Privacy Policy — VelocityPay

1. What We Collect

When you create a VelocityPay account, we collect:

Data	How	Why
Email address	Registration form	Account login and billing notifications
Password (bcrypt hashed)	Registration form	Account authentication — we never store plaintext
Store / business name	Registration form	Display on your terminal and dashboard
Business address & EIN	KYC form (optional fields)	KYC record — may be required for compliance review
Government ID + selfie	Stripe Identity (redirected flow)	Identity verification — stored by Stripe, not by Velocity
NOWPayments API key	Dashboard input	Required to create crypto invoices on your behalf
Stripe customer / subscription IDs	Stripe API (automatic)	Billing management and subscription status tracking
Payment records	NOWPayments webhook events	Transaction history, settlement tracking, merchant reporting

2. How We Use Your Data

Your data is used exclusively to:

Create and maintain your merchant account
Process subscription billing via Stripe
Verify your identity (via Stripe Identity — we do not review documents)
Create and track cryptocurrency payment invoices via NOWPayments
Display real-time transaction metrics on your dashboard
Send transactional emails (KYC status, billing receipts, payment alerts)
Comply with legal obligations (sanctions screening, fraud prevention)

3. Third-Party Processors

We share data with the following third parties, which act as independent data controllers for their own use:

Processor	Data Shared	Purpose
Stripe	Email, billing info, KYC documents	Subscription billing and identity verification (Stripe Identity)
NOWPayments	Email, API key, payment amounts, crypto addresses	Invoice creation, payment processing, crypto-to-USD conversion
Neon (PostgreSQL)	All account and transaction data	Database hosting — our primary data store
Render	Application data in process memory	Web hosting and application serving

We do not sell, rent, or trade your data to any other third party.

4. KYC Documents (Stripe Identity)

Government ID images and selfies collected during identity verification are processed and stored by Stripe Identity, not by VelocityPay. Velocity receives only a pass/fail verification result and the merchant's verification status.

Stripe's handling of KYC data is governed by Stripe's own Privacy Policy. For Stripe's data retention and deletion practices, see stripe.com/identity.

5. Data Retention

We retain your data as follows:

Account data — retained while your account is active and for 3 years after closure
Payment records — retained for 5 years per financial record-keeping requirements
KYC verification status — stored indefinitely to support compliance reviews
Stripe Identity documents — governed by Stripe's policy, not Velocity

6. Cookies and Tracking

VelocityPay uses the following cookies and tracking:

Session cookies — required for authentication. HttpOnly, secure in production. 7-day expiry.
Polsia analytics beacon — an anonymous, pseudonymous visitor identifier is set for product analytics purposes. No personal data is transmitted.

We do not use third-party advertising trackers. We do not store tracking cookies from external ad networks.

7. Merchant Rights

You have the right to:

Access — request a copy of your personal data held by Velocity
Correction — update your email, store name, and business info at any time via the dashboard
Deletion — request deletion of your account. We will close the account and anonymize transaction records per financial retention requirements. KYC documents held by Stripe are subject to Stripe's deletion policy.
Objection — contact us at privacy@velocitypay.polsia.app with any concerns

8. Data Security

We implement industry-standard technical and organizational measures to protect your data:

Passwords hashed with bcrypt before storage
All traffic over HTTPS in production
Session cookies: HttpOnly, SameSite=Strict, Secure flags
Database access restricted to the application layer
API keys stored in environment variables, never committed to version control

9. International Data Transfers

If you access VelocityPay from outside the United States, your data may be transferred to and processed in the US. By using VelocityPay, you consent to such transfers in accordance with this Privacy Policy.

10. Children's Privacy

VelocityPay is not directed to individuals under 18. We do not knowingly collect data from minors. If we discover that a minor's data has been collected, it will be deleted immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes (e.g., new third-party integrations, changes in data retention) will be communicated via email and/or a platform notice. Continued use of the platform constitutes acceptance of the updated policy.

12. Contact

For privacy inquiries, data access requests, or deletion requests, contact:

Email: privacy@velocitypay.polsia.app

We will respond to all legitimate requests within 30 days.