Privacy Policy

Last updated: October 24, 2026

This Privacy Policy explains what personal data VOKZ.pay ("we", "us") processes when you use the Service, why, and what rights you have. It complements our Terms of Use. VOKZ.pay is the controller of this data and complies with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018). Contact: [email protected].

1. Data we collect

Merchants (account holders)

  • Account: name, store name and email address.
  • Credentials: your password, stored only as a one-way hash; the secret of your authenticator app, if you turn on two-factor authentication, stored encrypted; recovery codes and the codes we send by email, stored only as hashes.
  • Wallet: the public address of the wallet you link.
  • Charges and payments: amounts, descriptions, status and dates of your charges and, when paid, the payer's wallet address and the transaction signature.
  • Plan: your trial and plan dates and your plan payments.
  • Security log: sign-ins, failed sign-ins and changes to your password, wallet and two-factor settings, with the IP address and browser (user agent) used. You can see this log on the Security page.

Payers

Paying a charge does not require an account, and we do not ask for your name or email. When a charge is paid, we store the public address of the wallet that paid and the transaction signature with the charge, and show them to the merchant.

Everyone

Your IP address and request data are processed by our servers and by Cloudflare to deliver the Service, limit abuse (for example, the number of requests per minute) and block bots, and may appear in server logs that are kept for a limited time.

We also collect aggregate usage statistics with Cloudflare Web Analytics: pages visited, the site you came from, country, browser and device type, and how fast pages load. It does not use cookies or store anything in your browser, and it is not used to identify you.

2. How we use it

  • to provide the Service: accounts, charges, payment pages and payment detection;
  • to send emails about your account: email confirmation, password reset and security alerts. We do not send marketing emails;
  • to protect accounts and the Service against fraud and abuse;
  • to manage your plan and its payments;
  • to understand, in aggregate, how the Service is used and improve it;
  • to comply with legal obligations.

Under the LGPD, we rely on the performance of our contract with you, our legitimate interest in keeping the Service secure and improving it, and compliance with legal obligations.

3. The blockchain is public

Payments happen on the Solana network, which is public and permanent. Wallet addresses, amounts and times of transactions can be seen by anyone, and neither we nor anyone else can change or delete them.

4. Who we share it with

We do not sell personal data and we do not show ads. We share data only with:

  • Hostinger, which hosts our servers and database;
  • Cloudflare, which provides DNS, network security, website hosting, the Turnstile bot check and website analytics;
  • Resend, which delivers our emails;
  • a Solana RPC provider, which we query to read the blockchain (public wallet addresses and charge references);
  • Have I Been Pwned: when you choose a password, we send only the first 5 characters of its SHA-1 hash to check it against known data breaches, never the password itself;
  • the merchant you pay, as described in section 1;
  • authorities, when required by law or a court order.

5. International transfers

Some of these providers process data outside your country, including in the United States. We choose providers that protect data adequately and use it only to provide their services to us.

6. How long we keep it

We keep your account data, charges and security log while your account exists. When you ask us to delete your account, we delete or anonymize your personal data within 30 days, except what we must keep to comply with the law. Data recorded on the blockchain cannot be deleted.

7. Your rights

You can ask us to confirm whether we process your data and to access, correct, delete, anonymize or port it, to tell you who we share it with, and you can object to processing. Send your request to [email protected] from the email address on your account, and we will reply within 15 days. You may also complain to Brazil's data protection authority (ANPD) or to the authority in your country.

8. Security

We use encrypted connections, hashed passwords and codes, encryption of two-factor secrets, limits on sign-in attempts and alerts for sensitive changes. No system is completely secure: keep your password and recovery phrase safe. We will never ask for your recovery phrase.

9. Cookies and browser storage

We do not use advertising or analytics cookies: our analytics (Cloudflare Web Analytics) works without them. Your sign-in session is kept in your browser's session storage and is cleared when you close the tab. If you pick the dark or light theme, that choice is saved in your browser's local storage so the dashboard opens the same way next time; it holds nothing else. Cloudflare may set cookies that are strictly necessary for security and bot protection.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. We will tell merchants about relevant changes by email or in the Service, and the date at the top shows the latest version.

12. Contact

Questions or requests about your data: [email protected].