Privacy Policy
Last updated 2 November 2026
This explains what VinGate collects, why, and who sees it. For your own buyers you are the controller and we are a processor: we handle their data to take the payment you asked for and for nothing else.
What we collect
- Account: email address, hashed password, session cookies, and the businesses you create.
- Business: name, statement descriptor, support details, connected processor accounts and their encrypted tokens.
- Payments: amount, currency, status, description, line items, the buyer email you pass, a hash of the buyer IP, card brand and last four digits, and processor references.
- Developers: API keys (stored hashed), webhook endpoints and their encrypted signing secrets, delivery attempts and responses.
- Operations: alerts, risk decisions, and error logs.
What we never see
Full card numbers. The card fields on a checkout page are the processor's own frames, so the number goes from the buyer's browser straight to Square or Stripe and comes back as a token.
Processor passwords. Connecting an account uses the processor's consent screen and returns a scoped token or account reference.
Why we process it
- To perform the contract: run checkouts, route payments, record them, deliver your webhooks.
- Legitimate interests: fraud and velocity checks, keeping the service up, and fixing faults.
- Legal obligations: tax records, and answering processor or authority requests.
- Plan billing: charging your card on file for the plan you chose.
Who we share it with
- The processor you connected (Square or Stripe), as the party that charges the card.
- Supabase, our Postgres and auth host.
- Vercel, which serves the app; GitHub Actions, which runs the scheduled jobs.
- Our own Square account, for plan charges only.
- Anyone you point a webhook at. Those payloads are yours.
How long we keep it
- Payment records and plan charges: 7 years, for tax.
- Hashed buyer IPs and risk decisions: 90 days.
- Webhook delivery attempts and error logs: 30 days.
- Dormant accounts with no payments: deleted on request.
Security
Processor tokens and webhook secrets are encrypted at rest. Traffic is TLS. Webhook calls are signed and verified. The Security page has the detail.
No system is perfect. If a breach affects your data we tell you without undue delay and describe what was exposed.
Your rights
You can ask for a copy of your data, correction, deletion, or export, and you can object to processing based on legitimate interests. Write to support@vinnapayments.com and we answer within 30 days.
A buyer who wants their data should ask the business they paid first; we assist that business rather than deciding for it.
Data is stored in the United States. Where data leaves the EEA or UK we rely on standard contractual clauses.
Cookies
Session cookies keep you signed in and remember whether the dashboard is showing test or live. Checkout pages set no marketing cookies.
Changes
Material changes are posted here with a new date. If a change needs consent we ask on the dashboard.