Privacy policy.

This policy explains what data Bayon Pay collects from merchants and their customers, how we use it, and the choices you have. It applies to the Bayon Pay dashboard, API, hosted checkout, and WooCommerce plugin.

• Account data: your name, email address, business name, and a hashed version of your password when you create a merchant account.
• Bank payment link: the merchant-facing bank payment link you connect, and its associated currency. We never collect or store a bank login, bank Merchant ID, or bank API secret.
• Transaction data: order amount, currency, reference ID, status, and timestamps for payments you create — the information needed to keep your order status synchronized.
• Customer checkout data: when a customer pays through a Bayon Pay hosted checkout, we process the amount and payment status needed to complete that transaction. We do not collect a paying customer's bank login or card details — payment happens through their own banking app.
• Technical data: standard request logs (IP address, browser user agent, timestamps) used for security, fraud prevention, and debugging.

Bayon Pay never asks you or your bank for a bank login, bank Merchant ID, or bank API secret. We never touch your money — every payment settles directly between your customer and your own connected bank account. Bayon Pay is never in the settlement path and does not have access to your bank balance.

• To operate your merchant account and process payments.
• To send account emails: email verification codes, password reset codes, and service notices.
• To detect and prevent fraud, abuse, and illegal activity — see our terms on acceptable use and account suspension.
• To respond when you contact us for support.
• To maintain the security and reliability of the service.

We do not sell your data.

We share the minimum data needed with your connected bank to create and confirm a payment, since the bank — not Bayon Pay — settles the transaction. We use a third-party service to deliver account emails (verification codes, password resets). We do not sell or rent your data to advertisers or data brokers, and we share data with law enforcement only where legally required.

• Passwords are stored using salted, one-way hashing — never as plain text.
• A generated Bayon Pay API key is shown to you once; only its one-way hash is stored afterward.
• Sessions use HttpOnly, secure cookies.
• A payment rail stays disabled on your account until your bank connection and webhook setup are verified.

Bayon Pay uses a small number of essential cookies to keep you signed in to your merchant dashboard and to remember your light/dark theme preference. These are functional cookies required for the service to work, not third-party advertising or tracking cookies.

We keep account and transaction data for as long as your merchant account is active, and for a reasonable period afterward as needed for accounting, fraud prevention, and legal obligations. You can request deletion of your account data as described below, subject to records we are required to keep by law.

You can access and update most of your account information directly from your dashboard. To request a copy of your data, a correction, or deletion of your account, contact us using the details below.

We may update this policy from time to time. We will post the updated policy on this page with a new "last updated" date.

Questions about this policy, or requests about your data, can be sent through our contact page.