Privacy Policy

Settlematic ("we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect when you use our website, applications, and APIs (the "Service"), how we use it, and the choices you have.

This policy applies to merchants and team members who create Settlematic accounts. It also describes limited data we process when end clients view hosted payment pages. By using the Service, you agree to the practices described here.

We collect information in the following categories:

• Account information: name, email address, password hash, organization name, and role
• Business data: invoices, clients, line items, payment terms, branding assets, sweep destinations, and API keys (stored hashed or encrypted where applicable)
• Payment and transaction data: invoice amounts, quoted crypto rates, blockchain addresses, transaction hashes, confirmation status, and timestamps
• Usage data: pages visited, features used, device type, browser, IP address, and approximate location derived from IP
• Communications: support requests, feedback, and email preferences
• Cookies and similar technologies: session identifiers, authentication tokens, and analytics cookies (see Section 8)

We use collected information to:

• Provide, operate, and maintain the Service
• Authenticate users and enforce account security
• Detect and record on-chain payments associated with your invoices
• Send transactional emails (invoice delivery, payment confirmations, security alerts)
• Improve product performance, fix bugs, and develop new features
• Comply with legal obligations and respond to lawful requests
• Prevent fraud, abuse, and security incidents
• Send marketing communications where permitted and with opt-out options

We do not sell your personal information. We may share information in these circumstances:

• Service providers: hosting (e.g., cloud infrastructure), email delivery, analytics, and customer support tools bound by confidentiality obligations
• Blockchain networks: transaction data is inherently public on distributed ledgers when payments are made
• Your clients: invoice and payment page content you choose to expose to payers
• Integrations you enable: webhooks, API consumers, and third-party tools you configure
• Legal requirements: when required by law, court order, or to protect rights, safety, and security
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required

We retain account and business data for as long as your account is active or as needed to provide the Service. Invoice and payment records may be retained longer where required for accounting, tax, dispute resolution, or legal compliance.

Upon account deletion, we will delete or anonymize personal data within a reasonable period, except where retention is required by law or legitimate business interests (e.g., fraud prevention logs).

We implement technical and organizational measures designed to protect your information, including encryption in transit (TLS), hashed passwords, scoped API credentials, rate limiting, and access controls on production systems.

No method of transmission or storage is completely secure. You are responsible for safeguarding your password, API keys, and sweep destination configurations. Enable team permissions thoughtfully and revoke access for departed members promptly.

Settlematic may process data in the United States and other countries where we or our service providers operate. By using the Service, you consent to transfer of information to jurisdictions that may have different data protection laws than your country.

Where required, we use appropriate safeguards such as standard contractual clauses for cross-border transfers.

We use essential cookies for authentication and session management. With your consent where required, we may use analytics cookies to understand how the Service is used.

You can control cookies through browser settings. Disabling essential cookies may prevent you from logging in or using core features.

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. California residents may have additional rights under the CCPA/CPRA. EEA and UK residents may have rights under GDPR.

To exercise rights, email support@settlematic.com with "Privacy Request" in the subject. We may verify your identity before fulfilling requests. You may opt out of marketing emails via unsubscribe links.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. Contact us if you believe we have collected data from a child so we can delete it.

Our Service may link to third-party websites or integrate with external tools (block explorers, wallets, AI assistants). Their privacy practices are governed by their own policies. We encourage you to review them before sharing data.

We may update this Privacy Policy periodically. Material changes will be posted on this page with an updated "Last updated" date and, where appropriate, notified by email or in-app message.

Privacy questions or requests: support@settlematic.com (subject: "Privacy Policy").