Privacy
Our data policy, in plain English.
XMRgate is built around a single principle: we shouldn't see things we don't need. This page documents the principal data categories we store, what we avoid, and the measures used to minimize collection. Implementation-specific security and operational records may also be processed as described below.
What we never store
- Raw payer IP addresses in payment records
- Payment-card numbers or bank credentials
- Plaintext merchant passwords or secret API keys
- Payer names or shipping addresses required by XMRGate as a condition of checkout
- Private wallet keys in public frontend bundles
Principal data we store
- Merchant ID
- Coin type
- Amount received
- Timestamp
- On-chain TX hash (public by nature)
- One-way IP security hash and limited request metadata for abuse controls
- Optional merchant-supplied customer reference or receipt email when an integration uses it
- Merchant account, authentication, webhook, and payout configuration data
- Per-merchant customer profiles and checkout metadata supplied by an integration
- Webhook secrets plus bounded delivery response data needed for signing, retry, and audit
How we enforce it
Invoice auto-expiry
Invoices expire 30 minutes after creation by default. Merchants can tune this per integration.
Hashed API keys
Keys are stored as bcrypt hashes. We cannot recover a plaintext key — even with full DB access.
Limited analytics
Operational analytics are limited to service reliability, fraud prevention and product performance needs.
Release-gated infrastructure
Payment creation and withdrawals remain disabled until each enabled mainnet rail completes funded canaries.
Deployment verification
The intended production deployment uses EU infrastructure and restricted service roles. Region, bindings, backups, and effective access controls require operator verification.
Payout address separation
Buyer deposit addresses, platform balances and merchant payout addresses are tracked separately for clearer accounting.
Wallet recovery boundary
Authorized operator recovery endpoints may expose decrypted wallet material when explicitly used. Dedicated wallet-key separation remains pending before funded launch.
An honest caveat about public chains
Bitcoin, Ethereum, Litecoin and stablecoins on those networks are permissionless and public. Anyone can inspect them. Our data-minimization policy covers XMRGate's own infrastructure — it does not change the public nature of those blockchains. Monero provides protocol-level transaction privacy, but XMRGate and merchants may retain account, invoice, timing, customer-reference, IP-security-hash, and operational metadata.
Apply for access