Przejdź do treści
Prawo

Data Retention Policy

How long each kind of record is kept, and why.

Ostatnia aktualizacja 16 lipca 20262 min czytaniaSekcje: 8

1. Financial and transaction records

Invoices, on-chain settlement records, balances, transfers and payout requests are kept as long as accounting and legal compliance require. The default is five years from the transaction. Where the law that applies to the Operator requires a different period, the Operator sets that period instead.

2. Security and rate-limit metadata

Minimal request metadata such as IP address, timestamp and user-agent is short-lived. The default is 90 days, after which it is purged. It exists for security, rate-limiting and fraud prevention, and nothing else.

3. Short-lived operational data

3.1 TOTP replay codes

Purged after about two minutes. They exist only to stop a two-factor code being used twice.

3.2 Abandoned unpaid payment-link records

When someone opens a payment link, tip page or donation page and never pays, the record of that attempt is pruned after about 30 days. Completed payments are kept as financial records (section 2).

4. Account data

Your account email, password hash, API key and encrypted API secret live for as long as the account does. On request, account data is deleted, except where a record must be retained under section 1 or by law. Deleting an account does not delete the financial records of transactions that already happened.

5. What is never retained

Private keys and seed phrases are never on the server, so there is nothing to retain or delete. Card numbers are never stored.

6. Data on the blockchain

Settlement happens on public blockchains. Those records are outside the Operator's control and cannot be edited or erased by anyone, including us. Deletion applies to the instance's own database, not to the chain.

7. Requesting deletion

Contact the Operator at support@payora.money. Merchants who are controllers for their customers' data should see the Data Processing Agreement.

8. Longer periods

These are the periods this instance applies. The Operator sets a longer one where the law that applies to it requires that; ask if you need the exact figure for your case.

Last updated: 16 July 2026. If we make material changes to this page, the updated version will be posted here.

FAQ

Najczęściej zadawane pytania

Proste odpowiedzi, w tym te niewygodne: przechowywanie, opłaty i co się dzieje, gdy coś pójdzie nie tak.

Centrum pomocy

How long are transaction records kept?

Five years from the transaction by default, because accounting and legal compliance require it. Where the law that applies to the Operator sets a different period, the Operator uses that period instead.

How long is my IP address kept?

Minimal request metadata such as IP, timestamp and user-agent is kept for 90 days by default and then purged. It is used for security, rate-limiting and fraud prevention only.

Can I have my account deleted?

Yes. Account data is deleted on request, except where a record must be retained for accounting or legal compliance. Deleting an account does not erase the financial records of transactions that already happened.

Can blockchain records be deleted?

No. Settlement happens on public blockchains, and those records are outside the Operator's control and cannot be edited or erased by anyone. Deletion applies to the instance's own database only.

Na co odpowiada ta strona