Privacy Policy

Last updated: 15 June 2026

LongPay (“LongPay”, “we”, “us”) is a non-custodial point-of-sale service operated by Chatbtc Limited, that lets merchants accept Bitcoin (Lightning) and USDT (TRC-20 / ERC-20) payments priced in Hong Kong dollars. This policy explains what personal data we collect, how we use it, and your rights. It applies to our website and apps at longpay.hk.

Non-custodial: payments are sent directly from a customer’s wallet to the merchant’s own wallet address. LongPay never holds, controls, or has access to your funds or private keys.

1. Information we collect

• Account data: your business name, email address, and a securely hashed password (handled by our authentication provider).
• Merchant configuration: the wallet addresses you add (Lightning Address, USDT TRC-20 / ERC-20), shop details, devices, and preferences.
• Transaction data: payment amounts (in HKD and crypto), payment method, status, timestamps, and on-chain/Lightning references needed to detect and record payments.
• Customer information you enter: when you create invoices, tickets, or events, you may add a customer’s name, email, and a description. You are responsible for having a lawful basis to provide this.
• Usage & device data: IP address, device/browser type, and aggregate analytics and performance metrics, used to operate, secure, and improve the service.
• Cookies: a session cookie to keep you signed in (see “Cookies” below).

We do not knowingly collect payment card numbers, government IDs, or private keys.

2. How we use your data

• To create and operate your account and provide the point-of-sale service.
• To generate payment requests/QR codes and detect incoming on-chain or Lightning payments.
• To send transactional emails such as invoices and receipts (only when you choose to).
• To secure the service, prevent abuse, and apply rate limits.
• To analyze and improve performance and reliability.
• To comply with legal obligations.

3. Cookies and local storage

We use a strictly necessary session cookie so you stay logged in, and local storage to remember preferences such as your theme and language. We do not use advertising or cross-site tracking cookies.

4. Service providers we share data with

We share data only with providers that process it on our behalf to run the service:

• Supabase — authentication and database hosting (account and application data).
• Vercel — application hosting, analytics, and performance monitoring.
• Upstash — rate limiting (processes IP addresses).
• Resend / Mandrill — delivery of transactional email (recipient name and email).
• CoinGecko — exchange-rate data (no personal data is sent).
• TronGrid, public Ethereum RPC, mempool.space — public blockchain lookups using wallet addresses (no other personal data is sent).

We do not sell your personal data. We may disclose data if required by law or to protect our rights and users.

5. International transfers

Our providers may process data on servers outside Hong Kong. Where we transfer personal data across borders, we take steps intended to ensure it remains protected consistent with this policy and applicable law.

6. Data retention

We keep your data for as long as your account is active and as needed to provide the service, then for any period required to meet legal, accounting, or reporting obligations. When you delete your account, your account and associated records are removed (see your rights below).

7. Your rights and choices

Subject to applicable law (including the Hong Kong Personal Data (Privacy) Ordinance), you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing.

• Delete your account in-app: Settings → Delete account. This permanently removes your account and associated data (shops, transactions, invoices, events, and saved addresses).
• Or contact us at support@longpay.hk to exercise any of these rights.

8. Security

We use encryption in transit, row-level access controls that isolate each merchant’s data, and other safeguards. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children

LongPay is intended for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date above.

11. Contact

Questions or requests: support@longpay.hk
Chatbtc Limited, Rm 1703-04, 17/F, Tung Chiu Commercial Centre, 193 Lockhart Road, Wan Chai, Hong Kong.