Privacy

In short

• The website sets no cookies and measures nothing: no tracking, no analytics, no ads.
• Your money never passes through us. Payments go straight to your wallet, and we never know your keys.
• Your account and your store are stored on our server in Switzerland.
• We never sell data and only share it with the services listed below.

Who is responsible

Markus Schneeberger, owner of bitcoinpayments, c/o JL Consulting Group GmbH#2166, Zürcherstrasse 84, 8852 Altendorf, Switzerland, is responsible for processing your data.

Questions about privacy: hoi (at) bitcoinpayments.ch.

When you visit the website

The website is delivered via Cloudflare. To get the pages to you and protect them from attacks, Cloudflare processes technical details such as your IP address, the time, the page requested and your browser. We do not analyse this information.

We serve the fonts ourselves; your browser contacts no third party for them. If you choose the light or dark theme, only your browser remembers it; this setting never leaves your device.

The “Status” page asks our server whether it is running when it loads. The server sees your IP address, as with any request.

Your account and your store

For your account on our BTCPay Server we process your email address, your password (stored only in encrypted form) and your store settings. To keep you signed in, the server sets cookies that are needed for it to work.

When you connect a wallet, the server stores its public key (xpub). It uses it to create payment addresses and detect incoming payments; it can see all addresses of that wallet but can never move funds. That is why we recommend a separate wallet just for BTCPay.

Invoices, point of sale, donations and recurring payments in your store contain data about your customers, such as amounts and – if you ask for them – names or email addresses. We process this data only on your behalf so that your store works. You are responsible for it towards your customers.

Everything is stored on our server in Switzerland. On the way there, the connection passes through Cloudflare and an upstream server in an EU/EEA country that forwards it.

Our servers keep technical logs with IP address, time, requested address and browser to detect faults and attacks. We only look at them for that purpose.

Plan and payment

For your plan we process your email address, the term, your balance and your payments. You pay in bitcoin through our own store – with no payment provider in between.

Payments on the Bitcoin blockchain are public and cannot be deleted. Anyone who knows an address or transaction can look it up. That is a property of Bitcoin, not of us.

Emails

Automatic emails – for example about signing up, your password or your plan – are sent through a Swiss email service with servers in Switzerland.

If you write to us, we process your message and details to reply. Our mailboxes are provided by a Swiss provider; they may be stored in Switzerland or in an EU/EEA country.

Now and then we may email you about our own, similar offers. Every such email contains an unsubscribe link, or just write to us at hoi (at) bitcoinpayments.ch.

Who receives data

Only the services we need to operate receive data, and only as much as necessary:

• Cloudflare (USA): delivering the website and protecting the server
• Operator of the upstream server (EU/EEA): forwarding connections to and from our server, storing encrypted backups
• Email delivery service (Switzerland)
• Provider of our mailboxes (Switzerland or EU/EEA)

Data abroad

According to the Swiss Federal Council, EU/EEA countries provide adequate data protection. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council also recognises as adequate.

We only hand over data to authorities if the law requires us to.

How long we keep data

• Your account and store: until you ask us to delete them, at the latest 6 months after your plan ends. We delete locked accounts in batches, so it can take up to 6 months.
• Records of your payments to us: ten years, as required by law for bookkeeping.
• Emails to us: as long as we need them for your request.
• Backups: encrypted, in Switzerland and on a server in an EU/EEA country. Whatever has been deleted disappears from the backups after three months at the latest.
• Technical logs: one month at most.

Security

Connections to the website and to our server are encrypted, and so are our backups. You can turn on two-factor sign-in for your account – we recommend it. We look after the server personally and keep it up to date.

Your rights

You can ask at any time what data we hold about you, have it corrected or deleted, and request it in a common format. Just write to hoi (at) bitcoinpayments.ch. To make sure nobody else receives your data, we first check that the request really comes from you.

If you disagree with our answer, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

Changes

If our services change, we update this policy. The version on this page applies.