Privacy Policy
What NoTollPay collects and why. Last updated 8 November 2026.
What we collect
From a business: its name, email address, a scrambled form of its password, its public wallet addresses, its plans, invoices and webhook settings.
From a buyer: nothing directly. An invoice records the public blockchain transaction that paid it, and any customer reference the business chooses to send.
From every visitor: the IP address, kept briefly to limit sign-in abuse. One cookie keeps you signed in. On our public pages, such as the home page and the guides, Google Analytics counts visits using its own cookies. It never runs on the dashboard or on a checkout page, and we use no advertising cookies.
Why we use it
To run the service, to tell you when a payment arrives or a plan ends, to send security notices and receipts, and to prevent abuse. We do not sell your data and we do not use it for advertising.
Analytics and your choice
If your device is set to a European time zone, we ask before Google Analytics starts, and it stays off unless you accept. Everyone else can turn it off at any time with the button below. Your choice is saved only in your own browser.
Who else sees it
Email is delivered through Resend, which receives your address and the message. If you choose to sign in with Google, Google tells us your name and confirmed email address, and nothing else. Google Analytics receives visits to our public pages. Blockchain nodes and data providers receive the public wallet addresses we look up. Webhooks go only to the addresses you set. We share data with anyone else only if the law requires it.
Public blockchains
Blockchain transactions are public and permanent, and nobody can delete them. That includes the wallet addresses and amounts of your payments.
How long we keep it
Account and invoice records stay while your account exists, because they are your payment history. Sign-in abuse records last minutes. Records of blockchain transfers last 35 days. When you ask us to close your account, your personal details are removed, apart from what the law requires us to keep.
Your choices
You can read and correct your details in Settings. To get a copy of your data or close your account, write to [email protected].
Security
Passwords are stored as scrypt hashes, API keys as hashes, and webhook secrets encrypted. Sessions are signed and every form is protected against forgery. We hold no private keys, so a breach here could not move your money.
Contact
Questions go to [email protected].