Privacy policy
Last updated: 2026-10-18
This page lists what easyway stores, why, and who else sees it. We collect what the gateway needs to run your account and your payments, and nothing for advertising. We do not sell personal data.
What we store about merchants
| Data | Why |
|---|---|
| Account | Email address, name, a salted scrypt hash of your password (never the password itself), whether the email is verified and when you last signed in. If you sign in with Google: your Google account id and profile picture URL. |
| Business settings | Business name, website, support email, your fee rate, invoice lifetime, underpayment tolerance and notification choices. |
| Security | Your 2FA secret (encrypted), hashed backup codes, your withdrawal whitelist, API keys (stored only as a keyed hash, with the time and IP address each key was last used) and webhook URLs with their signing secrets. |
| Money | Your balances, ledger entries, invoices, deposits and payouts, including the destination address and the IP address a payout was requested from. |
| Activity log | Sensitive actions (API keys, whitelist, 2FA, withdrawals) with time, IP address and browser user agent, so you and we can investigate misuse. |
What we store about your customers
When someone pays one of your invoices we store the invoice: amount, coin, deposit address, the on-chain transactions, and whatever you attach to it (order id, description, metadata). If you or the customer provide an email address it is stored on the invoice; it is used to email product codes or downloads for product links, and it is visible to you in the dashboard, the API, CSV exports and webhooks. Donation links store the donor name and message if the donor enters them. We store these on your behalf: you decide what to send us, and your customers' questions about their data are best answered by you first.
Blockchain transactions are public by nature. Anyone can see an address and its transfers on a block explorer; we cannot hide or erase them.
Server logs
Our servers log each request (time, method, path, status and IP address) to keep the service running and to spot attacks. Logs are used for operations and security only.
What your browser keeps
After you sign in, the dashboard keeps your session token and your name and email in the browser's local storage (key site.auth), so you stay signed in across tabs; signing out removes it. If a language choice is offered and you pick one, a NEXT_LOCALE cookie remembers it. The dashboard may remember small interface choices (such as a dismissed checklist) in local storage. There are no advertising or analytics trackers on this site.
Who else sees data
You, through the dashboard, the API and webhooks sent to the URLs you configure. Google, only if you choose to sign in with Google. Our mail server, which sends sign-in codes, notices and product emails. Blockchain networks and the nodes and data services we use to watch them, which see addresses and transactions but no names or emails. Exchange-rate sources receive no personal data. We disclose data to authorities only when the law requires it.
How long we keep it
Account, invoice and payout records are kept while your account is open and afterwards for as long as they are needed for accounting, fraud prevention and legal obligations. Email sign-in codes expire after 10 minutes.
Your choices
You can see and export your payments and payouts in the dashboard (CSV export) and change your settings there. To get a copy of your data, correct it, or close your account and have personal data deleted where we are not required to keep it, email support@easyway.cash from your account's address.
Security
How we protect accounts and funds (watch-only API server, separate signer, 2FA, whitelists, hashed keys) is on the security page. The rules for using the service are in the terms of service.
Changes
When this policy changes we update this page and its date, and email account owners about changes that matter. Questions: support@easyway.cash.