Privacy Policy

Last updated: November 1, 2026

We collect as little personal data as we can: an email address to sign you up, security data (such as IP addresses of logins) to protect your Account, and the records of your transactions that any financial service must keep. We don’t ask for identity documents or selfies, we don’t use advertising or analytics trackers, and we don’t sell data. This policy explains exactly what we collect, why, who processes it for us, how long we keep it and what your rights are.

1. Who is responsible for your data

The controller of personal data processed through VexoraGate is the operator of VexoraGate (we). For any privacy question or request, write to [email protected], preferably from the email address of your Account.

This policy applies to the website vexoragate.com, the dashboard, the merchant API, the hosted payment pages, the Telegram bot and Mini App, and our emails.

2. What data we collect

Account data. Your email address; a hash of your password (we never store the password itself, it is hashed with a slow, salted algorithm); your 2FA secret, stored encrypted; your language preference; your notification preferences; and the dates your email was confirmed and your security settings were changed.

Security and session data. For each login session: the IP address, the browser user-agent string, and the time it was created and expires. We also record security events (logins, password and 2FA changes, API key generation, withdrawal requests) with the IP address in an audit log, and we send you notifications about them.

Transaction data. Your balances and the full history of your deposits, withdrawals, payouts, transfers and fees in our ledger; the blockchain addresses we issued to you; the addresses you send funds to; transaction hashes (txids); amounts, assets, networks, timestamps and statuses; and the reasons for any rejected withdrawal.

Merchant data. For each Merchant: its name, website, description of the goods or services, logo URL, callback, return and success URLs, IP allowlists, encrypted API keys (with only the last characters visible), moderation decisions and notes, Invoices, Static wallets, payouts and webhook delivery logs.

Payer data processed for Merchants. When someone pays a Merchant’s Invoice we process the data the Merchant sends us through the API (order ID, amount, optional additional data and, if the Merchant chooses to send it, the payer’s email) and the on-chain data of the payment (the sending address and txid). We process this on behalf of the Merchant, see section 8.

Telegram data. If you link Telegram: your Telegram user ID, chat ID, username and first name as provided by Telegram, and the time of linking. The Mini App receives a signed session from Telegram that we verify; we do not receive your phone number or contacts.

Communications. Messages you send us (email or Telegram) and our replies.

Technical data. Our reverse proxy and application write technical logs (IP address, requested URL, status code, user agent, time) to detect errors and attacks. Cloudflare, which protects the Service, processes connection data as described in section 6.

3. What we don’t collect

No identity documents, passports, ID cards, selfies, face scans or proof of address — VexoraGate does not perform identity verification (KYC) at sign-up.
No phone number, date of birth or home address is required.
No advertising cookies, cross-site trackers, analytics pixels or fingerprinting scripts. Our pages load fonts, images and scripts only from our own domain.
No private keys of your external wallets — and our own servers hold no private keys of customer funds either.

In rare cases described in our Terms and AML & Sanctions Policy, we may ask for information about the origin of specific funds or about a business; anything you then provide is processed under this policy.

4. Why we use your data

To provide the Service: create and run your Account, credit deposits, process withdrawals, payments, payouts and transfers, keep the ledger, send webhooks to Merchants, and show you your history.
To keep your Account and funds secure: authenticate you, enforce 2FA and email confirmations, detect suspicious logins, apply security locks, and investigate incidents.
To prevent fraud and comply with the law: review withdrawals and Merchants, check for links to stolen funds or sanctioned addresses, respond to lawful requests and keep the records the law requires.
To communicate with you: send confirmations, security alerts and the notifications you choose (by email and, if linked, Telegram), answer support requests, and tell you about important changes to the Service or these policies. We do not send marketing emails unless you have opted in.
To operate and improve the Service: monitor performance and errors, plan capacity and fix bugs, using aggregated or technical data where possible.

5. Legal bases

Where data-protection laws such as the GDPR apply, we rely on: performance of a contract (providing the Service under our Terms); legal obligations (keeping financial records, responding to lawful orders, sanctions compliance); legitimate interests (securing the Service, preventing fraud and abuse, defending legal claims, improving the Service — balanced against your rights); and consent where we ask for it (for example optional marketing, or linking Telegram), which you can withdraw at any time.

6. Who processes data for us

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions, and only to the extent they need it:

Hosting — our hosting provider in the Netherlands: our servers and database are located in the Netherlands.
Cloudflare, Inc. — content delivery, DDoS protection, TLS and bot protection (including Cloudflare Turnstile on sensitive forms). All traffic to the Service passes through Cloudflare, which processes IP addresses and request data in its global network.
Namecheap Private Email — delivery of transactional emails (confirmations, alerts).
Telegram — delivery of bot messages and the Mini App, only if you link Telegram.
Blockchain data providers (for example TronGrid for Tron and public BNB Smart Chain RPC endpoints) — we query them for blocks and transactions involving our addresses; these queries contain blockchain addresses and txids, not your email.

We also disclose data: to a Merchant, for payments made to that Merchant (status, amounts, txid, sending address, data the Merchant itself provided); to authorities, courts or law-enforcement agencies when we are legally required to or when a request is valid and proportionate; to professional advisers under confidentiality; and to a successor if our business is reorganised or sold, under the same protections.

We do not sell, rent or trade personal data, and we do not share it with advertisers.

7. Public blockchain data

Deposits, withdrawals and payments are recorded on public blockchains (Tron, BNB Smart Chain). Anyone can see the addresses, amounts and times of these transactions, and they cannot be changed or deleted by anyone, including us. We do not publish which addresses belong to which user, but analysis of public blockchain data by third parties can sometimes link addresses to people. Keep this in mind when you share addresses — privacy-friendly does not mean anonymous.

8. Data of Merchants’ customers

When we process the data of a Merchant’s customers (Payers) to provide payment pages, Invoices, Static wallets, refunds and webhooks, we act on behalf of the Merchant, who decides what data to send us and is responsible for informing its customers. We also process limited Payer data for our own purposes as an independent controller where needed for security, fraud prevention and our legal obligations. Payers can contact the Merchant or us with questions.

9. International transfers

Our servers and database are located in the Netherlands. Some providers (for example Cloudflare, Telegram and email or blockchain-data providers) may process data in other countries, including outside the European Economic Area. Where the law requires it, we rely on adequacy decisions or on standard contractual clauses and additional safeguards for such transfers. You can ask us for more information at [email protected].

10. How long we keep data

Account data — while your Account is open; after closure, for as long as needed for the purposes below and then deleted or anonymised.
Ledger and transaction records (balances, deposits, withdrawals, payments, payouts, fees) — at least 5 years after the end of the business relationship or longer where applicable law requires. Our ledger is append-only, so these records cannot be erased on request while the retention period runs.
Sessions — a login session expires after 7 days of validity (10 minutes while 2FA is pending); expired sessions are no longer usable and are removed from the database regularly.
Audit log of security events — for the lifetime of the Account and up to 5 years after closure, to investigate fraud and disputes.
Server and proxy logs — kept in size-limited rotating files (5 files of 10 MB per service): the oldest entries are overwritten automatically, so how long a log line survives depends on traffic (usually days to a few weeks). We copy logs only when needed to investigate a specific incident.
Email confirmation and password-reset tokens — single use, valid for 24 hours and 1 hour respectively; Telegram link codes — valid for 10 minutes.
Encrypted database backups — deleted automatically after 14 days.
Support communications — up to 3 years after the last message.

11. How we protect data

All connections use HTTPS (TLS); the servers accept traffic only through Cloudflare and expose no database or admin ports to the internet.
Passwords are hashed; 2FA secrets, API keys and integration credentials are encrypted at rest; session tokens are stored only as hashes.
Strict Content Security Policy, HttpOnly and SameSite cookies, rate limiting, and separate administrator access protected by 2FA and audit logging.
No private keys of customer funds on internet-facing servers; withdrawals are reviewed by a person; hourly reconciliation of the ledger against on-chain reserves.
Daily database backups encrypted with AES-256.

No system is perfectly secure. If a personal-data breach is likely to result in a risk to you, we will notify you and the competent authority as required by law.

12. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete data (subject to the record-keeping obligations in section 10 — we cannot erase ledger entries or data we must keep by law, but we will delete or anonymise everything else); restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on consent.

Send requests to [email protected] from your Account email so that we can confirm it is you; we may ask for additional confirmation (for example a 2FA code) before disclosing data. We answer within one month, or explain why we need more time. You also have the right to lodge a complaint with a data-protection authority — in the EU, for example, the authority of your country of residence or the Dutch Autoriteit Persoonsgegevens.

Many settings are available directly in your Account: notification preferences, Telegram linking and unlinking, language, password and 2FA.

13. Cookies

We use only cookies that are strictly necessary for the Service (login session, language, selected Merchant, admin-panel language) and the security cookies that Cloudflare may set. We do not use analytics or advertising cookies. Details are in our Cookie Policy.

14. Automated decisions

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated checks (for example limits, security locks or risk flags) can delay an operation, but withdrawals, payouts and Merchant approvals are decided by a person.