1. Who is responsible
The controller of the personal data described here is Mint-Rail.com (Dubai), UAE, trading as Mint-Rail. Contact us at [email protected].
2. What we collect
From merchants: the names, email addresses and roles of the people who use the portal; company, licensing and contact details supplied at onboarding; API keys and embed origins; sign-in records including IP address and device.
About a merchant's customers, during a payment: the email address used to open the wallet; the wallet address; the customer reference the merchant attaches, if any; the IP address of the device; the amount, currency and status of the payment; and the resulting on-chain transaction. We do not receive card numbers or identity documents. Those are collected by the on-ramp provider under its own policy.
Automatically: server logs, and the technical details of every request we make to a provider and every event a provider sends us, kept for security and reconciliation.
3. Why, and on what basis
- To run the payment and report its outcome to the merchant: performance of a contract.
- To verify a merchant's licence and eligibility, and to detect and prevent fraud and misuse: our legitimate interests, and legal obligations that apply to us.
- To keep security and audit records: our legitimate interests and legal obligations.
- To answer support requests: performance of a contract and our legitimate interests.
4. Who receives it
A payment involves third parties who are each an independent controller of what they collect: the wallet provider that creates and secures the customer's wallet (which receives the email address), the on-ramp provider that verifies the customer and sells them the digital asset (which receives the email address, wallet address, customer reference, IP address and amount, and performs its own identity verification), and the public blockchain network on which the transfer is recorded. A transfer recorded on a public blockchain is visible to anyone and cannot be deleted.
We also use hosting, email delivery and error-monitoring providers as processors under contract. We disclose data to authorities where the law requires.
5. International transfers
Some providers operate outside the European Economic Area. Where personal data leaves the EEA we rely on an adequacy decision or on standard contractual clauses with the recipient.
6. How long we keep it
Payment, transaction and audit records are kept for as long as the merchant's account is open and for the period afterwards that anti-money-laundering and accounting law requires. Sign-in records are removed when a session expires. Server logs are kept for a short, fixed period.
7. Your rights
You may ask for access to, correction of, or deletion of your personal data, ask us to restrict or object to its processing, and ask for a copy in a portable form. Write to [email protected]. You may also complain to the data-protection authority where you live. Rights over data held by a wallet or on-ramp provider are exercised with that provider.
8. Cookies
We use only cookies the service needs: a session cookie for signed-in users, a short-lived signed cookie that binds a payment to the browser that opened it, and a cookie remembering your colour-scheme choice. We do not use advertising or cross-site tracking cookies.
9. Security
Data is encrypted in transit; secrets and provider credentials are encrypted at rest. Access is limited to the people who need it and every change is recorded.
10. Changes
We will post any change to this policy here with a new effective date, and tell merchants of material changes directly. Our Terms & Conditions govern the use of the service.