Skip to content
Skip to Content
YOUR PRIVACY MATTERS

Privacy Policy

We believe in transparency about how we collect, use, and protect your personal information.

Last Updated:

Privacy at a Glance

Our Commitments

  • We're transparent about what data we collect and why
  • You have control over your personal information
  • We use industry-standard security measures
  • We comply with GDPR, CCPA, and applicable privacy laws

Your Rights

  • Request access to your personal data
  • Correct inaccurate information
  • Request deletion of your data
  • Export your data in a portable format

Important: This is a summary. Please read the full policy below for complete details.

Privacy Policy

1. Information We Collect

We collect information you provide directly (account details, business information), information automatically collected (usage data, device information), and information from third parties (payment processors, identity verification services).

Types of information we collect:

  • Account and business information (name, email, company details)
  • Payment and transaction data (invoice details, payment methods)
  • Usage data (how you interact with our platform)
  • Device information (IP address, browser type, operating system)
  • Fraud prevention data (payment risk scores, authentication results, IP addresses associated with payment attempts, velocity patterns)
  • Communications (support messages, feedback)

2. How We Use Your Information

We use your information to provide and improve our services, process payments, communicate with you, ensure security, prevent fraud, and comply with legal obligations. We do not sell your personal information to third parties.

Primary uses:

  • Process payments and provide invoicing services
  • Maintain, improve, and secure our platform
  • Provide customer support and respond to inquiries
  • Send important service updates and communications
  • Prevent fraud, abuse, and ensure platform security through risk scoring, velocity monitoring, IP tracking, and 3D Secure authentication

3. Information Sharing

We share your information only as necessary to provide services or comply with legal obligations. We do not sell personal information.

We may share information with:

  • Payment processors (Stripe) and financial institutions to process transactions
  • Service providers who assist our operations (email, SMS, hosting)
  • Law enforcement when required by applicable law or legal process
  • Professional advisors (lawyers, accountants) for business purposes

4. Service Providers and AI

We use the following service providers to run Paganki. Each receives only the data it needs for its task and processes it on our behalf or as an independent payment provider.

Providers we use:

  • Stripe — card and bank payments, payouts, and fraud screening (Stripe Radar)
  • PayPal — payments, when a business enables PayPal as a payment option
  • Clerk — sign-in and account authentication for business users
  • Resend or SendGrid — sending email, such as invoices, reminders, receipts and sign-in codes
  • Twilio — sending SMS and WhatsApp messages, when a business uses those channels
  • Sentry — error monitoring to find and fix problems (see Error Monitoring below)
  • Google — Analytics and Ads, only after you give cookie consent (see Cookies and Tracking)
  • OpenAI and Anthropic — AI drafting. When you use an AI feature, the text you enter (for example a job description or quote details) and related business details are sent to the AI provider to draft estimates, emails and warranty terms.
  • IPQualityScore — IP reputation checks on payment attempts to detect fraud, when enabled. It receives the payer's IP address
  • Amazon Web Services — hosting and file storage

Important: AI features only run when you use them. Review every AI draft before sending it, and avoid entering information you do not want processed by an AI provider.

5. Error Monitoring

We use Sentry, as a processor, to find and fix errors. Before you accept analytics cookies — and always on payment and customer-portal pages — your browser sends Sentry error reports only, never performance traces or session replay. Our servers also send Sentry error reports and performance timings for a sample (10%) of the requests they handle, including requests for those pages. Neither includes your IP address, cookies, user identity or request bodies.

An error report contains:

  • The error and its stack trace
  • Your browser, operating system and device (from the user agent)
  • The page URL and referrer, with payment-link tokens and secret-looking query values redacted
  • The app version
  • Breadcrumbs: console messages, selectors of elements you clicked, page navigations, and request URLs with their status codes

Important: Only if you accept analytics cookies, Sentry also receives performance traces for 10% of page loads (timings and web vitals) and Session Replay. Replay masks all text and inputs and blocks media; it records 10% of sessions, and for the rest keeps a short buffer that is sent only when an error occurs. Replay never runs on payment or customer-portal pages, and it stops when you withdraw consent.

6. Fraud Prevention Data

To protect all parties on our platform, we collect, process, and retain specific data for fraud prevention purposes. This data is processed under our legitimate interest in preventing fraud and maintaining platform security.

Fraud-related data we collect and process:

  • IP addresses associated with payment attempts, including first access IP and subsequent changes
  • Payment risk scores and fraud assessments from Stripe Radar (risk level, risk score, network status, outcome type)
  • Payment velocity data including failed attempt counts per IP address and per payment link
  • 3D Secure authentication results and challenge completion status
  • Account suspension records including reason, date, and administrator who initiated the action
  • High-value transaction flags and associated contextual data

Important: Records of failed or cancelled payment attempts, including the IP address used, are deleted after 30 days, and customer-portal sessions 24 hours after they expire. Risk assessments and the details of completed payments are kept with the transaction record, and account suspension records with the account (see Data Storage and Retention). Deletion requests under GDPR/CCPA may be limited where retention is necessary for fraud prevention or legal obligations.

7. Data Storage and Retention

We store your information for as long as necessary to provide services, comply with legal obligations, and resolve disputes. When you request deletion, we remove or anonymize your personal information, subject to legal retention requirements.

Retention periods:

  • Account data: for as long as your account exists. Nothing is deleted automatically; email [email protected] to have your account and personal data deleted or anonymized
  • Transaction records: 7 years for regulatory compliance
  • Support communications: 3 years
  • Security and activity logs: for as long as your account exists, for fraud prevention

8. Your Privacy Rights

You have rights regarding your personal information under applicable privacy laws (GDPR, CCPA, etc.). To exercise these rights, contact us at [email protected].

Your rights include:

  • Access: Request a copy of your personal information
  • Correction: Update or correct inaccurate information
  • Deletion: Request removal of your personal information
  • Portability: Export your data in a machine-readable format
  • Objection: Object to certain types of data processing

Important: Some rights may be limited by legal requirements or legitimate business needs such as fraud prevention. We will respond to requests within legally required timeframes.

9. Data Security

We implement industry-standard technical and organizational measures to protect your personal information including encryption, access controls, regular security assessments, and employee training. However, no system is 100% secure.

Security measures include:

  • Encryption for data in transit (TLS/SSL) and at rest
  • Multi-factor authentication and role-based access controls with 7-tier permission system
  • 3D Secure (3DS/SCA) authentication for card payments to verify cardholder identity
  • Stripe Radar machine learning for real-time fraud detection and risk scoring
  • Rate limiting and velocity controls to prevent card testing and brute-force attacks
  • OTP verification codes hashed with SHA-256 before storage
  • Incident response procedures and breach notification protocols

10. Cookies and Tracking

We use cookies and similar technologies to run the platform, understand how it is used, and measure our advertising. Except for strictly necessary cookies, we only set cookies after you opt in. When you first visit, analytics and marketing cookies are disabled by default until you accept them in our cookie banner.

We use Google Analytics and Google Ads, loaded through Google Consent Mode. Until you grant consent, these services do not store analytics or advertising cookies and receive only limited, cookieless signals. You can accept all cookies, reject non-essential cookies, or choose specific categories. If you accept marketing cookies and then sign up or subscribe, the Google tag also sends Google a one-way hashed (SHA-256) version of your account email, so Google Ads can match the sign-up to the ad you clicked ("enhanced conversions"). Your plain email address is not sent.

Categories of cookies we use:

  • Strictly necessary cookies — required for core features such as sign-in and payments; these cannot be disabled.
  • Analytics cookies — help us understand how the site is used so we can improve it (off until you opt in).
  • Marketing cookies — used to measure ad campaigns and show relevant ads (off until you opt in).

Important: To review, change, or withdraw your consent at any time, select "Cookie preferences" in the website footer.

11. International Data Transfers

Your information may be processed in the United States and other countries where our service providers operate. We use Standard Contractual Clauses and other safeguards to protect your information when transferred internationally.

Transfer safeguards:

  • Standard Contractual Clauses (SCCs) for international transfers
  • Adequacy decisions where available
  • Security measures consistent with this policy

12. Policy Updates

We may update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or platform notification. The 'Last Updated' date indicates when the policy was most recently revised.

Update process:

  • Email notification for material changes
  • 30-day advance notice for changes requiring new consent
  • Continued use after updates constitutes acceptance

Questions About Privacy?

We're here to help with any privacy-related questions or concerns

Privacy Team

[email protected]

Data Protection Officer

[email protected]
General ContactTerms of Service