Privacy policy

Information we handle

• Account information: your sign-in identifier, email address, name and profile information supplied by you or your chosen sign-in provider. Onboarding can also collect your age, country and phone number.
• Identity verification: Didit collects the identity documents, selfie and other information requested in its hosted verification flow. Face comparison and liveness checks can process biometric information derived from facial images. Payd records the verification result and session references. Authorized Payd staff can review verification information through Didit.
• Recipient and activity information: recipient names, contact and address details, bank or mobile-wallet details you enter, transfer previews, test payment references, amounts, statuses and account review records.
• Technical information: authentication and security records. Our hosting and service providers can also process request metadata, such as IP address, browser information and error logs, when delivering the service.

Google and Apple sign-in

Google sign-in requests basic identity permissions only: OpenID, email address and profile. We use the identifier, email and profile information supplied through Clerk to create, authenticate and manage your Payd account. Payd does not request access to your Gmail, Google Drive, contacts or calendar.

Apple sign-in provides an account identifier and, when shared, your name and email address. If you choose Hide My Email, we use the relay address Apple provides.

We do not sell Google user data or use it for advertising. You can revoke Payd’s access through your Google or Apple account settings. Revoking a connection does not automatically delete information already associated with your Payd account; contact us to request deletion.

How we use information

We use information to provide sign-in, manage accounts and recipients, verify phone numbers and identity, apply access restrictions, display previews and test activity, respond to support requests, investigate errors and protect the service against misuse.

Identity verification must be approved before an account can start a transaction. Completing verification does not enable live payments or guarantee access to a future transfer service.

Service providers and sharing

We use Clerk for authentication, Google and Apple when you choose their sign-in options, Didit for identity checks, Twilio for phone verification, Stripe for test payment processing, Vercel for website hosting and Render for the API and database. Information needed for each function is processed by the relevant provider. Their own privacy information also applies when you use their services.

Authorized staff can access information needed for account support, security and review. We can also disclose information when required by applicable law or to address fraud, abuse or security incidents. Providers may process information in countries other than your own.

Didit’s verification privacy notice explains its verification processing, including automated checks, permitted fraud-model improvement and options to object. Its biometric data policy describes retention and destruction. You can contact Payd about your verification information or contact Didit at privacy@didit.me.

Cookies and storage

Payd and its authentication providers use cookies or similar browser storage to maintain sessions and support authentication and security. Blocking this storage can prevent sign-in or other account features from working.

Retention, choices and deletion requests

Account, recipient, verification and activity records are retained to operate and support the service, maintain security and handle account reviews. There is currently no automatic account-deletion schedule.

To request access, correction, account closure or deletion, email engineering@thinqr.org. We may verify that the request concerns your account before acting. We will review which records can be removed and explain any retention needed for security, disputes or applicable obligations. Providers can retain information under their own policies.

Payd’s account features are intended for adults aged 18 or over.

Contact and updates

For privacy questions, contact Thinqr-org, LLC at engineering@thinqr.org. Changes to this policy will be posted here with an updated date.