Privacy policy

01What we collect

Account: your email address and, if you sign in with Google, your Google account ID. We do not store passwords. One-time sign-in codes are kept only in hashed form, expire after 10 minutes and are delivered by our email provider.

Orders: amounts, rate and fees, the network, your wallet address, the phone number, card number or IBAN you are paid to, transaction hashes and the payment receipts you upload. For OTC orders, also the name and the masked number of your verified card, kept with the order.

Identity verification (only if you use OTC): your first and last name, date of birth, citizenship, phone number and address; the type and number of your identity document and, for citizens of Azerbaijan, your personal identification number (FIN); photos of the document, a selfie holding it and a photo of the front of your bank card; the cardholder name, the bank, and only the first 6 and last 4 digits of the card number. The full card number is checked in your browser and never sent to us, and the card photo must hide the middle 8 digits.

Technical data: your IP address and browser details in server logs, used for security and to limit abuse.

API access requests: if you fill in the form on the "For business" page, the company name, type and country, your name, position, work email and phone number, the expected monthly volume and your message.

02Why we use it

To carry out your orders, to check payments, to verify your identity for OTC, to prevent fraud and money laundering, to meet legal obligations, to evaluate and answer requests for API access, and to answer your other requests. We do not sell your data and do not use it for advertising.

03How we protect it

The photos of your identity document, your selfie and your card, the document number and the personal identification number are stored encrypted. Only 2Pay operators can open them, to review your verification.

04Cookies and storage

We use the 2pay_session cookie, which keeps you signed in, and two cookies that help you sign in: 2pay_login, used with email codes, and 2pay_oauth, which lasts 10 minutes while you sign in with Google. Your browser also stores your language, the bars above the header you closed, the order you are working on (so you can come back to it) and, in the API documentation, the code language you chose. We do not use tracking or advertising cookies.

The 2pay.az website uses no cookies. It keeps only its own settings in your browser, such as your language, the notice bars you closed and your answer to its cookie notice.

05Who sees it

2Pay operators who review orders and identity verifications. The 2Pay team, who review requests for API access. Banks and payment providers that carry out payments. Authorities, when the law requires it. Transactions you make on a blockchain are public by nature.

06How long we keep it

Order records, receipts and identity verification data are kept for as long as anti-money-laundering law requires. Account data is kept while your account exists and then as long as the law requires. API access requests are kept for as long as the business relationship with your company and the law require.

07Your rights

You can ask to see, correct or delete your personal data, within the limits of the law. Contact 2Pay support to make a request.