Privacy policy
Version 0.1 (draft) · Last updated 5 November 2026
Draft for review by counsel. The operating entity and its registration details will be confirmed before launch; until then this policy describes the PurpleRail test environment, in which no real funds are processed.
1. Who we are
PurpleRail is a crypto payment service: it lets businesses ("merchants") accept payments in crypto-assets and receive fiat currency. The service is operated by [PurpleRail operating entity, registered address, company number] ("PurpleRail", "we"), with technology provided by Ecomstat. Custody of crypto-assets and fiat accounts is provided by licensed financial institutions and specialist providers named in section 6.
Contact for privacy questions: [privacy@ — to be confirmed].
2. Whose data this covers
- Payers: people who pay a merchant with crypto through our checkout or a payment link.
- Merchant and partner users: people who use the merchant dashboard, the mobile app or our API on behalf of a business, and operators of financial institutions and payment providers we work with.
- Visitors to our websites and documentation.
3. What we collect and why
| Data | Why we use it | Legal basis (EU/UK GDPR) |
|---|---|---|
| Payment details: order reference and amount from the merchant, the token and network you choose, the deposit address we give you, the sending wallet address and transaction hash on the blockchain | To process the payment, detect and confirm it, refund it where needed, and keep records for the merchant | Performance of a contract with the merchant; our legitimate interest in providing the service |
| Anti-money-laundering and sanctions screening results about the sending wallet | To meet legal obligations to prevent money laundering, terrorist financing and sanctions breaches | Legal obligation; legitimate interest in preventing financial crime |
| Refund address you give us | To return funds | Contract; legal obligation |
| Merchant user account data: name, business email, role, sign-in times, two-factor settings | To provide secure access to the dashboard and app | Contract with the merchant; legitimate interest in security |
| Business and payout details: company information, bank account, payout history | To pay merchants and meet record-keeping duties | Contract; legal obligation |
| Technical data: IP address, device and browser type, security logs | To keep the service secure and working, and to investigate abuse | Legitimate interest |
We do not ask payers for their name, email or card details to pay with crypto, unless the law or the merchant's risk policy requires additional information (for example under the Travel Rule for larger transfers). We do not sell personal data and we do not use it for advertising.
Blockchain data is public and permanent. Wallet addresses and transactions you make on a blockchain can be seen by anyone and cannot be deleted by us or by anyone else.
4. Automated decisions
Every payment is screened automatically for sanctions and financial-crime risk. Payments from sanctioned sources are blocked automatically, as the law requires; other elevated-risk payments are reviewed by a person. We may not be able to tell you why a payment was blocked, because the law can prohibit disclosing that ("tipping off"). You can contact the merchant or us to ask for a human review where the law allows it.
5. How long we keep data
- Payment, screening and refund records: 5 years after the payment (anti-money-laundering record-keeping), or longer if required by law or an investigation.
- Merchant account data: for as long as the account is active, then up to 6 years for legal and accounting claims.
- Security logs: up to 12 months.
6. Who we share data with
- The merchant you are paying (payment status and amounts, not screening details).
- Financial institutions and providers that make the service work: custody and wallet provider (e.g. Fireblocks), liquidity provider (e.g. SCRYPT), blockchain-analytics / AML provider (e.g. Chainalysis), off-ramp and banking partners. Each processes data only to provide its part of the service, and some act as independent controllers under their own legal obligations.
- Our technology and hosting providers (Ecomstat; cloud hosting in the EU/UK).
- Authorities such as financial intelligence units, regulators or courts, when the law requires.
7. International transfers
We host in the EU/UK. Where a provider processes data outside the UK/EEA, we use appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.
8. Security
Data is encrypted in transit; passwords are stored only as strong one-way hashes; staff access is role-based with two-factor authentication and a full audit log; customer funds are held by licensed custodians under policies we cannot change on our own.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its use, and to complain to a data-protection authority (in the UK, the ICO; in the EU, your local authority). Some data cannot be deleted while we must keep it by law, and data written to a blockchain cannot be deleted by anyone. Contact us using the details in section 1.
10. Mobile app
The PurpleRail app for merchants uses the same data as the dashboard. It may use your camera only if you choose to scan a QR code, and sends notifications only if you allow them. It contains no advertising or third-party tracking.
11. Changes
We will post any changes on this page and update the date above. Significant changes will be notified to merchants in advance.