Privacy Policy
1. Summary
SGRON collects as little personal data as a payment needs. We never receive card details. We do not keep the buyer's email address: it is used for sign in at our wallet provider and we store only a one way hash of it. We do not sell personal data and do not use it for advertising.
2. Controller
SGRON (Smart Geo Router) is the controller for the data described below. Contact: hello@sgron.com. For data about a purchase that the merchant holds in its own systems, the merchant is the controller.
3. Buyers: what we process
- Email for sign in. Entered on the payment page and handled by Privy, which sends the code and links the buyer's wallet to the email. SGRON receives a signed token from Privy, reads the wallet address from it and stores only a hash of the email.
- Wallet address and transactions. The buyer's wallet address, the signed transfer authorisation, transaction hashes and amounts. These are needed to complete and prove the payment and are public on the blockchain by nature.
- Payment details. Invoice, amount, currency, exchange rate, status and timestamps.
- Technical data. The country derived from the IP address by our network provider, the device type and the browser, used to choose a card provider that serves the buyer's country and to protect the service from abuse.
Card numbers, identity documents and the results of identity checks are collected by the card provider (Stripe or MoonPay) under its own privacy policy and are not shared with SGRON.
4. Merchants: what we process
- Account email, business name, password (stored only as a hash) and the two factor secret (stored encrypted).
- Wallet addresses, webhook address, API keys (stored only as hashes) and settings.
- Invoices, payments, fee accruals, fee statements and webhook delivery logs.
5. Why and on what basis
- To perform the payment the buyer asked for and the service the merchant signed up for (performance of a contract).
- To keep records of payments and fees, and to meet legal obligations that apply to us (legal obligation).
- To secure the service, prevent fraud and fix errors (legitimate interest).
6. Who receives data
- The merchant the buyer is paying: invoice status, amount received, transaction hash and the order reference.
- Privy (wallet and sign in), Stripe and MoonPay (card payments), and thirdweb where it is used, each for its part of the payment.
- Our hosting provider Infomaniak (Switzerland), our network provider Cloudflare, and Alchemy, which provides access to the blockchain.
- Authorities, where the law requires it.
Some of these providers process data outside the European Economic Area and Switzerland. Where they do, transfers rely on adequacy decisions or standard contractual clauses.
7. How long we keep it
Payment and fee records are kept for as long as accounting and legal retention rules require, and otherwise for no longer than needed for the purposes above. Data written to a public blockchain cannot be deleted by anyone, including SGRON.
8. Cookies
This website sets no cookies and uses no analytics or advertising trackers. The merchant console uses one strictly necessary session cookie to keep a merchant signed in. The payment page uses Privy's sign in storage to keep the buyer's session during the payment.
9. Your rights
You can ask for access to your data, its correction or deletion, a copy in a portable format, and you can object to or ask us to restrict processing, within the limits of the law. Write to hello@sgron.com. You also have the right to complain to your data protection authority, in Switzerland the FDPIC, in the European Union the authority of your country.
10. Changes
We will update this policy when our processing changes. The date at the top shows the current version.