Privacy notice

Effective date: October 19, 2026

PayWicket is built so that we hold as little of your data as possible: we never hold your money, we never see card numbers, and we measure our website without tracking cookies. This notice explains what we do collect, why, and how long we keep it.

In plain English: No tracking cookies, no advertising pixels, no data brokers. We count visits ourselves with a daily‑rotating anonymous identifier, we keep merchant account details because you asked us to run your payments, and we keep card‑payment records only to the extent the licensed card provider shares them with us. Wick, our assistant, records chats and calls so we can answer you properly.

1. Who we are

PayWicket ("we", "us") provides non‑custodial payment technology at paywicket.com. For questions about this notice or your data, email support@paywicket.com.

2. Visitors to our website

We run first‑party, cookieless analytics. When you view a page, your browser sends us the page address, the page that referred you, any campaign tags in the link (utm_* or ref), its language, time zone, screen size and connection type, how far you scrolled and how long the page stayed open, and the technical details every web request carries (IP address, browser and device type). We use the browser details to understand what people read and on what kind of device; we do not combine them into an identifier.

No cookies, no fingerprinting. Repeat views are grouped under an anonymous identifier derived from your IP address and browser with a secret that changes every day, so we cannot follow you from one day to the next, and we cannot link it to you as a person. Within a single tab we keep a random session identifier in session storage, which your browser deletes when the tab closes.
Where you are coming from. We resolve the IP address to an approximate location (country, region and city — never an address) and to the network that owns it (for example a company network, a university, a public agency or a mobile carrier), using IPinfo and the public WHOIS records that the internet registries publish for each address block, plus the address's public reverse‑DNS name. When the network belongs to an organization we show that organization to our sales team together with the pages its people viewed, so we can follow up with businesses that seem interested. Visits from home, mobile, cloud and VPN connections are not attributed to anyone. We do not buy or sell personal data from data brokers.
Retention. Full IP addresses are kept for 30 days for security and abuse prevention, then truncated (the last part of the address is removed) so they no longer identify a specific connection. Aggregated statistics are kept indefinitely.
EU, EEA and UK visitors, and Global Privacy Control. If our systems place you in the EU, EEA or UK, or your browser sends the Global Privacy Control signal, we truncate your IP address before storing anything and keep only the country — no city, no network owner, no organization, no hostname.
Blocking. Content blockers that stop requests to /api/t stop this measurement entirely; the website keeps working.

3. Contact and walkthrough requests

If you send us a message through the website form, we keep your name, email, company and message so a person can reply and follow up. We record which page you were on and how you found us (referrer and campaign) so we know which channels work. For business email domains we also look up public facts about the company (its website title and description, logo and mail provider) so our team knows who is asking. We do not add you to a newsletter without asking.

4. Wick, our assistant

Wick answers questions by chat and by phone. Conversations are recorded and transcribed so we can review answers, improve the assistant and follow up when you ask us to. If you share contact details with Wick, they are passed to our team as a sales or support lead. Wick cannot see merchant accounts, payments or wallets. The assistant platform (Yupiter) processes conversations on our behalf under contract.

5. Merchants (account holders)

Account. Email, name, a hash of your password, your authenticator secret, your payout wallet address or public key, and your business profile if you request card acceptance.
Payments. Amount, description, status, transaction hashes, payer wallet addresses, and for card payments the buyer email and the order reference the licensed card provider gives us. We never receive card numbers.
Generated wallets are created in your browser; the recovery phrase never reaches our servers. We store only the extended public key needed to derive receiving addresses.
Sign‑up attribution. We note how you found us (landing page, referrer, campaign or partner code) to pay partner commissions and understand our channels.
Operational logs. Logins (with IP address and browser), API calls, webhook deliveries and staff actions are logged for security, support and audit. Payment records are kept for as long as required by tax and anti‑money‑laundering rules.

6. Buyers paying a PayWicket merchant

If you pay with a crypto wallet, the payment is a public blockchain transaction between you and the merchant; we record the transaction hash and your wallet address. If you pay by card, the licensed card provider verifies your identity and processes the card; we receive the result and your email address so a receipt can be sent. Our checkout page is measured like any other page (see section 2) plus the steps you reach in the payment flow, so we can find and fix where buyers get stuck.

7. Who we share data with

Only service providers that need it to run PayWicket: our hosting provider (Render), our DNS and security provider (Cloudflare), our email provider (Resend), our IP‑to‑location and network lookup provider (IPinfo, which receives IP addresses only) and the public WHOIS services of the regional internet registries (ARIN, RIPE and their peers, which also receive the IP address only), the licensed card provider (Crossmint) for card payments, and the assistant platform (Yupiter) for Wick. We share data with authorities only when the law requires it. We do not sell personal data.

8. Your rights

You can ask us what we hold about you, ask us to correct or delete it, or object to processing, by emailing support@paywicket.com. Merchants can update account details and delete their payout wallet from the dashboard. We respond within 30 days. Where data is kept to meet a legal duty (for example payment records), we will tell you.

9. Security

All traffic is encrypted in transit. Staff access requires two‑factor authentication and is logged. Secrets such as webhook keys are stored hashed or encrypted. If a breach ever affects you, we will notify you without undue delay.

10. Changes

We will update this notice when our practices change and keep the effective date above current.