Privacy Policy

General provisions

This policy explains what data Weelay may process and for what purposes it is used.

Weelay provides non-custodial technical infrastructure for creating invoices, displaying a checkout page, checking USDT TRC20 payments, using the API and sending webhook notifications to the merchant.

Weelay does not hold buyer funds, does not control merchant wallets and does not store private keys.

What data Weelay may process

Weelay may process data required for service operation, security, user support, payment checking and technical functions.

Such data may include:

• account data;
• email;
• project data;
• merchant wallet address;
• invoice data;
• order id, if provided by the merchant;
• tx_hash;
• invoice statuses;
• webhook URL;
• API keys in protected form;
• technical logs;
• IP address, user agent and session data;
• support requests;
• merchant complaint data.

Account data

When registering and using Weelay, merchant account data may be processed.

This may include email, hashed password, account status, registration date, email verification date, security settings and technical session data.

Weelay does not store the password in plain text.

Project data

The merchant may create projects to accept payments.

A project may store project name, status, settings, wallet address, limits, creation date and other technical parameters required for service operation.

Wallet address and blockchain data

To check payments, Weelay processes the merchant wallet address, tx_hash and other data related to USDT TRC20 transactions.

Blockchain data may be public on the TRON network. This means that tx_hash, addresses and certain transaction information may be available through public blockchain explorers and external services.

Weelay cannot make a public blockchain transaction private.

Invoice data

Weelay may store invoice data:

• invoice id;
• project;
• amount;
• currency;
• status;
• payment URL;
• order id;
• invoice expiration time;
• creation time;
• check time;
• tx_hash, if payment is found;
• technical check data.

This data is needed to display the invoice, check payment, operate the API, send webhook notifications, provide support and review disputes.

API keys

The full secret API key is shown to the merchant only once at creation.

Weelay should not store the secret API key in plain text. To verify the key, a protected hash value, prefix, last characters or other technical data required for key management may be used.

The merchant is responsible for securely storing the secret API key on the merchant side.

Webhook data

If the merchant uses webhook, Weelay may store webhook URL, delivery status, delivery attempt time, endpoint response result, response code and technical delivery errors.

This data is needed for notification delivery, retries and troubleshooting.

Technical logs

Weelay may process technical logs for security, diagnostics, abuse prevention, error fixing and user support.

Logs may include:

• request time;
• IP address;
• user agent;
• endpoint;
• trace_id;
• response code;
• technical error;
• identifiers of related objects.

Weelay should not intentionally log passwords, full secret API keys, private keys, seed phrases or other sensitive secrets.

Cookies and sessions

Weelay may use cookies and similar technologies for session handling, authentication, security, language selection and proper interface operation.

More details are provided in the Cookie Policy.

Support and complaints

If a user contacts support or submits a complaint about a merchant, Weelay may process request data:

• email;
• problem description;
• invoice id;
• order id;
• tx_hash;
• payment URL;
• screenshots or attachments, if provided;
• support reply history.

This data is used to handle the request, review technical data and protect the service.

Purposes of processing

Weelay uses data for the following purposes:

• account creation and management;
• project operation;
• invoice creation and checking;
• Merchant API operation;
• webhook notification delivery;
• account security;
• abuse prevention;
• technical error diagnostics;
• user support;
• complaint handling;
• enforcement of service rules;
• improvement of product stability and quality.

Sharing data with third parties

Weelay may use external technical providers required for service operation, such as hosting, email delivery, infrastructure protection, monitoring or blockchain API.

Weelay does not sell user data to advertisers.

Data may be disclosed if required to comply with law, protect Weelay rights, investigate abuse, process a complaint or protect users.

Data retention

Weelay stores data as long as necessary for service operation and technical, legal, security and accounting purposes.

Some data may be retained after account closure if needed for security, invoice history, complaint review, fraud prevention or legal requirements.

Security

Weelay applies technical and organizational measures to protect data.

However, no service can guarantee absolute security. The user is also responsible for the security of the account, email, password, devices, wallet and API keys.

User rights

The user may contact Weelay support regarding data, account, security or deletion of information.

Some data cannot be deleted immediately if it is required for technical history, security, abuse prevention, complaint handling or legal requirements.

Buyer data

The buyer may use the checkout page without registering a Weelay account.

In this case, Weelay may process technical data related to payment: payment URL, invoice id, wallet address, amount, status, tx_hash, IP address, user agent and other data required to display the page and check payment.

Changes to this policy

Weelay may update this policy.

The current version is published on the Weelay website. Continued use of the service after an update means acceptance of the updated policy.

Summary

Weelay processes data required for operating the non-custodial USDT TRC20 checkout, API, invoices, webhook, security, support and complaint handling.

Weelay does not hold buyer funds, does not control merchant wallets and does not sell user data to advertisers.