "we", "us") is a payment processing service and an AssetRails company. We provide card and cryptocurrency payment acceptance, banking, and settlement services to approved merchants. This policy explains how we handle personal data when you visit our website, apply for a merchant account, use our services, or pay a merchant through an AssetPay checkout.

2. Information we collect

Merchants and applicants

Business information — legal entity name, registration number, country of incorporation, website, business vertical, and estimated volumes.
Know-Your-Business (KYB) data — identity documents and personal details of directors, shareholders, and ultimate beneficial owners, as required by applicable anti-money-laundering (AML) law.
Contact details — names, email addresses, and phone numbers of your team.
Financial details — settlement bank accounts, payout wallet addresses, and transaction history.

Merchants' customers (payers)

Payment data — card details are captured by our PCI DSS-compliant payment partners; AssetPay does not store full card numbers. For crypto payments we process wallet addresses and on-chain transaction data.
Transaction data — amount, currency, timestamps, payment status, and the merchant order reference.
Technical data — IP address, browser type, and device information used for fraud prevention and 3-D Secure authentication.

Website visitors

Information you submit through our application or contact forms.
Basic technical logs (IP address, pages viewed) needed to operate and secure the site.

3. How we use personal data

To provide payment processing, settlement, and related services.
To onboard and verify merchants, including KYB, sanctions, and AML screening required by law.
To detect and prevent fraud, abuse, and security incidents.
To meet legal and regulatory obligations, including record-keeping and reporting.
To communicate with you about your application, account, or support requests.
To improve our services and website.

4. Legal bases

Where data protection law applies (for example the GDPR or UK GDPR), we rely on: performance of a contract (providing the services), legal obligation (AML/KYB, accounting, and regulatory requirements), and legitimate interests (fraud prevention, network security, and service improvement).

5. Sharing

We share personal data only as needed to deliver the services:

Payment partners — acquiring banks, card scheme partners, and banking providers that process transactions on our behalf.
Service providers — hosting, identity verification, sanctions screening, and analytics vendors under contract.
Regulators and law enforcement — where required by law or to protect our legal rights.
Blockchain networks — crypto transactions are recorded on public blockchains by design; on-chain data (addresses, amounts, transaction hashes) is public and cannot be deleted.

We do not sell personal data.

6. International transfers

Our partners and infrastructure may be located outside your country. Where required, we use appropriate safeguards such as standard contractual clauses for cross-border transfers.

7. Retention

We keep merchant and transaction records for as long as your account is active and afterwards as required by AML and financial regulation — typically five years after the end of the business relationship. Website enquiries are kept only as long as needed to handle them.

8. Security

We use industry-standard safeguards: encryption in transit, hashed credentials and API secrets, role-based access controls, and segregated infrastructure. Card data is handled by PCI DSS-compliant partners. No system is perfectly secure; we encourage merchants to protect their API keys and report any suspected compromise immediately.

9. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. Note that we cannot delete data we are legally required to retain (for example KYB records within the statutory retention period) or data recorded on public blockchains. To exercise your rights, contact privacy@assetpay.io. You may also lodge a complaint with your local data protection authority.

10. Cookies

Our website uses only essential cookies and local technologies needed for the site to function. We do not run third-party advertising trackers.

11. Children

Our services are for businesses and are not directed at children under 18. We do not knowingly collect data from children.

12. Changes

We may update this policy from time to time. Material changes will be notified on this page with an updated date, and to merchants by email where appropriate.

13. Contact

Questions about this policy or our data practices: privacy@assetpay.io.

Privacy Policy