Privacy Policy

Last updated: 2026-09-16

Privacy Policy

This Privacy Policy explains how [to be completed] ("Paysipa", "we", "us") processes personal data when you use the Paysipa dashboard and hosted checkout, in line with the EU General Data Protection Regulation (GDPR).

Controller

The data controller is [to be completed], [to be completed]. Contact our data protection contact at [to be completed].

What we collect

For merchants: your name, email address, password (stored as a salted hash, never in plain text), business name and country, and the payment and webhook activity your Stripe-connected account generates. For your customers, at checkout: only what Stripe's hosted payment fields collect directly, which Paysipa never sees or stores.

Why we process it (legal basis)

We process merchant account data to perform our contract with you (Art. 6(1)(b) GDPR): creating your account, running the checkout, and paying out through Stripe. We process security-related data, such as login attempts, on the basis of our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

Payment processing through Stripe

Paysipa creates charges directly on your own Stripe-connected account; we never hold your customers' card details. Stripe processes payment data as an independent controller for its own compliance obligations; see Stripe's own privacy policy for details.

Cookies and local storage

Paysipa uses one session cookie to keep you signed in and your browser's local storage to remember your light/dark theme choice and your analytics choice.

Website analytics

On the public Paysipa website, and only if you allow it in the consent banner, we count visits with our own self-hosted instance of Plausible Analytics at analytics.amarbaro.com. It records the page you viewed, the referring site, your browser, operating system and device type (desktop, tablet or mobile) and your country, derived from your IP address. It sets no cookies and stores no identifier: your IP address is only used, together with your browser's user agent, to compute a daily-rotating hash so a visit is not counted twice, and the IP address itself is never stored. The data stays on our own server and is not shared with anyone.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time through the "Cookie settings" link in the footer, which stops all counting from that moment. Analytics never runs in the merchant dashboard or on the hosted checkout, so your customers are not counted when they pay.

How long we keep data

We keep account and transaction data for as long as your account is active, and afterward only as required by tax and commercial-law retention periods under German law.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or export your personal data, and to object to processing based on legitimate interest. Contact [to be completed] to exercise these rights. You may also complain to your local data protection supervisory authority.

International transfers

Where Stripe or another processor handles data outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

Security

We use industry-standard measures, including hashed passwords, encrypted secrets, and access controls, to protect your data. No online service can guarantee absolute security.

Changes to this policy

We may update this policy as the service evolves; the version in effect is always the one published at this address.

Contact

Questions about this policy or your data: [to be completed].