Legal

Privacy Policy

Last updated: October 26, 2026
Platform Architecture: Paye operates in two distinct modes: Bring Your Own Keys (BYOK) Mode, where Paye acts as a high-availability proxy and routing middleware with zero custody of funds, and Managed Mode, where Paye provides unified checkout and ledger tracking in partnership with licensed payment processors.

1. Introduction

Paye ("we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of developers, merchants, and their customers. This Privacy Policy describes how we collect, store, process, and protect information across our platform, APIs, developer dashboards, and checkout interfaces (collectively, the "Services").

2. Information We Collect

Depending on how you use our Services (BYOK Mode or Managed Mode), we collect the following categories of information:

  • Account Credentials: Full names, business names, email addresses, hashed passwords, and session identifiers required to authenticate your account and project workspace.
  • Payment Processor Credentials (BYOK Mode): Upstream payment processor API keys (e.g. Paystack, Flutterwave) provided by you to authorize Paye to route transactions through your own processor accounts.
  • Settlement & Compliance Data (Managed Mode): Bank name, bank code, NUBAN account number, and verified account holder name for disbursing settlements; regulatory business identification records (such as CAC registration numbers or ID verification) required for higher-tier volume limits and anti-money laundering (AML) compliance.
  • Transaction Metadata: Payment references, amounts, currencies, customer email addresses, provider routing choices, HTTP status codes, latency timings, and webhook delivery records.
  • Technical & Telemetry Data: IP addresses, user agent headers, API request payloads, and audit logs used for security monitoring, anomaly detection, and schema drift prevention.

Payment Card Details: Paye does not collect, handle, or store full credit or debit card numbers (PANs) or CVVs. Customer card processing is executed directly by PCI-DSS certified upstream payment processors within secure hosted frames.

3. Data Protection and Security Standards

Security is fundamental to our infrastructure architecture:

  • Encryption at Rest: All processor secret keys, integration secrets, and sensitive tokens are encrypted using AES-256-GCM authenticated encryption before persistence.
  • Encryption in Transit: All data transmitted between your applications, our APIs, upstream gateways, and client browsers is encrypted using TLS 1.3.
  • In-Memory Processing: In BYOK Mode, processor credentials are only temporarily decrypted in memory during active transit requests to execute failover routing and are never logged in plaintext.
  • Access Control: We enforce strict role-based access control (RBAC), scoped API keys, and environment isolation between Live production and Sandbox test workspaces.

4. How We Use Your Information

We use collected information solely for operational and compliance purposes:

  • To route payment requests intelligently across supported African payment rails with automated failover.
  • To maintain unified merchant ledgers, track pending and available balances, and disburse settlements in Managed Mode.
  • To authenticate API calls, detect schema drift, and prevent fraudulent or unauthorized access.
  • To provide transaction analytics, fee savings metrics, and audit logs in your dashboard.
  • To comply with statutory financial regulations, including KYC/AML tier limits and fraud prevention.

5. Data Sharing and Third-Party Processors

We do not sell, rent, or monetize your personal or transaction data. We share information only with:

  • Licensed Payment Processors: Such as Paystack and Flutterwave, strictly to execute payment collection, bank account resolution, and payout transfers requested by you or your customers.
  • Legal & Regulatory Authorities: When required by enforceable court orders, applicable Nigerian laws, or binding regulatory mandates.

6. Data Retention and Account Deletion

We retain account metadata and transaction log history for as long as your project is active to support reconciliation, audit requirements, and legal obligations. When you remove a processor key or delete a project, the associated integration keys are instantly and permanently purged from our databases.

7. Merchant and Customer Rights

Under applicable data protection regulations (including the Nigeria Data Protection Act - NDPA), you have the right to access your stored data, request corrections, export transaction ledgers, or request account closure. Requests can be submitted directly through the dashboard or by contacting our security team.

8. Updates to This Policy

We may periodically update this Privacy Policy to reflect platform enhancements or regulatory changes. Significant changes will be announced on our website and in the merchant dashboard.

9. Contact Us

If you have questions about this Privacy Policy or our data protection practices, please contact us at support@paye.africa.