سياسة الخصوصية

This policy explains what personal data ScarabPay Business collects when you use this website, the merchant portal, or the merchant API, and what we do with it. It is written from the system's actual data model rather than from a template, so where it names a retention period, that period is what the software enforces.

Who we are

Company registration is in progress. The registered controller name, number, jurisdiction and address will be published in this section and on the About page once registration completes. We have chosen not to print a placeholder entity here.

Data we collect from this website

The public website loads no third-party scripts, no analytics, no advertising pixels and no embedded media. Nothing on these pages reports your visit to anyone. The only personal data this site collects is what you type into the contact form.

When you submit that form we store:

• your name, and your company name if you give one;
• the work email address you provide;
• the country code you optionally select;
• the message you write;
• the language the form was submitted in, so a person can reply in it;
• a truncated browser user-agent string;
• a salted, one-way hash of your IP address. We do not store the address itself. The hash lets us recognise repeated abuse from one source and cannot be reversed into an address.

We use this only to reply to you and to defend the form against automated abuse. Contact submissions are not used for marketing, are not profiled, and are not sold or shared with anyone for their own purposes.

We do not send an automated acknowledgement. An unauthenticated form that emails an address supplied by whoever filled it in can be used to send mail to people who never asked for it, so we do not do it. A person replies instead.

How long we keep it

• Submissions identified as automated abuse are deleted after 30 days.
• All other submissions are deleted after 24 months.

Both are enforced by a scheduled deletion job, not by a manual process.

Data we process for merchants

If your company uses the platform to issue cards, we process data on your instructions as a processor, and the merchant is the controller of its own customers' data. That processing covers:

• Merchant account data — the names, email addresses and roles of people you authorise to use the portal, plus multi-factor authentication secrets and recovery codes.
• Business verification documents — material you upload to verify your business. These are held on private storage, never in a publicly reachable location.
• Cardholder identity — the identity details required to issue a card to one of your customers, including name, date of birth, an identity document reference and an address. These are encrypted at rest and are transmitted to a licensed issuing partner only as part of an issue request.
• Transaction and ledger records — movements of money, retained for as long as the account exists. The ledger is insert-only: entries are never edited or deleted, because the integrity of a financial record depends on it. Corrections are posted as new entries.

We never store full card numbers or security codes, and the API never returns them. A card resource exposes a masked number and its last four digits only.

Operational logs and audit records

• API request metadata — retained for 90 days, then pruned.
• Audit records of who performed which action — retained for 365 days, then pruned. Financial ledger entries are not audit logs and are not pruned.
• Payout proof files attached to completed withdrawals are deleted on a daily schedule while the withdrawal record itself is retained.
• Application logs pass through a scrubber that removes card data, secrets and credentials before anything is written, so those values cannot reach a log file at all.

Cookies

This site sets a session cookie and a language-preference cookie. It sets no analytics or advertising cookies, and there is no consent banner because there is nothing to consent to. The Cookie Policy lists each one.

Who else sees the data

We use a small number of processors to run the service — hosting, email delivery, card issuing, and crypto payment processing. They are listed by category on the Sub-processors page.

We do not sell personal data. We disclose it to a public authority only where we are legally required to, and we retain it where a legal obligation requires retention beyond the periods above.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict our processing, and to receive it in a portable form. You may also complain to your local data protection authority.

Two limits apply and we would rather state them here than in a refusal later. First, financial ledger entries cannot be deleted on request: they are the record of money movement and we are required to keep them. Second, if you are a cardholder of one of our merchants, that merchant is the controller of your data and we will refer your request to them.

To exercise any of these, use the contact form with the topic set to support.

Security

Access to merchant data is scoped per merchant and fails closed. Cardholder identity records are encrypted at rest. Full card numbers and security codes are never exposed through the API and are never persisted. Administrative actions are appended to an insert-only audit trail.

No system is perfectly secure and we do not claim otherwise. If you believe you have found a vulnerability, the disclosure process is described on the Developers page.

Changes

When this policy changes we publish a new version with a new effective date. The version and date at the foot of this page identify the text currently in force.