Your data, kept to the minimum

1. Who this policy covers

This policy explains what personal data Klap (also called Klappay, “we” or “us”) collects across its products, why, who else handles it, and your choices. It covers every product listed above and the website at klappay.com. Kompra has its own privacy policy.

“Klap” means the people who build and operate the Services, together with any company they set up, or transfer the Services to, to operate them. That company keeps the commitments in this policy.

Our data protection contact, who handles requests from data subjects and authorities, is reached at hi@klappay.com.

2. When Klap decides, and when a merchant does

For account holders, such as developers, merchants and page or campaign owners, Klap is the controller of their account data: we decide how it is used and are responsible for it.

When you pay a merchant, creator or campaign through Klap, the details they ask for, such as your email, name, shipping address or message, are collected for them. They are the controller of those details, and Klap processes them on their behalf, only to run the payment and the product they use. Questions about how a merchant uses your data should go to the merchant first. You can still contact us, and we will help where we can.

3. Data we collect

We collect only what each product needs to work.

• Account: your name and email address from Google or GitHub, or the email and password you sign up with. Passwords are stored only as a salted hash.
• Organization and payouts: your organization name, the payout wallet addresses and split partners you configure, a short hint of each API key (never the full key) and webhook settings.
• Payer details: what a merchant asks for at payment, such as email, name, shipping address, a display name or a message on a Give or Fund page.
• Klap One: your email address, the public part of any passkey you register, the wallet addresses you link, and a record of the payments you approve. A device fingerprint is kept only as a one-way hash, to spot suspicious sign-ins.
• Klap Trust: for each payer wallet address, the amounts, times and outcomes of its payments through Klap, and the trust score calculated from them, as described in section 11.
• Payments: amounts, tokens, networks, the paying wallet address and transaction hashes. These are public and permanent on the blockchain.
• Content you publish: product descriptions, page stories, campaign updates and images. Public pages are visible to anyone with the link.
• Messages you send us: what you write when you contact support or report a problem.
• Cookies: session cookies that keep you signed in, a short-lived cookie on Link payment pages so you return to the same charge, and analytics in the Klap App. We do not use advertising cookies.
• Technical logs: IP address, browser, device, date and time and request details, kept for security, rate limiting and troubleshooting.

4. What we never collect

Klap never receives the private key or recovery phrase of any wallet. When a product creates a wallet for you, it is generated in your browser and only its public address is sent to us. We do not collect card or bank account numbers, and we do not ask for sensitive data such as health, religion or biometrics. Never send us a recovery phrase or private key: anyone asking for one in Klap’s name is not Klap.

5. Why we use it, and on what legal basis

Under Brazil’s General Data Protection Law (LGPD) and similar laws, we use your data only when we have a legal basis for it:

• to perform our contract with you: sign you in, create charges, route payouts and splits, settle escrow, confirm payments, show merchants and owners their payments and supporters, and send service emails such as sign-in codes, receipts, sale notices, invoices and cancellations;
• to meet legal obligations: keep the records the law requires, answer lawful requests from authorities, and comply with sanctions and anti-money-laundering rules;
• for our legitimate interests, balanced against your rights: keep the Services secure, prevent fraud and abuse, understand how the Klap App is used to improve it, score payer wallets with Klap Trust, and defend legal claims;
• with your consent, where we ask for it. You can withdraw it at any time, without affecting what was done before.

6. What other people see

A merchant or owner sees the details you gave when paying them. A Give or Fund page can show your name, message and amount publicly unless you choose to stay anonymous on the page. Anyone can see a payment on the blockchain, whatever you choose on the page.

7. Who else handles your data

We use the providers below. Each receives only the data it needs for its role and may use it only to provide its service. We do not sell personal data and do not share it for advertising.

We may also share data when the law, a court order or an authority requires it, to protect the rights, safety or property of Klap, our users or the public, or with a buyer or successor if Klap is reorganised, merged or sold, under this same policy.

Google · Sign-in

Your Google account name and email address, when you choose to sign in with Google.

GitHub · Sign-in to the Klap App

Your GitHub name and email address, when you choose to sign in with GitHub.

Resend · Transactional email

Your email address and the content of service emails, such as sign-in codes, receipts and invoices.

OpenPanel · Product analytics in the Klap App

Pages visited and actions taken in the Klap App, linked to your account. No payer data is sent.

WalletConnect (Reown) · Wallet connection at checkout

The wallet address and network used when you connect a wallet through WalletConnect.

0x · Token swap quotes

The tokens, amounts and wallet addresses involved when a payment needs a swap.

Blockchain node providers · Reading and sending transactions

Wallet addresses, amounts and transaction data that are already public on the blockchain.

Cloud infrastructure providers · Servers, databases and backups

The data the Services store, held on our behalf under confidentiality and security obligations.

8. International transfers

Several of our providers are based in, or store data in, other countries, including the United States. When your data leaves your country, we transfer it only as allowed by the LGPD and similar laws: because it is needed to perform our contract with you or to take steps you asked for, and under contractual commitments from those providers to protect it at a level comparable to this policy.

9. How long we keep it

We keep data only as long as we need it:

• payer details from checkouts that were never paid are removed automatically;
• account and organization data is kept while the account is active, and deleted or anonymised after it is closed, except what we must keep by law;
• payment, invoice and tax records are kept for up to 5 years after the payment, to meet tax and legal obligations and defend claims;
• access logs are kept for at least 6 months, as Brazil’s Internet Civil Framework (Marco Civil da Internet) requires, and for no longer than we need them for security;
• support messages are kept for as long as needed to resolve the request and any follow-up.

10. Data on the blockchain

Payments through the Services are recorded on public blockchains that Klap does not run. That data, such as wallet addresses, amounts and times, is public, permanent and cannot be changed or deleted by us or anyone else. Requests to delete or correct data cannot apply to it.

11. Wallet trust scores

Klap Trust calculates a trust score for payer wallet addresses from their payment history across Klap: amounts, times and whether each payment was confirmed, overpaid, refunded or reclaimed. Merchants and charges are stored only as one-way codes that cannot be traced back to them, and Klap Trust never reads the blockchain or any data beyond what Core already confirmed.

We use the score, based on our legitimate interest in confirming payments safely and quickly, only to shorten how long Core waits for blockchain confirmations. A low score, or no score, never blocks or reverses a payment. The score is never published or shared with merchants. Only Klap’s own systems, Klap One for wallets you linked, and the owner of a wallet who proves it by signing a message on the Klap Trust page can see it.

If you think a score about your wallet is wrong, you can ask us at hi@klappay.com to explain the criteria behind it and to review it.

12. Your rights

Under the LGPD, the EU and UK GDPR, and similar laws, you can ask us to confirm whether we process your data, give you access to it, correct it, anonymise, block or delete data that is unnecessary or that we no longer need to keep, give you a copy in a portable format, tell you who we shared it with, and review decisions made only by automated means. You can also object to processing based on legitimate interests and withdraw consent.

To make a request, email hi@klappay.com from the address on your account. We may ask you to confirm your identity first. We answer within 15 days, and we tell you if a law requires us to keep some data or if a request concerns data a merchant controls.

You can also complain to your data protection authority, which in Brazil is the National Data Protection Authority (ANPD).

13. Security

We use encrypted connections, encrypt secrets at rest, store passwords only as salted hashes, never store full API keys, sign webhooks, and restrict access to production systems. No system is perfectly secure, so we cannot promise absolute security. If an incident is likely to put you at real risk, we will tell you and the authorities as the law requires.

14. Children

The Services are only for people aged 18 or older. We do not knowingly collect data from anyone younger. If you think a child has given us data, email hi@klappay.com and we will delete it.

15. Changes to this policy

When we change this policy, we update the date at the top and, for material changes, tell account holders in the product or by email before the change takes effect.