Privacy Policy

This Privacy Policy explains how Reclack (“Reclack”, “we”, “us”) handles personal data when you visit our website, use the dashboard and APIs, or pay a merchant through a page we host. It applies to the Reclack website and to the Services described in our Terms of Service.

Reclack is stablecoin billing infrastructure. Payments move directly from a payer's wallet to an address the merchant controls. We do not hold funds, and we never ask anybody for a seed phrase or a private key.

Data protection law distinguishes between deciding why data is processed and processing it for somebody else. Both happen here, in different places.

We are the controller

For the personal data of merchants and prospective merchants: account holders, team members, billing contacts, website visitors and anybody who writes to us.

We are a processor

For the personal data a merchant processes through the Services about its own customers, such as a payer's email address, name or wallet address. The merchant decides why that data is processed; we act on their instructions.

The merchant is the controller

For the relationship with their own customers, including what they sell, what they promise and how they answer a payer's privacy request.

Where we act as a processor, a payer who wants their data corrected or deleted should contact the merchant they paid. If they contact us, we will point them to the merchant and tell the merchant that the request was made.

• Providing the Services: creating subscriptions, opening invoices, submitting collections, sending receipts and reminders, and showing a payer their own records in the portal.
• Keeping the Services working: monitoring, debugging, capacity planning, and investigating incidents.
• Security and abuse prevention: detecting fraud, abuse, automated attacks and prohibited use, and protecting merchants and payers from them.
• Support: answering your questions and tracing what happened to a specific payment or delivery.
• Legal and compliance: meeting obligations such as record keeping, sanctions screening and responding to lawful requests.
• Product and communications: telling you about changes to the Services, and, where you have asked for it or where the law permits, about things we think are relevant to your account.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use payer data to market to payers.

Where the UK GDPR, the EU GDPR or a similar law applies, we rely on the following bases:

Contract

Processing needed to provide the Services to you and to take the payments you asked us to take.

Legitimate interests

Keeping the Services secure and available, preventing abuse, improving the product, and communicating with merchants about their accounts. We balance these against your rights.

Legal obligation

Record keeping, tax, sanctions and responses to lawful requests from authorities.

Consent

Optional analytics cookies and marketing email, where consent is required. You can withdraw it at any time.

Payments settle on public blockchains. Addresses, amounts, timestamps and transaction hashes are published by those networks, are visible to anyone, and are permanent.

• We cannot edit, hide or delete anything that has been written to a blockchain, and neither can you. A deletion request cannot be fulfilled against a public chain.
• A wallet address can be personal data when it is linked to a person. Where we hold such a link in our own systems, the rights described below apply to our copy of it.
• Reclack does not publish a merchant's or a payer's name, email address or other contact details to a blockchain.
• Third parties, including analytics firms, can observe public chains independently of us. That is a property of the networks rather than something the Services control.

We share personal data only where it is needed to run the Services, and under contracts that restrict what the recipient may do with it.

A current list of sub-processors is available at [email protected], and merchants under a data processing agreement are notified before a new sub-processor is added. If Reclack is involved in a merger, acquisition or sale of assets, data may transfer as part of that transaction, and we will say so before it takes effect.

Reclack and its providers operate in more than one country, so personal data may be transferred outside the country where it was collected, including to the United States.

Where data protected by UK or EU law is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses, together with the UK Addendum where relevant, and on technical measures such as encryption in transit and at rest. A copy of the mechanism used for a particular transfer is available on request.

• Encryption in transit, and encryption at rest for stored records.
• Secrets, API keys and webhook signing secrets stored hashed or encrypted, never in plain text in logs. Reclack does not log secrets or private keys.
• Scoped API keys and role-based access in the dashboard, so a credential carries only the access its job needs.
• Least-privilege internal access, with access to production data limited to the people who need it and recorded when used.
• Request logging, monitoring and alerting, so an unusual pattern is visible rather than silent.
• Separate sandbox and live environments, with separate credentials and separate networks.

No system is perfectly secure. If a breach affects your personal data and the law requires notification, we will notify you and the relevant supervisory authority within the time limits that apply. To report a vulnerability, write to [email protected].

Depending on where you live, you may have some or all of the following rights over personal data we hold as controller:

• Access: ask what we hold and get a copy.
• Rectification: have inaccurate data corrected.
• Erasure: have data deleted where we have no overriding obligation to keep it.
• Restriction and objection: ask us to pause a use, or object to processing based on legitimate interests.
• Portability: receive data you gave us in a machine-readable form, or have it sent to another provider where technically feasible.
• Withdraw consent: for anything we do on the basis of consent, without affecting what was done before.
• Complain: to your local supervisory authority. In the UK that is the Information Commissioner's Office.

Write to [email protected] to exercise a right. We will verify the request, respond within the period the law allows, and tell you if we cannot act on part of it and why. If you are a payer rather than a merchant, contact the merchant you paid, because they decide how their customer data is used.

We use a small number of cookies and similar storage mechanisms, and we keep them to what the site actually needs.

Hosted payment pages use only what is needed to complete the payment. Browser settings can block cookies, but blocking strictly necessary ones will stop the dashboard working.

The Services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.

• You decide what customer data to collect at checkout. Collect what you need and no more: email and name are both optional.
• You need your own privacy notice, telling your customers what you do with their data and naming Reclack as a processor where relevant.
• You need a lawful basis for sending us personal data about your customers.
• Where the law requires a data processing agreement between us, ours is available at [email protected] and incorporates these commitments.
• Forward a customer privacy request to us if it concerns data only we can reach, and we will help you answer it.

We update this policy when the Services change or when the law requires it. The date at the top shows when it last changed, and material changes are notified by email or in the dashboard before they take effect.

For anything about this policy, about the data we hold, or to exercise a right, write to [email protected]. For security reports, write to [email protected]. Reclack's corporate details and registered address are available on request and in the dashboard.