Privacy, for businesses and payers.

Who this section covers

Businesses that use Orrerie Merchant and the people on their teams; the customers of those businesses; and people who pay through an Orrerie checkout at pay.orrerie.com.

Who decides how your data is used

Team members and business details: Orrerie LLC decides why and how they are used (the controller).

A business's customers: the business decides; Orrerie only stores and processes their data on the business's instructions (the processor), under the data-processing terms inside the Merchant Terms.

Paying addresses checked against sanctions lists, and the checkout's security data: Orrerie LLC decides (the controller).

If you are on a business's team

Your sign-in email, encrypted, and a keyed fingerprint of it for finding your account. Why: Sign-in, security notices, records of what you did. Kept: Until you are removed, or 90 days after the account closes.

Your passkeys' public keys, credential ids, authenticator model, counters and the names you give them. Why: Sign-in and confirming changes. Kept: Until removed, or 90 days after the account closes.

Your sessions: time, IP address, browser family and rough place (country and region from the IP address). Why: Security, "new sign-in" notices, the activity log. Kept: 90 days after the session ends.

The encrypted copy of your business's wallet key, which only your passkey (or your wallet password with your browser) can open. Why: So you can unlock it on your own devices. Kept: Deleted when you stop holding a key; every copy 30 days after the account's closure completes.

Your name, role and invitations; a point-of-sale PIN only as a hash. Why: Access control. Kept: Until removed, or 90 days after the account closes.

The activity log of what you did in the dashboard. Why: Security and accountability. Kept: The life of the account and 1 year after it closes; IP addresses in it 12 months.

The passkey's secret never reaches Orrerie: it stays with your device or your password manager, under their terms.

Business verification

Verification is optional; it raises your business's limits. If you start it, Didit (a separate identity company; its privacy notice: https://didit.me/terms/privacy-policy/) collects your company's details, the identity documents of the people who control it and a short face scan, on its own pages. Orrerie receives and keeps only the result: the decision and its reason code, the company's registered details (legal name, registration number, country, company type, incorporation date, registered address, registry status, and whether a tax number exists, never the number), the names, roles, ownership shares and outcomes of the people listed, which documents were provided with their outcomes, whether an AML check found a match (yes or no), and the risk level. Orrerie keeps no identity document, selfie, face scan, face template, date of birth or document number. We keep the verification record while your business is verified and 5 years after the account closes or the verification is replaced; we ask Didit to delete its copy 90 days after a check lapses, is declined and not repeated, is replaced, or the account closes, and Didit deletes anything older than 5 years in any case. If you do not verify, or a check is declined, your account simply keeps its starting limits.

If you are a customer of a business

The business decides what it collects about you (your name, email, postal address, notes) and is the one to ask about it. Orrerie stores it for the business, on its instructions, and the business can delete it at any time. It is deleted 90 days after the business's account closes; orders stay in the business's books without your details.

If you pay through an Orrerie checkout

No identity check, ever. You are never asked for an identity document or a face scan to pay.

The paying address and the transaction are public on the network and permanent. Orrerie links them to the order you paid.

The paying address is checked against sanctions lists: first against a copy of the United States Treasury's list kept by Orrerie (nothing leaves Orrerie for this), then with Scorechain, which receives the address; for large payments, and only if Orrerie has switched it on, Didit and its data supplier Merkle Science also receive it. The result is kept 5 years.

Your IP address and browser family are kept 30 days, for rate limits and abuse control. The checkout sets no cookie.

The checkout asks for no email, and Orrerie sends payers no email. A field the business asks for at checkout, or an email the business gives Orrerie with the order for its own records, is kept with the order (removed 90 days after the business's account closes).

"Report this business" keeps only the reason you chose from a fixed list, the page and the time: no email, no address and no free text. It is kept 2 years after the case closes.

If you pay with the Orrerie app (Pay with Orrerie)

The app fetches the order from Orrerie and shows it to you before you pay; Orrerie links your payment to the order. The business is not told who you are: it sees the paying address and the transaction only, never your Orrerie identity, email or handle. If you close the order in the app without paying, or the app cannot tell whether your payment went out, it tells Orrerie only that, so the business's checkout page can say so; it sends nothing else about you. If the business refunds an order you paid this way and Orrerie knows no wallet of yours to send it to, Orrerie tells your phones; when you tap the notice, the app asks Orrerie for that refund's link, which opens in your browser so you can say where to receive it.

Relay

When you pay in another asset or on another network, the deposit address and the routing are provided by Relay, a separate company. Relay receives the networks, assets, amounts and addresses of the route, and holds the funds in transit until it delivers them.

What cannot be deleted

When a business closes, or when you ask us to delete something, some things stay where they are, because nobody can remove them: anything recorded on a public blockchain (payments, refunds and payouts, with their addresses and transaction ids) stays there for ever; what Relay and Didit hold is kept under their own retention (Relay's notice; Didit deletes a verification when we ask it to and anything older than 5 years in any case); and a business's wallets exist as long as their keys do. Money sent to an old payment address after a business closed still reaches that business's wallet, and Orrerie no longer sees or reports it.

Your rights and requests

Use the existing Privacy Requests page to see, correct or delete what Orrerie holds about you. If you are a customer of a business, ask the business first: it decides about your data, and we help it answer you.

Where your data is processed

As for the rest of Orrerie: Orrerie LLC is established in the United States, and hosting, communications, blockchain, verification and screening providers can process this information in other countries where their infrastructure operates, where the law can differ from yours. What each provider receives is listed in the Providers document; where an international transfer needs a legal safeguard, that requirement applies to our use of the service.

Every piece of personal data, why it is held, who else receives it and how long it is kept

Sign-in email (encrypted, plus keyed hash). Whose: Member. Why held: Sign-in, security notices, receipts of actions. Who else receives it: The email-sending provider. Kept: Until removed, or 90 days after the account closes.

Passkey public key, credential id, AAGUID, counter, flags, a name. Whose: Member. Why held: Sign-in and step-up. Who else receives it: None. The passkey's secret stays with the device or its password manager (Apple, Google, Microsoft, 1Password and similar), under their terms. Kept: Until removed, or 90 days after the account closes.

Session records: time, IP address, browser family, rough place (country and region from the IP address). Whose: Member. Why held: Security, "new sign-in" notices, the activity log. Who else receives it: None. Kept: 90 days after the session ends; IP addresses in the activity log 12 months.

Encrypted merchant seed blob. Whose: Merchant. Why held: So the browser key can be unlocked on any of the member's devices. Who else receives it: None. Unreadable by Orrerie. Kept: Deleted when the member loses the key-holding role; all copies 30 days after closure completes.

Business profile: display name, legal name, country, business type, what is sold, website, support email, refund policy link, logo. Whose: Merchant. Why held: Running the account, the checkout, AUP review. Who else receives it: Shown to payers (display name, logo, support email, policy link, tier mark); legal name only on invoices and receipts if the merchant chooses. Kept: Until removed, or 90 days after the account closes.

Verification record and consent. Whose: Merchant, its key people. Why held: Tier decision, proof a check was done. Who else receives it: Didit holds everything else (documents, pictures, face scans, dates of birth, match details) as Orrerie's processor. Kept: While verified and 5 years after the account closes or the verification is superseded.

Team: member names, roles, invitations, POS PIN hash. Whose: Members. Why held: Access control. Who else receives it: Other members of the same merchant. Kept: Until removed, or 90 days after the account closes.

Customers: name, email, optional postal address, notes, wallets seen, credit. Whose: Merchant's customers. Why held: The merchant's own records, invoices, receipts, subscriptions. Who else receives it: The merchant's members by role; the email provider when a receipt or invoice is sent. Kept: Until the merchant deletes them or 90 days after the account closes.

Orders, payments, refunds, payouts, ledger: amounts, times, public addresses, transaction ids. Whose: Merchant; payers by address. Why held: The service itself; the merchant's books. Who else receives it: Relay receives the merchant's wallet address, the payer's chosen network and asset and the amount when an instruction is made; RPC and indexing providers receive public addresses and transaction ids in reads; swap venues for conversions; SideShift additionally the member's public IP address. Kept: While the account is open and 5 years after it closes.

Fields the business asked for at checkout, or an email the business gave with the order; the checkout asks for no email. Whose: Payer. Why held: The merchant's order. Who else receives it: The merchant. Kept: With the order while the account is open; removed 90 days after the account closes.

Checkout visitor IP address and browser family. Whose: Payer. Why held: Rate limits and abuse control. Who else receives it: None. Kept: 30 days.

Screening records: public address, network, result, list version. Whose: Payer; address owners. Why held: Sanctions control; proof a check ran. Who else receives it: Scorechain receives the address (L2); Didit and its data supplier Merkle Science receive it if L3 is used; L1 sends nothing out. Kept: 5 years.

Pay with Orrerie link: which Orrerie app account paid which order. Whose: Payer (an app user). Why held: Matching the payment; the payer's own Activity. Who else receives it: not the merchant: the merchant sees the paying address and transaction only, never the payer's Orrerie identity, email or handle. Kept: With the order (as P9).

API request log, webhook delivery log. Whose: Merchant; customers inside bodies. Why held: Debugging by the merchant. Who else receives it: None. Kept: 30 days; delivery metadata (status, time) 90 days.

Activity log. Whose: Members. Why held: Security and accountability. Who else receives it: The merchant's Owners and Admins. Kept: Life of the account and 1 year after closure.

"Report this business": one reason from a fixed list, the page and the time (no email, no address, no free text). Whose: Payers, public. Why held: Abuse handling. Who else receives it: None. Kept: 2 years after the case closes.

Support messages. Whose: Whoever writes. Why held: Support. Who else receives it: The email provider. Kept: 2 years after the conversation ends.

Emails sent: recipient, kind, time (not the body). Whose: Members, customers. Why held: Proof of notice, delivery debugging. Who else receives it: The email provider. Kept: 30 days after sending.

Which Orrerie app account holds a business's recovery key: the app account and the merchant account (opaque ids), the key's generation and when it was confirmed. Whose: Members (as app users). Why held: So a phone restored from its words lists the Business recovery keys it holds. Who else receives it: No one: Orrerie's gateway keeps it, apart from the merchant service, and reads the business's name live from the business's own co-signer. Kept: Until the key is replaced, the business closes or the app account is deleted.

What is never collected

Identity documents of payers; a payer's name unless the business asks for it; advertising identifiers; tracking cookies; analytics about people; contact lists; precise location.

Providers for Orrerie Merchant and Orrerie Pay

Didit. Role: Business verification for Orrerie Merchant (optional); wallet screening if switched on. What it receives: Company details, identity documents and face scans of the people a business lists, on Didit's own pages; a paying address and network if wallet screening is switched on. Their notice: https://didit.me/terms/privacy-policy/.

Merkle Science (through Didit). Role: Data supplier of Didit's wallet screening, only if it is switched on. What it receives: A paying address and network. Their notice: Didit's notice.

United States Treasury sanctions list. Role: A file Orrerie downloads every 6 hours; nothing is sent to it. What it receives: Nothing. Their notice: https://ofac.treasury.gov.

Scorechain (extended). Role: Sanctions check of payers' addresses and of payout destinations for Orrerie Merchant, beside the wallet's own use. What it receives: A public address. Their notice: Scorechain's notice.

Relay (extended). Role: Deposit addresses and routing for Orrerie Pay checkouts, beside the wallet's own use. What it receives: Networks, assets, amounts and addresses of each route; holds funds in transit. Their notice: Relay's notice.

What the merchant sites store

merchant.orrerie.com. What is stored: One session cookie (__Host-ms, HttpOnly, Secure, SameSite=Strict, 12 hours at most, ended after 2 hours idle); in local storage the Test mode switch and which Home blocks you dismissed; in this tab's session storage, for at most 12 hours, what you typed into a form when your session ended (never a password, code or key); and in the browser's database the encrypted channel's key for this browser and, for a member who uses one, the wallet password's device secret, the backup check and a one-time pairing key (24 hours at most). None of these keys can be read out of the browser. Why: Sign-in; the encrypted channel; unlocking your own key; the dashboard's own settings.

pay.orrerie.com. What is stored: No cookie. In local storage the language you chose and, on a paired point-of-sale device, that device's pairing (which opens nothing); in this tab's session storage, while you pay, one random key of this visit to the checkout, so a reload keeps your place; it opens nothing alone and is removed once the payment link is used or refused, or the order ends. Why: Your language; a till's pairing; a reload while your payment confirms.