Privacy policy
What we collect, why, who receives it, how long we keep it and how you control it.
Draft for review
This policy is a draft and not yet in force. Items in [brackets] still need the operator's details.
1. Who we are
Coino Live (coino.live) is a cryptocurrency payment gateway operated by [company legal name], [registered address] ("we"). For anything about your data, write to [email protected].
For the payment data of a merchant's customers, the merchant decides why it is collected and we process it on the merchant's behalf.
2. What we collect
Your account: name, email address, password (stored only as a one-way hash), the Google account id if you sign in with Google, two-factor settings, language, the time and IP address of your last sign-in, and who invited you if you came through an invitation link.
Your business: your gateways (name, website, webhook address), and what you create: invoices (with the customer details you enter), payment forms and the answers customers submit, donation campaigns, point-of-sale terminals and API keys (stored only as a hash).
Payments and withdrawals: amounts, currencies, order references, the customer email if one is given, deposit addresses, withdrawal addresses and blockchain transaction ids.
Custody users: the user id and, if your application sends them, the name, email and metadata of your own users.
Messages: support conversations and contact form messages.
Security records: account and staff actions with their time, IP address and browser, and technical server logs.
Cookies: a session cookie that keeps you signed in, a security cookie that protects forms, and, only when you arrive through an invitation link, a referral cookie kept for 30 days. On our public pages (not in the dashboard), Google Analytics sets cookies to count visits and see how the site is used. We use no advertising cookies.
3. Why we use it
To provide the service you signed up for: payment pages, crediting deposits, keeping your balance, paying withdrawals, webhooks and support. To keep accounts and funds safe and to prevent fraud and abuse. To keep the accounting records the law and our solvency checks require. To send service emails (security notices, withdrawal and support messages, and payment notices you can turn off), and to pay affiliate commissions.
We do not sell personal data and do not use it for advertising.
4. Public blockchains
Cryptocurrency transactions, addresses and amounts are recorded on public blockchains, where anyone can see them and nobody, including us, can change or delete them.
5. Who receives data
Service providers that run parts of the service for us, only for that purpose: our hosting provider [name, country]; Cloudflare (network protection and encrypted backups); our email provider [name]; blockchain data providers such as Alchemy, TronGrid, toncenter and mempool.space, which receive addresses and transaction ids but not names or emails; Google, only if you sign in with Google, and Google Analytics for visits to our public pages. Price data comes from CoinGecko without any personal data.
Merchants receive the payment data of their own customers. We share data with authorities when the law requires it.
6. How long we keep it
Account data is kept while your account is open. When you close it, your name, email and sign-in details are removed. Payment, ledger, withdrawal and security records are kept for [number] years, as accounting and anti-money-laundering rules require. Server logs are kept for 14 days. Encrypted backups are kept for 14 days on the server and up to 30 days off-site.
7. Security
Passwords and API keys are stored as hashes, sensitive settings are encrypted, two-factor authentication is available for accounts and required for staff, connections use HTTPS, and the keys that move funds are kept on a separate, isolated signing server.
8. Your choices and rights
In your dashboard you can download all your data as a file (Account → Your data), correct your name and email, turn payment emails off, and close your account. You can also ask us for access, correction or deletion, or object to a use of your data, by writing to [email protected]. Records we must keep by law are kept until that duty ends.
[If applicable: you can also complain to your data protection authority.] The service is not meant for people under 18.
9. Changes and contact
We will tell you by email before important changes to this policy take effect. Questions: [email protected].
Last updated: [date]
Contact the team