Privacy notice

Effective date: October 23, 2026

PayWicket is built so that we hold as little of your data as possible: we never hold your money, we never see card numbers, and we measure our website without tracking cookies. This notice explains what we do collect, why, and how long we keep it.

In plain English: No tracking cookies, no advertising pixels, no data brokers. We count visits ourselves with a daily‑rotating anonymous identifier, we keep merchant account details because you asked us to run your payments, and we keep card‑payment records only to the extent the licensed card provider shares them with us. Wick, our assistant, records chats and calls so we can answer you properly.

1. Who we are

PayWicket ("we", "us") provides non‑custodial payment technology at paywicket.com. For questions about this notice or your data, email support@paywicket.com.

2. Visitors to our website

We run first‑party, cookieless analytics. When you view a page, your browser sends us the page address, the page that referred you, any campaign tags in the link (utm_* or ref), its language, time zone, screen size and connection type, how far you scrolled and how long the page stayed open, and the technical details every web request carries (IP address, browser and device type). We use the browser details to understand what people read and on what kind of device; we do not combine them into an identifier.

No cookies, no fingerprinting. Repeat views are grouped under an anonymous identifier derived from your IP address and browser with a secret that changes every day, so we cannot follow you from one day to the next, and we cannot link it to you as a person. Within a single tab we keep a random session identifier in session storage, which your browser deletes when the tab closes.
Where you are coming from. We resolve the IP address to an approximate location (country, region and city — never an address) and to the network that owns it (for example a company network, a university, a public agency or a mobile carrier), using IPinfo and the public WHOIS records that the internet registries publish for each address block, plus the address's public reverse‑DNS name. When the network belongs to an organization we show that organization to our sales team together with the pages its people viewed, so we can follow up with businesses that seem interested. Visits from home, mobile, cloud and VPN connections are not attributed to anyone. We do not buy or sell personal data from data brokers.
Retention. Full IP addresses are kept for 30 days for security and abuse prevention, then truncated (the last part of the address is removed) so they no longer identify a specific connection. Aggregated statistics are kept indefinitely.
EU, EEA and UK visitors, and Global Privacy Control. If our systems place you in the EU, EEA or UK, or your browser sends the Global Privacy Control signal, we truncate your IP address before storing anything and keep only the country — no city, no network owner, no organization, no hostname.
Blocking. Content blockers that stop requests to /api/t stop this measurement entirely; the website keeps working.

3. Contact and walkthrough requests

If you send us a message through the website form, we keep your name, email, company and message so a person can reply and follow up. We record which page you were on and how you found us (referrer and campaign) so we know which channels work. For business email domains we also look up public facts about the company (its website title and description, logo and mail provider) so our team knows who is asking. We do not add you to a newsletter without asking.

4. Wick, our assistant

Wick answers questions by chat and by phone. Conversations are recorded and transcribed so we can review answers, improve the assistant and follow up when you ask us to. If you share contact details with Wick, they are passed to our team as a sales or support lead. Wick cannot see merchant accounts, payments or wallets. The assistant platform (Yupiter) processes conversations on our behalf under contract.

5. Merchants (account holders)

Account. Email, name, a hash of your password, your authenticator secret, your payout wallet address or public key, and your business profile if you request card acceptance.
Payments. Amount, description, status, transaction hashes, payer wallet addresses, and for USDC purchases in the PayWicket Wallet the buyer email and the order reference the licensed card provider gives us. We never receive card numbers.
Generated wallets are created in your browser; the recovery phrase never reaches our servers. We store only the extended public key needed to derive receiving addresses.
Sign‑up attribution. We note how you found us (landing page, referrer, campaign or partner code) to pay partner commissions and understand our channels.
Operational logs. Logins (with IP address and browser), API calls, webhook deliveries and staff actions are logged for security, support and audit. Payment records are kept for as long as required by tax and anti‑money‑laundering rules.

6. Buyers paying a PayWicket merchant

If you pay with a crypto wallet, the payment is a public blockchain transaction between you and the merchant; we record the transaction hash and your wallet address. If you buy USDC with a card for your PayWicket Wallet, the licensed card provider verifies your identity and processes the card; we receive the result and your email address so a receipt can be sent. The USDC bought with your card lands in a purchase wallet that is yours: your email is its recovery method, and the only key that can move the funds is yours: on devices that support it, a passkey (created by your device's Face ID, Touch ID, Windows Hello or PIN and kept in your Apple, Google or Microsoft account, which also carries it to your other devices); otherwise a signing key created in your browser, inside the card provider's isolated frame. Approving a delivery with a passkey is a biometric or PIN prompt; the assertion your device produces is forwarded to the wallet to verify. We store the passkey's public key and credential id, never the private key. The first time an email is used for a PayWicket Wallet you confirm it with a one-time code sent by the card provider, so a wallet can only ever be created by the person who controls the email. You approve the delivery of your purchase to the merchant with that key; PayWicket holds no key to the wallet. The key stays in your browser's storage for that frame (clearing site data removes it; your email recovers the wallet). If your wallet uses a passkey, another device of yours that carries the same passkey needs no codes, and a device that does not can approve through your phone (the browser's QR prompt). If you later pay from a device without the passkey or a browser key, you verify your email with two short codes sent by the card provider, which registers a key for that device too. Our checkout page is measured like any other page (see section 2) plus the steps you reach in the payment flow, so we can find and fix where buyers get stuck.

6a. PayWicket Wallet (customer wallet app)

At paywicket.com/wallet you can sign in to the purchase wallet described above, see its balance and history, load it by card, send USDC to another wallet or to another PayWicket wallet by email, and set up autopay for subscriptions. Sign-in is a one-time code from the card provider (Crossmint); we verify the signed token they issue and keep a session of our own for up to 30 days (random token, your verified email, your wallet address, the IP address and browser that signed in). We store the operations you start (loads, sends, autopay set-ups) with amounts, fees, destination address or email, your note, and the transaction hash; these appear in your activity. A card load buys the full amount into your wallet; the processing fee is a transfer you approve afterwards, on its own or together with your next send or payment, and until then it shows as pending on your balance. Sending to someone by email looks up whether that address has a PayWicket wallet; nothing else about them is revealed to you. Autopay creates an on-chain mandate signed by your wallet that names the merchant, a per-cycle cap, a minimum interval and an expiry; it is public blockchain data. PayWicket cannot move funds in your wallet: every transfer, load or mandate is signed by a key on your device; our servers only prepare and relay. We never see card numbers.

7. Who we share data with

Only service providers that need it to run PayWicket: our hosting provider (Render), our DNS and security provider (Cloudflare), our email provider (Resend), our IP‑to‑location and network lookup provider (IPinfo, which receives IP addresses only) and the public WHOIS services of the regional internet registries (ARIN, RIPE and their peers, which also receive the IP address only), the licensed card provider (Crossmint) for USDC purchases in the PayWicket Wallet, and the assistant platform (Yupiter) for Wick. We share data with authorities only when the law requires it. We do not sell personal data.

8. Your rights

You can ask us what we hold about you, ask us to correct or delete it, or object to processing, by emailing support@paywicket.com. Merchants can update account details and delete their payout wallet from the dashboard. We respond within 30 days. Where data is kept to meet a legal duty (for example payment records), we will tell you.

9. Security

All traffic is encrypted in transit. Staff access requires two‑factor authentication and is logged. Secrets such as webhook keys are stored hashed or encrypted. If a breach ever affects you, we will notify you without undue delay.

10. Changes

We will update this notice when our practices change and keep the effective date above current.