Privacy Policy

1. Who This Policy Covers

This Policy applies to:

• Merchants — businesses that use XRPay storefronts, merchant tools, or connected commerce platforms, including BigCommerce
• XRPay Cash users — people who use the mobile app to buy, send, receive, or withdraw crypto
• xApp Off-Ramp Users — Xaman wallet holders who use the XRPay xApp to convert XRPL assets to fiat USD
• Shoppers — customers who pay through a checkout powered by the App
• Waitlist subscribers — individuals who sign up for early access at our public landing page

2. Information We Collect

From Merchants (via BigCommerce OAuth)

• BigCommerce store hash, store name, and store domain
• Merchant email address (provided by BigCommerce during install)
• BigCommerce API access tokens (stored in our access-controlled database and used to read/update store data)
• Merchant settlement addresses and, when the optional app-generated operational-wallet feature is enabled, the wallet's encrypted seed/private-key material
• App configuration: settlement preferences, POS settings, Telegram bot tokens
• Transaction history: order IDs, amounts, payment statuses, XRPL transaction hashes
• B2B wholesale listings, orders, and inventory managed within the App
• POS employee records: names and PIN hashes (for in-store register access)

From merchants connecting Google, Meta, or TikTok catalogs

• Provider account and business identifiers, available catalog identifiers and names, and the destination you select
• Google Merchant Center account and data-source identifiers, or TikTok Business Center and catalog identifiers, when you connect those channels
• Access and refresh tokens, granted permissions, token expiry, and connection status; saved tokens are encrypted
• Product identifiers, titles, descriptions, images, storefront links, prices, currency, and availability needed to synchronize your selected catalog
• Publication results, timestamps, and errors used to show sync status and resolve problems

You authorize each connection through its provider and choose your catalog or Google Merchant Center data source. We use this access to discover and verify your available destinations and publish and update your products. Google refresh tokens allow scheduled updates after your initial authorization. Catalog connection does not authorize ad spending or publishing social posts.

From xApp Off-Ramp Users (KYC & Bank Linking)

• Identity data (KYC): Full legal name, date of birth, residential address, Social Security Number (SSN), and government-issued ID — collected and processed by our regulated partner Bridge.xyz as required by US financial regulations
• Bank account data: Bank name, routing number, and account number (US ACH), IBAN and BIC/SWIFT (international), or wire transfer details — used solely to route fiat withdrawals
• Off-ramp transaction records: XRPL wallet address, token amounts, conversion rates, fees, ACH transfer IDs, and settlement timestamps
• XRPL trustline balances (read-only, fetched at session time to populate the withdrawal UI)

KYC identity data is collected, stored, and processed primarily by Bridge.xyz under their own privacy policy. Xbit Innovations LLC retains only the Bridge customer ID, KYC status, and transaction records necessary to provide the service.

From Shoppers (at checkout)

• Email address (passed from BigCommerce checkout for confirmation purposes)
• XRPL wallet address used for payment (recorded from public blockchain data)
• Transaction amounts and blockchain transaction hashes

From XRPay Cash Mobile Users

• Account and authentication data: email address, authentication method, account identifier, and session information
• Optional contact profile: display name and verified phone number when you choose to let contacts find you
• Contact discovery data: protected fingerprints of phone numbers from contacts you choose to check for matches. Contact names remain on your device and are not uploaded
• Wallet and transaction data: public wallet addresses, selected assets and networks, balances read from public blockchains, amounts, quotes, fees, transaction hashes, and payment status
• Local payment and payout data: country, Mobile Money phone number and network, and bank or payout details needed to process a transaction
• Device and notification data: push notification token, platform, app version, and related delivery status
• Product usage data: app interactions, transaction-flow events, anonymous installation and session identifiers, country code, and error or outcome information used to operate and improve the service

From Waitlist Subscribers

• Email address and optional store name (submitted via the landing page form)

We do not collect wallet seed phrases or private keys for external wallets, and we do not store card numbers entered in a payment provider's hosted checkout. SSN and government ID are processed exclusively by Bridge.xyz and are never stored on Xbit Innovations LLC infrastructure.

3. How We Use Your Information

• To connect the sales channels you authorize and keep your selected product catalog up to date, including scheduled updates, publication status, retries, and removal of previously published products that are no longer eligible
• To authenticate your BigCommerce store and maintain your App installation
• To generate payment requests, QR codes, and verify on-chain settlement
• When you enable an app-generated operational wallet, to provision the wallet and perform wallet setup or transactions you request or authorize, including trustline, settlement, refund, treasury, payout, and automated-sweep functions
• To update order statuses and sync payment results back to your BigCommerce store
• To provide the merchant dashboard, analytics, B2B marketplace, POS register, and tax ledger
• To operate the xApp off-ramp: verify identity via Bridge.xyz, link bank accounts via Plaid, initiate ACH withdrawals, and record transaction history
• To authenticate XRPay Cash users and provide crypto buying, sending, receiving, swapping, and withdrawal features
• To match opted-in users with protected contact-number fingerprints and coordinate payment invitations
• To obtain quotes, calculate and display fees, route local payments and payouts, and track transaction delivery
• To send requested verification codes and transaction or invitation notifications
• To measure product usage, diagnose failures, and improve reliability using first-party analytics
• To comply with US financial regulations (BSA/FinCEN) applicable to fiat off-ramp services
• To send one launch notification to waitlist subscribers (opt-in at time of submission)
• To detect and prevent fraudulent or unauthorized activity
• To comply with applicable legal obligations

We do not sell your data or use it for our own advertising. When you connect a sales channel, we send the product information needed to provide the catalog service you requested.

4. Data Storage & Security

All data is stored in a PostgreSQL database hosted on Railway (EU/US region). Sensitive values — including integration API tokens and seeds for app-generated operational wallets — are encrypted at rest. Access is restricted to authorized systems and personnel. When a wallet operation that you request or authorize requires signing, the App may decrypt an operational-wallet seed in server memory to sign and broadcast the transaction. Administrator multi-factor authentication is required to export an operational-wallet seed.

If you configure an external wallet for direct settlement, the App stores its public address but does not require or store that external wallet's private key or seed phrase. Do not provide an external-wallet private key or seed phrase to Xbit Innovations LLC. All communications between the App, third-party services, and XRPL are transmitted over HTTPS/TLS. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

We perform regular dependency audits and follow OWASP security guidelines for web application development.

5. Data Sharing

We share data only in the following limited circumstances:

• Google, Meta, and TikTok — When you connect one of these sales channels, we send product information to the Merchant Center data source or catalog you select. Railway Corporation provides hosting and database processing for XRPay's catalog connection data and encrypted tokens. Each provider processes information on its own platform under its own policies
• BigCommerce — We write order status updates and register storefront scripts via the BigCommerce API as required for the App to function
• XRP Ledger (XRPL) — Payment transactions are submitted to the public XRP Ledger; all XRPL transactions are publicly visible by design
• Xaman (XUMM) — Payment signing requests are routed through Xaman's API; no personal data beyond a payment amount and destination address is shared
• Bridge.xyz — For xApp off-ramp users, KYC identity data (name, DOB, SSN, address, ID) and bank account details are shared with Bridge.xyz as required to process fiat withdrawals. Bridge.xyz is an independent controller of this data under their own privacy policy
• Plaid — Bank account credentials entered during the Plaid Link flow are processed directly by Plaid; Xbit Innovations LLC receives only a tokenized reference used to route ACH transfers (US users)
• ChangeNOW — XRPL wallet address and token amounts are shared with ChangeNOW to obtain swap quotes and execute DEX conversions for non-XRP trustline withdrawals
• Payment, on-ramp, off-ramp, and swap providers — Contact, wallet, transaction, and payout details required to quote and complete the route you request may be shared with the provider shown in the app
• Public blockchains — Wallet transactions are broadcast to the selected public network and remain publicly visible by design
• Communications providers — Phone number, email address, push token, and message delivery data may be processed to deliver verification codes, invitations, and transaction notifications
• Telegram — Store catalog data is delivered to your configured Telegram bot; no shopper personal data is transmitted to Telegram by the App
• Infrastructure and security providers — Data, including encrypted operational-wallet key material when that feature is enabled, is processed by hosting, database, monitoring, and security vendors as necessary to operate and protect the App
• Law enforcement — Only when required by a valid legal process under applicable law

Operational-wallet seeds are not published to XRPL or intentionally disclosed to payment recipients. Signed transaction data is submitted to XRPL and becomes public. We do not sell, rent, or trade personal data to advertisers or data brokers.

6. Account and Service Lifecycle & Privacy Requests

XRPay verifies signed BigCommerce callbacks when an app is opened, uninstalled, or a BigCommerce user's access is removed. Privacy requests can be submitted to support@xbitinnovations.com.

• Access — Request a copy of merchant or customer data associated with the App
• Erasure — Request deletion of identifiable data that is not subject to legal retention requirements
• Uninstallation — BigCommerce credentials are invalidated immediately when the signed uninstall callback is received
• Mobile accounts — Request deletion of an XRPay Cash account and associated non-regulated personal data, subject to identity verification and legal retention requirements

Personal XRPay Cash users can also follow the steps on our account deletion page.

7. Data Retention & Deletion

• Google, Meta, and TikTok catalog connection data is used while the connection is active. Disconnecting stops updates and clears the active connection's destination selection and credentials. Cleanup, authorization, synchronization, and diagnostic records may remain until cleanup or a verified deletion request is completed. Provider authorization may remain available to other XRPay connections using it. Disconnecting does not delete your catalog or products on the provider's platform. See our sales-channel data deletion instructions to disconnect, review provider access, or request deletion of integration data
• Merchant and transaction data is retained while the App is installed
• Encrypted key material for an app-generated operational wallet is retained while the wallet feature or an authorized transaction function requires it, and until a verified deletion request can be completed, subject to legal, fraud-prevention, backup, and security requirements
• Before requesting deletion of operational-wallet key material, you must export or rotate the wallet credential and move any assets you wish to retain. Deletion of our stored copy does not rotate the on-chain credential, prevent use by anyone who already possesses it, or reverse completed transactions
• Session tokens are invalidated on uninstallation
• Uninstallation disconnects the store immediately; non-regulated store data can be deleted on request
• Waitlist email addresses are deleted upon request or within 12 months if no launch notification is sent
• Mobile account profiles, contact-discovery records, push tokens, and product-usage events are retained only as long as needed to provide, secure, and improve the service, or until a verified deletion request can be completed
• Mobile transaction and payment records may be retained when required for fraud prevention, dispute handling, accounting, or financial-services compliance
• xApp off-ramp KYC records are retained for a minimum of 5 years as required by US Bank Secrecy Act (BSA) and FinCEN regulations. This retention obligation supersedes deletion requests for regulatory data
• Off-ramp transaction records (amounts, timestamps, XRPL hashes, ACH transfer IDs) are retained for 7 years to comply with financial recordkeeping requirements
• Merchants and off-ramp users may request deletion of non-regulated data at any time by emailing support@xbitinnovations.com

8. GDPR & International Privacy Rights

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we restrict processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at support@xbitinnovations.com. We will respond within 30 days.

9. Cookies & Analytics

We do not use data for behavioral advertising and do not place third-party advertising analytics on merchant storefronts. Web services may use session cookies to maintain authentication. XRPay Cash collects first-party product events, anonymous installation and session identifiers, app and platform versions, country code, and error or outcome information to understand feature use, diagnose failures, prevent abuse, and improve reliability.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted in the App dashboard and on this page with an updated effective date. Continued use of the App after notice of changes constitutes your acceptance.

11. Contact

For privacy-related questions, data requests, or to exercise your rights:

Xbit Innovations LLC
support@xbitinnovations.com