Data in the implemented application
Authenticated workflows can process account identity, merchant/project membership, order references, amounts, payment/refund state and audit records. Optional customer fields can include name, email and phone; merchant metadata may also contain business data. Do not place sensitive payment credentials in metadata.
Browser and session behavior
The dashboard uses authenticated sessions and CSRF protection. Browser session storage retains workspace context such as merchant, actor, environment and selected project. The public pages do not require sign-in or fetch merchant session data. Copy buttons use the browser clipboard only after an explicit click; this site adds no analytics SDK or enquiry submission form.
Purposes, sharing and retention
The final notice must identify the legal controller, lawful bases where applicable, actual hosting/processing recipients, retention periods, international transfers, deletion processes and security commitments. Those details have not been verified for commercial publication.
Choices and requests
The owner must publish a verified privacy contact and a process for access, correction, deletion and complaints under applicable requirements. No unverified contact address or response-time promise is presented here.
Payment information
Merchant server secrets and signing secrets must remain private. Hosted payment/authentication screens may have separate mandatory disclosures. This draft does not promise that required external branding or processing disclosures are invisible.