Privacy at BlockAck

1. Scope and roles

This policy applies to BlockAck.com and the BlockAck merchant platform. BlockAck.com provides and operates the service described in this policy. For merchant account and service-operation data, BlockAck generally acts as a controller or business. For personal data a merchant submits about its customers through the API, the merchant determines the purpose and is responsible for providing notices, obtaining a lawful basis, honoring rights, and limiting collection. BlockAck processes that data to provide the service.

2. Information we collect

• Account data: name, email address, verification state, authentication records, the Terms and Privacy version accepted at signup, the Terms version and time recorded when you create a hosted store, plan, and support communications.
• Merchant configuration: store names, environment, callback URL, public wallet addresses or extended public keys, provider identifiers, and encrypted provider credentials. Never submit seed phrases or private keys.
• Payment operations: invoice amounts and currencies, metadata supplied by merchants, an optional payer reference, an optional receipt email, public blockchain transaction identifiers, addresses, confirmations, payment state, callback delivery, and risk-review records. A receipt email is used to send that receipt.
• API and security data: API-key identifiers and hashes, permissions, usage counters, request timing, hashed network identifiers used for rate limiting, errors, and audit/security events. First-party API statistics aggregate daily authorization attempts by account, environment, permission, outcome, and access tier. When server-side Google analytics is enabled, authorized API calls also generate usage events containing fixed operation, permission and environment categories, without account identifiers, credentials, request contents or payment details. Per-account aggregate rows are not exported to Google.
• Device and analytics data: selected page views and fixed product-action categories, browser/device details, approximate location derived by Google, and analytics identifiers. Google Analytics loads automatically on supported pages and may use cookies or similar technologies.

3. How we use information

We use information to create and secure accounts; provide stores, invoices, monitoring, callbacks, billing, support, and risk indicators; meter usage; prevent abuse and unlawful use; compare public payment addresses with official sanctions lists; diagnose reliability; communicate service changes; enforce agreements; comply with law; and improve product performance. When our host provides a country code for a request, we use it only to refuse signup and new payment activity from comprehensively embargoed jurisdictions. We do not save that country code on the account. If you provide a public website at signup, we fetch that page and may send the page text and your description to Google Gemini to screen for prohibited activity. We store the address, your description, a score, and a short reason. We do not store the page. A score is not an approval. We do not use merchant public keys to spend funds and do not sell personal information for money.

4. Legal bases

Depending on location, processing may rely on performance of a contract, legitimate interests in operating and securing the service, consent where required, and compliance with legal obligations. Merchants must establish their own lawful bases for customer data they submit.

5. How information is shared

Information may be shared with infrastructure and service providers needed to operate BlockAck, including Vercel, Supabase, Google Cloud, Google Analytics, email delivery providers, and BTCPay-related infrastructure; with professional advisers; in a corporate transaction; or when reasonably required by valid law, security, fraud prevention, or protection of rights. Public blockchain data is inherently public and may be copied by third parties beyond BlockAck’s control.

6. International transfers and retention

Providers may process data in countries other than yours. Where required, appropriate transfer mechanisms should be used. We keep account, payment, security, and abuse records while an account is open and afterward for as long as needed to secure the service, resolve disputes, meet accounting and legal duties, and enforce the Terms. A request to delete an account does not erase backups still within their retention window, public blockchain records, or records the law requires us to keep. We do not store seed phrases or private keys.

7. Security

We use access controls, scoped credentials, encryption for supported secrets, tenant isolation, and monitoring. No system is completely secure. Merchants are responsible for endpoint security, API-key handling, callback verification, wallet backups, private keys, and restricting submitted metadata.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent where processing depends on consent. You may also complain to a regulator. Contact support@blockack.com. We may verify identity and may deny or limit requests where permitted by law.

9. Cookies and analytics

Authentication and security features may use necessary cookies. Google Analytics loads automatically on supported pages; the site does not display an analytics consent banner or preference control. Browser privacy settings and blocking tools may restrict collection. Custom events measure navigation to API docs, payment-link guidance and pricing, sign-in, accepted signup requests, onboarding steps, and dashboard sections. They do not include form contents, email addresses, keys, wallet addresses, payment amounts, or transaction identifiers. Page locations use a fixed list of routes without query strings or fragments; payment, verification, admin, and preview routes are excluded. Google may process analytics identifiers and device, page-view, and approximate-location information subject to its terms. Blocking future collection does not delete information already received by Google.

10. Children, changes, and contact

BlockAck is a business service not directed to children, and users must be legally able to contract. We may update this policy and will post the new date; material changes may require additional notice or consent. Questions and requests: support@blockack.com.