Privacy Policy
Last updated 1 October 2026
1. Who is responsible#
For your account data, Muny is the data controller. For the data of a business's customers that passes through Muny's checkout (for example a buyer's email on an order), that business is the controller and Muny processes the data on its behalf — see section 6. Contact our privacy team at privacy@muny.io.
2. Data we collect#
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, password (stored only as a salted hash), email-verification status, accepted Terms version | You |
| Business | Organisation name, team members and roles, invitations, settings, receiving wallet, API key names (keys stored only as hashes) | You |
| Wallet & transactions | Public wallet addresses, amounts, references, transaction signatures, payment and payout history | You, the Solana blockchain |
| Payment details | For checkout: customer email/name if the business collects them, order reference, metadata the business attaches | Businesses, their customers |
| Device & app | Device platform and name, app version, push-notification token | Muny Wallet app |
| Security & usage logs | IP address, user agent, request IDs, sign-in sessions, audit log of business actions, API request logs | Automatically |
| Communications | Emails we send you (sign-in links, receipts, notifications) and your messages to us | You, us |
We never collect your private keys or recovery phrase. In the Muny Wallet app they are created and stored only on your device. We don't currently collect identity documents; if we introduce identity or business verification we will update this policy first.
3. Why we use it (and legal bases)#
| Purpose | Legal basis |
|---|---|
| Create and run your account; process payments, payouts and transfers you request; send transactional emails | Contract |
| Verify payments on the blockchain; send webhooks and notifications you configure | Contract |
| Keep the Services secure; detect and prevent fraud, abuse and sanctions violations; enforce our Terms | Legitimate interests; legal obligation |
| Keep financial and audit records; respond to lawful requests | Legal obligation; legitimate interests |
| Improve and support the Services; answer your questions | Legitimate interests |
Some payouts or payments may be held for human review by automated risk rules (for example an unusually large first payment). These rules don't make final decisions with legal effect on their own; a person reviews held items. You can ask us about a decision at privacy@muny.io.
4. The blockchain is public#
Payments and payouts settle on Solana, a public blockchain. Wallet addresses, amounts and timestamps are visible to anyone and cannot be changed or deleted — by us or anyone else. Don't put personal information in payment memos. Deleting your Muny account removes your personal data from our systems but not from the blockchain.
5. Who we share data with#
We share personal data only as needed to run the Services:
| Recipient | Purpose | Location |
|---|---|---|
| HostHatch | Server hosting (database, application) | Netherlands (EU) |
| Twilio SendGrid | Sending transactional email | United States |
| Helius | Solana RPC access (reads and submits public blockchain transactions) | United States |
| Businesses you pay or that pay you | Payment details needed to complete or reconcile your payment | Varies |
| Authorities | When required by law, or to prevent fraud or protect rights and safety | Varies |
If Muny is reorganised, merged or sold, data may transfer to the successor under this policy. We don't sell personal data or share it for advertising.
International transfers
Some providers process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. When we act for a business (processor)#
When a business uses Muny's checkout, payment links or webhooks, we process its customers' data (for example an email for a receipt) on the business's instructions and under our Business Terms. If you bought from a business through Muny, contact that business about your data; we will help them respond.
7. How long we keep data#
| Data | Retention |
|---|---|
| Account and business data | While your account is open; deleted or anonymised when you delete your account |
| Transaction and payment records | Kept as financial records for as long as the law requires (typically 5–10 years), detached from deleted accounts |
| Sign-in sessions | Up to 30 days, removed 7 days after expiry |
| API request logs and webhook delivery logs | 90 days |
| Sign-in and email-confirmation links | Expire after 15 minutes / 24 hours; purged shortly after |
| Audit logs of business actions | While the organisation exists, to protect it and meet legal duties |
| Public blockchain data | Permanent — outside our control |
8. Security#
We use encryption in transit (HTTPS), hashed passwords and API keys, encrypted webhook secrets, rotating sign-in tokens, rate limits, access controls and audit logs. No system is perfectly secure; please report vulnerabilities as described on our Security page.
9. Your rights#
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy (portability);
- correct inaccurate data;
- delete your data — you can delete your account yourself in Settings or the Muny Wallet app;
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent where we rely on it;
- complain to your data-protection authority.
Email privacy@muny.io from your account email to make a request. We respond within 30 days and may need to verify your identity. Some data must be kept for legal reasons even after a deletion request (for example transaction records).
10. Cookies#
We use only the cookies needed to keep you signed in — no analytics or advertising cookies. See the Cookie Notice.
11. Children#
Muny is not for people under 18, and we don't knowingly collect their data. If you believe a minor has an account, contact privacy@muny.io.
12. Changes#
We will post updates here and change the “Last updated” date. For material changes we will notify you by email or in the Services before they take effect.