Privacy Policy

The person responsible for the personal data processed through vega-pal.com and the VegaPal app (the "controller") is an individual (a natural person) who runs the service under the name VegaPal, not a separately incorporated company. Postal address: none (we are reached by email only). For any privacy question or request, write to info@vega-pal.com.

• Account: your email address, the name and business details you add, and your settings. Your password is handled by our sign-in provider and stored only in hashed form; we never see it.
• Documents: what you enter in quotations, proforma invoices and invoices, such as your clients' names, contact details and addresses, items, amounts and notes, and your payment details (bank account details and wallet addresses).
• Payment checks: the wallet address, network and amount of each invoice we check, and public blockchain data about matching transfers, such as transaction IDs, sending addresses, amounts and times.
• Pro subscription: your plan, its dates, and the details of the payments you make to us (for example, blockchain details when you pay in crypto).
• Wallet tracking, when you use it: the addresses you choose to track, their networks, the platform and labels you give them, and the incoming transfers we find for them. You can track addresses that belong to other people, so only add an address when you have a legitimate reason.
• Telegram, only if you connect it: your Telegram chat ID, your Telegram username if Telegram shares it, and the language of your alerts.
• Sign-up source: the invite or partner code, and the campaign tags (such as utm_source) of the link that brought you to VegaPal.
• Usage and security: the dates of your sign-ins, a record of key actions in your account, and a random visitor ID that our own visit counter keeps in your browser. Our visit counter does not store your IP address, your browser details or the page you came from.
• The messages you send us by email or on Telegram.
• Transaction ID (TxID) checks: the transaction ID you check and the public result. We keep them without any link to you, your account or your IP address, as explained below.

• To provide VegaPal: store your documents, show payment pages, check payments, track the wallets you add, answer the transaction ID checks you make and send the alerts you ask for. We need this to perform our contract with you.
• To keep VegaPal safe and lawful: prevent abuse and fraud, check addresses against sanctions lists, restrict access from sanctioned regions and meet our legal duties. This rests on our legal obligations and our legitimate interest in a safe service.
• To run the business: handle Pro payments and renewal reminders, credit invitations and partner commissions, and answer your messages. This rests on our contract with you and our legitimate interests.
• To understand and improve VegaPal: count visits and see which pages and campaigns work, using totals rather than profiles of individuals. This rests on our legitimate interests.

We do not sell your personal data, and we do not use your documents or your tracked addresses for advertising.

• Service providers: we rely on service providers for hosting, storage, account management and technical operation, to process account data, stored content and the technical information needed to provide and protect the service. They process it only for that purpose. Our hosting provider also sees visitors' IP addresses and approximate location, which we use to restrict access from sanctioned regions.
• Blockchain data providers for each network we read, including public node providers for Ethereum, Polygon and other EVM networks. To check payments and track wallets, we send them the addresses we need to look up: the receiving address of each invoice being checked, each tracked address during its history check, and every tracked address on EVM networks. For transaction ID checks, we send them the transaction ID. They do not get your name or email from us, but they can see which addresses and transaction IDs we ask about. Each network, and what its providers receive, is listed below.
• A bot-protection provider, which runs the bot check on our sign-in and sign-up forms. It receives technical information from your browser, such as your IP address, to tell people from bots.
• Google, through Google Analytics and Google Ads conversion measurement on our site. Our Google tags turn off Google signals and ask Google not to use data from our site to personalize ads. We only send page addresses that are safe to share, never invoice links, transaction IDs, wallet addresses or account data. Google receives your IP address and device details from your browser when these tags load.
• Telegram, if you connect it: alerts pass through Telegram and are stored on its servers.
• Your clients, and anyone else who has the link to a payment page you share: they can see the details on that page, including your payment details.
• Partners: if you signed up through a partner's link, the partner never learns who you are. At most, they see whether the accounts they referred pay for Pro.
• Authorities, courts and our professional advisers, when the law requires it or to protect our rights and our users.

These are the kinds of providers our servers use to read each network, and what they receive. They never receive your name, email or account from us.

• TRON (TRC20): a TRON blockchain data provider. It receives the receiving address of each invoice being checked, each tracked TRON address while we check its past transfers, and the transaction IDs you check.
• Ethereum (ERC20) and Polygon: public node providers. They receive the receiving address of each invoice being checked, every tracked address on these networks each time we look for new transfers, and the transaction IDs you check.
• BNB Smart Chain (BEP20), Arbitrum, Base, Avalanche and Optimism, used only for transaction ID checks when that feature is available: public node providers. They receive only the transaction IDs you check.

Before we read a new network, or send a provider any data that is not listed here, we update this list.

When you check a transaction ID (TxID) or paste a blockchain explorer link, we take only the transaction ID (we never open the link), and our servers ask the data providers of the matching networks about it. The providers receive the transaction ID from our servers, never your name, email, account or IP address.

We keep the results in a lookup cache, so that repeated checks do not ask the providers again. The cache has no link to you, your account or your IP address: we do not keep a record of who checked which transaction ID, and we never log a transaction ID next to an IP address. Our analytics receive only the network and the type of result, never the transaction ID or an address.

To apply daily limits, we count checks per day under a one-way code made from your IP address, a secret key and the date, and per account when you are signed in. These counts do not say which transaction IDs were checked, and we do not store your IP address for them.

A share link contains the network and the transaction ID, so anyone who has the link can see that transaction.

Transfers on TRON, Ethereum, Polygon and other blockchains are public: anyone can see them, and nobody, VegaPal included, can change or delete them. What is private is the link between an address and your VegaPal account, the labels you give it and the documents it appears on. We keep that link private to your account, except on the payment pages you choose to share.

Our providers can process data outside your country, for example in the United States or in the European Union.

• Your account, documents, payment details and tracked wallets: while your account is open. Removing a tracked wallet stops tracking it; its past transfers can stay in your history until your account is deleted.
• When you ask us to delete your account, we delete it and the data linked to it, including documents, tracked wallets, alerts and your Telegram connection, within 30 days. We keep the records the law requires us to keep, such as payment records, for as long as it requires.
• Payment and subscription records: as long as we need them for accounting, tax and legal duties.
• Sign-in dates and visit counts: about 90 days. The random visitor ID stays in your browser for up to 30 days.
• Public blockchain transfers that are not linked to any account may be kept to run the service.
• Backups that protect the service can hold deleted data for a limited time, until they are removed.
• Temporary PDF Studio files are deleted after 24 hours, as the PDF Studio privacy notes explain.
• Transaction ID check results, which have no link to any person, and the daily check counts: as long as we need them to run the checks and their limits.

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy of it, object to or restrict some uses of it, and withdraw a consent you gave. To use these rights, write to info@vega-pal.com from the email address of your account. We answer within 30 days, and we may need to confirm that the request comes from you.

If the law where you live, such as the EU or UK GDPR or Saudi Arabia's Personal Data Protection Law, gives you more rights than this policy describes, we respect those rights. If you are not satisfied with our answer, you can complain to the data protection authority of your country.

Data travels over encrypted connections (HTTPS). Our database rules let each account read only its own data, and only our servers can read shared service data. Administrator actions are recorded. No system is perfectly secure, so please protect your sign-in details too.

We use browser storage to keep you signed in, remember your language and display settings, and run our own visit counter. Google Analytics and Google Ads set their own cookies on our site, and the bot check on our sign-in and sign-up forms may also use browser storage. You can block or delete cookies in your browser, but some parts of VegaPal, such as signing in, need them.

Our own visit counter does not run when your browser sends a Global Privacy Control or Do Not Track signal.

VegaPal is not meant for anyone under 18, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

We will update this policy when our services or the law change, for example before a new feature changes what we collect. The date at the top of this page shows the current version. If a change matters for you, we will tell you on our site before it applies.