Privacy Policy

• Account: your name, email address and profile picture provided by Neon Auth. We never see your Google password.
• Store settings: store name, the bank payment links you connect, logo, brand colour, support email and redirect URLs.
• Payments: amount, currency, your reference ID and metadata, status and timestamps. We don’t receive payers’ bank credentials, card numbers, PINs or one-time passcodes.
• Secrets: API keys are stored only as a SHA-256 hash and shown to you once. Bank session tokens are encrypted at rest.
• Account activity: changes to store settings and integrations, plan operations, first observation of a verified session, and last dashboard access. These records help our administrators support your account. Activity records exclude credentials and raw payment or webhook payloads.
• Technical logs: IP address and request metadata, kept for security and rate limiting.

• Your bank, through the payment link you connected, to create KHQR codes and read their payment status.
• Google, for sign-in only.
• Telegram, only if you link a group to a store; it receives a receipt for each confirmed payment. Receipt delivery records are retained for 90 days; pending receipts are retained for retry.
• Your own webhook endpoints, which receive payment events.
• Hosting and infrastructure providers that run the service on our behalf.
• Authorities, when Cambodian law requires it.

We don’t sell personal data or use it for advertising.

We keep payment records while your account is open and for as long as the law requires afterwards. Webhook delivery logs are kept for 90 days. Operational activity and session observation records are also retained for 90 days, with periodic cleanup. Last dashboard access is retained as a single timestamp. Administrative plan-change audits and payment records follow their existing retention. You can ask us to delete your account at any time.

You can access, correct, export or delete your data by contacting us from the email address on your account.