This policy explains what Caravel Pay processes, why, how long we keep it, and who else sees it. It covers this website, the API, our plugins and integrations, payment links and the hosted pay page. If you're buying from a merchant that uses Caravel Pay, that merchant has its own privacy policy for your order. This one covers what Caravel Pay itself handles.
In short#
- We never see your card details. The card provider you choose handles them.
- No tracking cookies, no analytics and no ads, on this website or on the pay page.
- When a buyer arrives at a pay page from another website, we keep only that website's domain, never the full address.
- Payments on a blockchain are public and permanent. Nobody can delete them, including us.
- We don't sell personal data.
Who is responsible#
Caravel Pay is responsible for the processing described here. You can reach us at hello@caravelpay.app.
Merchants#
When you get API keys, save a wallet in a plugin, or create a payment link, we process:
- Your site URL and its domain. We use them to decide which return, cancel and callback URLs we accept for you, and we check them against our denylist. We don't show them to buyers.
- Your payout wallet address, to send your payouts. We check it against a sanctions list and our denylist, and we check on the blockchain that it's an ordinary wallet.
- Your email address, if you give one. We use it only for service notices about your merchant, such as a pause, and we check it against our denylist.
- Your platform and plugin version, for support and compatibility.
- Your merchant id and secret. We keep the secret only to check your signed requests and to sign your webhooks. We show it once and never write it to our logs.
- A record of changes to your merchant, such as a pause, an approval or a change of limits, so we can tell what happened and when.
- What you send through the API: your checkouts (order id, amount, currency, URLs and, if you send one, the buyer's email), your payment links (amount, the note you write for buyers, and which checkouts were opened through each link), and the webhooks we send you.
- Webhook delivery attempts: for each attempt, the time, the HTTP status your server returned, a short error code and how long it took. These help you and us work out why a webhook was missed.
- IP addresses of API requests, to limit how often someone can call us, and in short-lived server logs (see How long we keep data).
Buyers on the pay page#
When you pay through a Caravel Pay checkout, we process:
- The checkout: the amount and currency, the merchant's order id, the status and the times it changed.
- Your email address, only if the merchant gave it to us. The pay page doesn't ask for it. If we have it, we may pass it to the card provider you choose, to fill in their form for you.
- On-chain data: the checkout's deposit address, the address you paid from, transaction ids and amounts, and the payout to the merchant. These are public on the blockchain by nature.
- The website you came from, as a domain only. When you open a pay page from a link on another website, your browser may tell us which page you came from. We keep only its domain (for example
example.com), never the full address, path or query, and never with your IP address. We store a daily count per merchant, and if the domain is on our denylist we also note which checkout it was for. We use this to find merchants who sell through sites that break our acceptable use policy. - Your approximate country and the payment method you choose. We use your country to show payment methods that work where you are. For each checkout we record which card provider was tried, your country code and whether the payment went through, so we can rank the providers that work best. Each record is deleted after 30 days.
- Your IP address, to limit how often someone can call us, and in short-lived server logs. Some card providers require the buyer's IP address to start a purchase: when you choose one of them, we pass your IP address, or a value derived from it, to that provider.
Card details and identity checks#
You enter your card details, or use Apple Pay or Google Pay, on the card provider's own page or widget. Caravel Pay never sees your card number, security code or bank details. The provider may ask you to verify your identity before it sells you USDC. Everything you give the provider is handled under the provider's own privacy policy, which it shows you before you pay.
Abuse reports#
When you report a seller, we process what you send: the web address you report, the category, the details you write, a checkout or link id if you include one, and your email address if you choose to give it, so we can follow up. We don't store your IP address with the report. The alert we receive about a new report doesn't include your email.
Cookies and browser storage#
We don't use cookies for tracking or advertising, and we don't run analytics. Here is everything we store in your browser:
- This website (caravelpay.app) sets no cookies. If you pick a programming language for the code samples in the docs, your browser's local storage remembers the choice. It stays on your device and is never sent to us.
- The pay page sets no cookies. If you pick a language, local storage remembers it. Session storage, which your browser clears when you close the tab, remembers which payment method you chose for that checkout, so you can come back to it.
- Payment-link pages set one cookie,
caravel_link_session. It lets you reload a payment link and get your open checkout back, instead of a new one. Your browser deletes it when you close the browser, and we store only a scrambled (hashed) copy of its value.
Card providers' pages set their own cookies, under their own policies.
Who else sees data#
- The card provider you choose gets what it needs to sell you USDC: the amount, the deposit address to deliver to, the page to send you back to and, depending on the provider, your email address, IP address and country.
- Blockchain networks. Payments and payouts on Polygon are public. The node services we use to read the blockchain and send transactions see the addresses and transactions involved.
- Cloudflare hosts this website and runs our DNS, and may carry traffic to our API and pay page. Like any web host, it processes visitors' IP addresses to deliver pages and protect against attacks.
- The merchant you buy from sees your checkout's status, the amounts, and the payout transaction.
- Our operations alerts go to a private Discord channel. They can contain merchant ids, site domains, reported web addresses and system status. They never contain buyers' or reporters' email addresses.
- Authorities, when the law requires us to share data.
How long we keep data#
| Data | How long |
|---|---|
| Webhook delivery attempts | 90 days, then deleted automatically |
| Provider results per checkout (provider, country, outcome) | 30 days, then deleted automatically |
| Rate-limit counters (keyed by IP address) | In memory only, never written to disk. Each counter covers at most one hour, and all of them are gone when the service restarts. |
| Server logs with IP addresses | A short time, then deleted automatically |
| Merchant records, checkouts, payouts and payment links | Kept as payment and accounting records. We don't delete them automatically today. |
| Daily counts of referring domains | We don't delete them automatically today. |
| Abuse reports | As long as we need them to act on the report and spot repeat abuse. We don't delete them automatically today. |
| On-chain data | Permanent. Nobody can delete it. |
We keep encrypted backups. Data deleted from our live systems can stay in a backup until that backup is deleted.
Your rights#
You can ask us for a copy of the personal data we hold about you, and ask us to correct it or delete it. Depending on where you live, you may also have the right to object to or restrict how we use it, or to receive it in a portable format. Email hello@caravelpay.app. We may ask you to prove the data is yours. For a merchant, that can mean proving you hold the merchant's credentials.
We delete what we can. We may have to keep some records, for example payment records needed for accounting or tax, or a denylist entry that stops a blocked seller from connecting again. Data on a blockchain can't be deleted by anyone.
You can also complain to the data protection authority where you live.
Changes to this policy#
We'll post every change on this page with a new "Last updated" date.
Contact#
Questions about your data? Email hello@caravelpay.app.