Privacy Policy

1. Overview

AgentPay ("we", "our") respects your privacy. This policy explains what data we collect and how we use it.

2. Data We Collect

Account data:

• Email address
• Hashed password (never stored in plaintext)
• Optional: TOTP secret (for 2FA)
• Optional: Webhook URLs

Usage data:

• API request metadata (IP, user-agent, timestamp)
• Transaction records (amounts, agent IDs, descriptions)
• Audit log entries (all sensitive operations)

Payment data:

Payment processing is handled entirely by Stripe. We never store full card numbers, CVV, or bank account details. We only receive a session ID and confirmation of payment success.

3. How We Use Data

• To provide the Service
• To prevent fraud and abuse
• To maintain security and audit trails
• To respond to support requests

We do NOT sell your data to third parties.

4. Data Retention

• Account data: retained while your account is active
• Transaction records: retained for legal/audit purposes (up to 7 years)
• Audit log: retained with hash chain integrity
• Health checks: retained for 90 days, then pruned automatically

5. Security

• Passwords hashed with scrypt
• Sessions stored server-side with HttpOnly cookies
• API keys stored and compared with constant-time operations
• Sensitive fields (webhook URLs) encrypted with Fernet (AES-128-CBC + HMAC)
• All traffic over HTTPS
• Full audit log with hash chain

6. Third-Party Services

• Stripe — payment processing
• Neon — PostgreSQL hosting
• Railway — API hosting
• Vercel — frontend hosting
• Resend — transactional email (password reset, verification)

7. Your Rights

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: request deletion (subject to legal obligations)
• Portability: export your data as JSON

Contact: mhmdthbrh@gmail.com

8. Changes

We may update this policy. Material changes will be announced on the website.