Privacy Policy
What Gully Pay collects, why, who helps us process it, how long we keep it, and how to see, export or delete it.
This draft describes how Gully Pay works today, based on what the product actually does. Our lawyers have not reviewed it yet, and the reviewed version may change the wording. Questions: [email protected].
Who we are
Gully Pay (gullypay.xyz, the Gully Pay app and the Gully Pay Merchant app) is run by Gully Labs. This policy explains what personal data the service handles and what you can do about it. For anything in it, write to [email protected].
When you pay a business through Gully Pay checkout, that business decides why it needs your details (for example to ship an order). It has its own privacy policy; we process the payment for it.
What we collect
Your account
- Email address, and your first and last name if you give them.
- Your password, stored only as a one-way bcrypt hash. We cannot read it.
- If you turn them on: your two-factor (TOTP) secret and the public keys of your passkeys.
- Sign-in sessions: a hash of each refresh token and when it expires, so you can see and sign out devices.
Businesses (merchant accounts)
- Business and store names, business type and country, team members and their roles.
- What you set up to sell: products, prices, orders, customers you add, payment links, webhook URLs.
- API keys, stored only as hashes (we show a key once, when you create it).
- Verification decisions our team records when a business is reviewed.
Payments
- Amount, currency, status, time and payment method of every payment, refund and payout.
- Card payments: you type card details into Stripe's secure form. They go to Stripe, never to our servers; we keep Stripe's payment reference.
- Stablecoin payments: the network, transaction hash, token, amount and the paying wallet address.
- The email address you give at checkout, used to send your receipt and shared with the business you paid.
Your wallet
- Gully Pay wallets are custodial: we generate the wallet and keep its private key encrypted with AES-256-GCM. The key never leaves our servers and is never shown, logged or sent anywhere.
- The wallet address, the recipients and amounts of transfers you send, and balances read from public blockchains.
The mobile apps
- Everything above that you use in the app. Sign-in tokens are kept in the iOS Keychain or Android Keystore.
- If you allow notifications: the device's Expo push token, its platform (iOS or Android) and which app it is, so we can tell you about payments, refunds and payouts. Removing the device or deleting the account deletes it.
- The camera is used on your phone to read QR codes; no image leaves the device. Face ID, Touch ID and fingerprint checks happen in the operating system; the app only learns yes or no.
- Crash reports, only in builds where reporting is switched on: the error message (with emails, tokens and long hex strings removed), stack trace, app version and platform. They are not linked to your account.
Technical and support data
- Your IP address, used while a request is handled to rate-limit and block abuse. It is stored only on security audit entries for sensitive actions such as closing an account.
- API request logs (method, path, status, duration and the account or key that made the call) for usage metering.
- Support tickets and the messages you send us.
- Your email, if you joined our earlier waitlist.
What we do not collect
Location, contacts, photos, advertising identifiers or browsing history. There are no advertising or third-party analytics SDKs on the site or in the apps, and we do not track you across other sites or apps.
How we use it
- To run your account and the payments, checkouts, wallets and payouts you ask for (performing our contract with you).
- To verify every stablecoin payment on-chain before a receipt is issued.
- To send service emails: email verification, password reset, receipts and account notices.
- To send the push notifications you turned on.
- To keep the service secure: rate limits, fraud checks, audit logs (our legitimate interest, and legal duties).
- To meet legal obligations such as financial record-keeping, tax and anti-money-laundering rules.
- To publish platform-wide totals (for example payment volume) that do not identify anyone.
International transfers
Our servers and providers may process data in countries other than yours. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses with those providers.
How long we keep it
We keep your data while your account is open. When you delete your account, this is what happens to each kind of data:
| Data | On deletion | How long | Why |
|---|---|---|---|
| Email, name, password hash, 2FA secret | Anonymised | Immediately | Removed from the account row; the address can be used to sign up again. |
| Sessions, passkeys, API keys, push devices | Deleted | Immediately | Signs you out everywhere and stops notifications. |
| Team memberships and waitlist sign-up | Deleted | Immediately | You lose access to every business you were a member of. |
| Businesses you were the only owner of | Kept | Closed at once; records kept 7 years | Checkout links, API keys and webhooks stop. Payment records stay for accounting and refunds. |
| Payments, refunds, payouts, ledger and fee entries | Kept | 7 years | Financial record-keeping, tax and anti-money-laundering obligations. |
| Embedded wallet (encrypted key) | Kept | 7 years, wallet frozen | So funds that arrive after closing can still be recovered for you after identity checks. |
| Security audit log | Kept | 7 years | Fraud prevention and incident investigation. Entries reference the anonymous id only. |
| Support tickets | Kept | 2 years | Handling disputes about past requests. |
Kept records are linked only to an anonymous account id after deletion. We do not delete what the law obliges a payment provider to keep, and we cannot delete public blockchain transactions.
Your rights and choices
- See and correct your details in Settings, or ask us for a copy of your data (we reply within 30 days).
- Delete your account in the app (Settings, Sessions and account, Delete account), on the web at gullypay.xyz/account/delete, or by email.
- Turn off notifications in the app or in your phone's settings.
- Object or restrict some uses, and complain to your data protection authority.
Send any request to [email protected] from the email address on your account so we can confirm it is you.
Security
Wallet keys are encrypted at rest, passwords are hashed, sessions are short-lived and can be revoked, and payments are verified on-chain before a receipt is issued. Details are on our security page.
Children
Gully Pay is for adults. You must be 18 or older to create an account, and we do not knowingly collect data from children.
Changes to this policy
We will update the date at the top when this policy changes and tell you by email or in the app before a material change takes effect.
Contact
Privacy questions and requests: [email protected]. Everything else: [email protected].