Legal

Privacy Policy

How BAXPAY SARL processes personal data under the GDPR across personal, business, freelancer, POS, SoftPOS, shops, and APIs — including biometrics, settlements, and your rights.

Please read carefully.

These documents describe how BAXPAY SARL operates BaxPay during open beta. They are written for transparency and GDPR accountability. They are not personal legal advice and are not a substitute for counsel-approved contracts. If anything here conflicts with a signed agreement between you and BaxPay, the signed agreement prevails for that relationship. For questions: [email protected] (privacy) or [email protected] (general).

Effective date: 18 July 2026 · Last updated: 3 November 2026

1. Who is responsible for your data

The data controller for BaxPay services is BAXPAY SARL, a French limited liability company (société à responsabilité limitée), registered with the R.C.S. Lille Métropole under number 979 498 706, with a share capital of €7,500, whose registered office is at 679 Avenue de la République, 59800 Lille, France.

Trade name: BaxPay. Contact: [email protected] · +33 9 80 80 95 80.

For data-protection matters contact [email protected]. We respond within Articles 12–15 GDPR time limits (generally one month, extendable by two further months for complex requests, with notice of any extension).

How our systems work

Controller: BAXPAY SARL — RCS Lille Métropole 979498706
Address: 679 Avenue de la République, 59800 Lille, France
Data protection contact: [email protected]

2. Scope of this notice

This Privacy Policy applies to: (a) the marketing website baxpay.com; (b) the BaxPay personal web and mobile applications; (c) BaxPay Business and Freelancer dashboards and mobile apps (including SoftPOS / Tap to Pay where enabled); (d) hosted payment pages, payment links, and online shops on BaxPay domains (including pay.baxpay.com and {shop}.baxpay.com); (e) the BaxPay POS application on payment terminals and Apps-on-Devices hardware (Stripe Terminal S700/S710 and Ciontek devices); (f) the developers portal and public APIs; and (g) related support channels operated by BAXPAY SARL.

Internal admin tools used by BaxPay staff process the same categories of data under access controls and audit logging; they are not a separate consumer product.

It does not cover third-party websites or services we do not control (for example your accounting software after data is exported, or a card scheme’s own notices). Merchants who accept BaxPay often act as independent controllers for their shoppers for their own purposes (receipts, loyalty, CRM) — their notices apply in addition to ours for those purposes.

3. Roles: controller, processor, and merchant of record

For your BaxPay account, KYC/AML files we hold, biometric templates in our biometric module, settlements we calculate, and platform communications, BAXPAY SARL is typically the controller (or joint controller with a regulated partner where required by that partner’s model).

Card acquiring on BaxPay Business / Freelancer is provided with Stripe as payment partner under Stripe Connect (platform / connected-account model). On card-present and most online charges, the merchant is generally the merchant of record toward the shopper; Stripe processes card data as a PCI DSS–certified provider; BaxPay provides software, onboarding, reporting, and settlement orchestration. Exact roles can vary by product (for example platform-collected fees or hardware shop checkout on BaxPay’s Stripe platform account).

When a merchant connects Pennylane, QuickBooks, Sage, or similar, the merchant authorises that ERP as a separate controller/processor of the exported data under the ERP’s terms.

Shoppers paying a merchant may have a relationship with that merchant as controller for the purchase; BaxPay and Stripe process payment data as needed to complete the transaction and fight fraud.

4. Categories of personal data we process

Depending on how you use BaxPay, we may process:

Identity and contact data — name, email, phone, date of birth, nationality, postal address, language preference.
Account and authentication data — credentials, MFA/passkey metadata, session identifiers, device binding signals.
KYC / AML / KYB data — government ID images and extracted fields, proof of address, liveness or similar checks where used, sanctions/PEP screening results, company documents, ultimate beneficial owners and representatives for businesses and freelancers.
Financial and payment data — IBAN and account identifiers, transaction amounts, currencies, beneficiaries, card tokens and last-four / brand (we aim not to store raw PANs; card data is tokenised at capture where possible), payout bank details, application fees.
Biometric data — ISO/IEC 19794-2 fingerprint minutiae templates (special category under Art. 9 GDPR). Never raw fingerprint images.
Merchant operations data — locations/stores, products and catalog, inventory movements, clients/CRM records, invoices and e-invoices, payment links, online-shop orders, till sessions, tips and tip attribution, team members and roles.
Workforce / team data (Business) — staff name and email, role, location assignments, hashed till PINs, optional salary-advance records, expense-card holder references when Issuing is enabled.
Settlement and risk data — eligibility and hold status, Instant payout level, trust signals, dispute/refund linkage.
Device and technical data — IP address, user-agent, device identifiers, approximate location from IP for fraud/security, app version, hardware profile, logs.
POS terminal diagnostics — crash reports, performance traces, and (only if the merchant enables them) aggregate usage analytics. Excludes cardholder data, PANs, PINs, auth codes, and biometric templates.
Communications — support tickets, emails, SMS delivery metadata, call notes.
Waitlist and marketing leads — email and related signup fields before an account exists.
Marketing preferences — consent status and opt-outs.

How our systems work

Data	Purpose	Lawful basis	Retention (typical)
Account data — name, email, phone	Create and operate your account	Art. 6(1)(b) contract	Account life + up to 5 years
Transaction & settlement records	Execute payments; accounting; payouts	Art. 6(1)(b); Art. 6(1)(c) legal obligation	Up to 10 years (accounting)
E-invoices / tax documents	Electronic invoicing & statutory books	Art. 6(1)(c); Art. 6(1)(b)	≥ 10 years (French commercial/tax rules)
KYC / AML / KYB documents	Customer due diligence	Art. 6(1)(c) legal obligation	5 years after relationship ends
Fingerprint templates	Identify you at a BaxPay terminal	Art. 6(1)(a) + Art. 9(2)(a) explicit consent	Until consent withdrawn
Team / till / tip attribution	Operate shared tills; merchant HR/reporting	Art. 6(1)(b) (merchant contract); Art. 6(1)(f) where staff are data subjects	Account life + applicable labour/tax retention
Device & fraud signals	Security and fraud prevention	Art. 6(1)(f) legitimate interests	Up to 5 years
POS crash & performance	Terminal reliability	Art. 6(1)(f)	Per Firebase (crashes often ≤ 90 days)
POS optional analytics	Improve POS UX — merchant opt-in	Art. 6(1)(a) consent	Until withdrawn; Analytics retention per Google
ERP OAuth tokens & sync logs	Push/pull catalog & accounting data	Art. 6(1)(b); merchant instructions	While connection active + short logs
Waitlist leads	Invite / launch communications	Art. 6(1)(a) or 6(1)(f) pre-contract	Until invite cycle ends or erasure
Audit & security logs	Security and accountability	Art. 6(1)(c) / 6(1)(f)	Up to 7 years
Marketing email	News and offers (where you opted in)	Art. 6(1)(a) consent	Until withdrawal + proof period
Marketing email measurement	Whether marketing emails are opened and which links are clicked (see §16)	Art. 6(1)(a) consent, given with marketing consent	Until withdrawal; kept with the email delivery log
Product update emails and push	New features and changes to the service you use	Art. 6(1)(f) legitimate interests (opt out anytime)	While the account is open
Service and legal notices	Notices you must receive (security, Terms, fees) and proof they were sent	Art. 6(1)(b) contract and 6(1)(c) legal obligation	Account life + 5 years

5. Biometric data — what is actually stored

Fingerprint data is special-category personal data under GDPR Article 9. This section states how the system is built today.

How our systems work

The raw fingerprint image is never stored, and never transmitted to BaxPay: The image is processed on the capture device. Minutiae are extracted there; the image is discarded there.
What is stored is an ISO/IEC 19794-2 minutiae template: A mathematical description of ridge features — not a photograph. A picture of your finger cannot be reconstructed from the template.
Templates live in a dedicated biometric module: Encrypted at rest (AES-256-GCM), separate from the core payments ledger. The payments API stores linkage metadata (e.g. identity references), not template bytes.
Lawful basis is your explicit consent: GDPR Art. 6(1)(a) and Art. 9(2)(a). You may decline biometric payment and use another method.
Withdrawing consent erases biometric templates: Templates, derived embeddings, and search-index entries are deleted. They are not kept under a statutory carve-out once consent is withdrawn.
A data export will not contain protected template bytes: An Art. 15/20 export confirms existence and metadata but does not export protected template bytes.

6. Purposes of processing

Provide, secure, and improve BaxPay accounts, wallets (where available), cards, transfers, payment links, online shops, invoicing, terminals, SoftPOS, and developer APIs.
Perform Strong Customer Authentication (SCA) and payment authorisation consistent with PSD2 where applicable.
Onboard users and merchants (KYC/KYB), screen for AML/CFT risk, and meet accounting, tax, and supervisory obligations under French and EU law.
Orchestrate settlements and Instant payouts under BaxPay-controlled eligibility while Stripe Connect payout schedules remain manual where configured.
Detect, prevent, and investigate fraud, abuse, chargebacks, and security incidents.
Enable merchant team collaboration (roles, locations, tills) and optional tip attribution for the merchant’s own reporting.
Sync catalogs and documents to ERPs the merchant connects; send transactional email/SMS (receipts, OTPs, invites).
Books (pre-accounting): when a merchant adds an invoice, receipt, or transfer proof paid outside BaxPay, read the document automatically to pre-fill its date, amount, VAT, supplier or customer, and a suggested category, which the merchant checks before saving.
Operate and secure POS terminals (crash/performance diagnostics); with merchant consent, measure aggregate POS usage.
Respond to support requests and send service-critical notices.
Send product updates about the service you use (opt out anytime) and, with consent, news and offers and measurement of whether those emails are opened and clicked; withdraw anytime (see §16).
Produce anonymised or aggregated statistics that no longer identify you.

7. Legitimate interests

Where we rely on Article 6(1)(f), our interests include: securing the platform; preventing fraud and money laundering (beyond minimum legal steps where proportionate); ensuring network and information security; keeping payment terminals reliable; defending legal claims; and limited B2B product improvement that does not override your rights.

You may object under Article 21. We will stop unless we demonstrate compelling legitimate grounds or need the data for legal claims. Fraud, AML, and security processing will often meet that threshold.

8. Recipients and processors

We share personal data only as needed with categories of recipients below. A current subprocessor list can be requested from [email protected].

OVHcloud (France / EU) — Kubernetes hosting, managed PostgreSQL, Redis, container registry, and object storage for application data and documents.
Stripe, Inc. / Stripe Payments Europe, Limited — Connect acquiring, Terminal, webhooks, Identity/KYC file handling where used, Issuing (when enabled), Billing for BaxPay plans, and related fraud tools. See Stripe’s privacy notices and Connect/Terminal terms.
Google Ireland Limited / Google LLC — Firebase Crashlytics, Performance Monitoring, and (merchant opt-in only) Analytics on BaxPay POS, under Firebase Data Processing Terms / SCCs.
BaxCloud / BaxMail — email delivery for BaxPay (account emails, service notices, product updates and, with consent, marketing), including open and click measurement for marketing emails you consented to.
Telnyx — SMS delivery for OTPs, payment-link shares, and similar transactional messages.
OpenAI (OpenAI Ireland Limited / OpenAI, L.L.C.) — automatic reading of the invoices, receipts, and transfer proofs merchants upload to Books, to pre-fill the operation for review. OpenAI acts as our processor under its Data Processing Addendum; documents sent through its API are not used to train its models and are kept by OpenAI only for a limited period for abuse monitoring. These documents can contain names, addresses, invoice details, and partial payment details of the merchant’s suppliers or customers. Merchants who prefer not to use automatic reading can enter operations by hand.
ERP providers you connect (e.g. Pennylane, Intuit QuickBooks, Sage) — under your authorisation and their terms.
Professional advisers under confidentiality; competent authorities (e.g. Tracfin, CNIL, courts, tax authorities) when required by law.
Optional or future banking/BaaS partners (e.g. Treezor or successors) if and when those rails go live for IBANs/transfers — we will update this notice before relying on them for production personal data.

How our systems work

Primary hosting posture: French / EU sovereign cloud (OVH), with biometric templates not transferred outside the EU
Card data: Tokenised / handled in Stripe’s PCI scope — not stored as raw PAN in BaxPay databases

9. International transfers

Personal data is processed primarily in the European Union (OVH France and EU regions we configure).

Some processors (notably Google Firebase diagnostic telemetry, OpenAI document reading for Books, and certain Stripe or communications flows) may involve transfers outside the EEA, in particular to the United States. Where that happens we rely on an adequacy decision and/or appropriate safeguards such as the EU Standard Contractual Clauses, plus supplementary measures where required.

Biometric templates are not transferred outside the EU.

If you connect a US-hosted ERP (e.g. QuickBooks), your authorisation may cause transfers governed by that provider’s terms; review them before connecting.

10. SoftPOS, payment links, and online shops

Business / Freelancer mobile SoftPOS (Tap to Pay) and related phone-as-terminal features process device integrity signals, location permissions you grant, and payment session data needed for NFC contactless acceptance where the capability is enabled for your account and country.

Payment links and hosted checkout collect payer contact details you or the payer provide (name, email, phone), order/line items, and payment status. Online shops on BaxPay subdomains process catalog, cart, and order data for guest or identified buyers.

We retain checkout and order records as transaction/accounting data. Abandoned checkout attempts may be purged on a shorter schedule for noise reduction and security.

11. Merchant teams, locations, and tips

Business accounts may invite team members, assign locations (stores), and operate shared tills. We process staff identity and access data to provide that service. The merchant remains responsible for informing staff under employment/privacy rules where applicable.

Tips entered on POS or register flows are attributed for the merchant’s reporting; default tax treatment in product copy treats tips as outside merchandise VAT — this is not tax advice. Tip amounts form part of payment records.

Till PINs are stored hashed. Do not reuse personal banking passwords as till PINs.

12. Settlements, Instant payouts, and balances

We process settlement eligibility, holds, disputes, refunds, and payout bank details to pay merchants under BaxPay-controlled settlement policies while Stripe Connect payout schedules remain manual where configured.

Balances on connected accounts are not a safeguarded “e-money wallet” or escrow product described as such in this notice; they are acquiring balances subject to partner and scheme rules. Instant payout eligibility may use risk/trust signals and caps.

You can read operational detail in-product; legal consequences of holds and payouts are also described in our Terms of Service.

13. Electronic invoicing

Where e-invoicing features are enabled, we process invoice content (buyer/seller identity, line items, VAT, attachments) to generate compliant documents (e.g. Factur-X / EN 16931 paths) and, when configured, to exchange with partner platforms or public annuaires.

Invoice and bookkeeping records are retained for at least ten (10) years where French commercial/tax rules require, even after an erasure request for other account data — we then restrict use to legal retention.

14. Accounting / ERP integrations

If you connect an ERP, we store OAuth tokens and synchronise products, clients, and/or accounting entries as you configure. Sync logs may include object identifiers and error messages.

Disconnecting the integration stops new syncs; data already in the ERP remains under that provider’s control. BaxPay is not responsible for the ERP’s security or retention.

15. BaxPay POS terminals (Apps on Devices)

The BaxPay POS application runs on merchant-controlled payment terminals (Stripe Terminal Apps-on-Devices and Ciontek devices).

We use Google Firebase Crashlytics and Performance Monitoring for stability. Legal basis: Article 6(1)(f) legitimate interests — integrity of payment acceptance on the merchant device. Disclosed in Settings.

Optional Firebase Analytics is off by default; enable “Share usage analytics” in POS Settings (Art. 6(1)(a)). Withdraw by turning the setting off. No advertising identifiers.

Cardholder data and biometrics are not sent to Firebase. Custom diagnostic keys are limited to non-sensitive app/hardware metadata.

16. Emails, notifications, and email measurement

We send three kinds of messages to account holders, and each follows its own rule:

Email measurement. Marketing emails may contain a 1×1 image and links routed through our email provider (BaxCloud / BaxMail), so that we know whether an email was opened and which links were clicked. We use this only to see which messages are useful and to send fewer that are not; we do not use it for advertising or share it with advertisers. It is covered by your marketing consent and stops when you withdraw it. Account, security, and payment emails, service notices, and product updates are never measured this way, and unsubscribe links are never redirected.

Open measurement is approximate: some mail apps load images automatically. You can prevent it by turning off automatic image loading in your mail app.

Undeliverable addresses. If an email to your address bounces, our provider reports it and we stop sending product updates and marketing to that address. Important account notices are then shown in the app instead.

Service and legal notices — security alerts, payment confirmations, and changes to our Terms, this policy, or our fees. They go to every account concerned because they are needed to provide the service or required by law (Art. 6(1)(b) and (c) GDPR), so they cannot be switched off. We keep a record of who was sent each notice and when.
Product updates — new features and changes to the service you use, by email and push notification. Legal basis: Art. 6(1)(f) legitimate interests. Switch them off in Settings → Notification preferences or with the link at the bottom of every update.
News and offers (marketing) — only with your consent (Art. 6(1)(a) GDPR; Art. L34-5 French Postal and Electronic Communications Code). Withdraw it at any time with the one-click unsubscribe link in every marketing email or in Settings → Notification preferences.

17. Automated decision-making

We use automated tools for fraud scoring, AML screening flags, capability gating (which features your account may use), and Instant payout level / caps. Some outcomes can significantly affect access to payouts or features.

Where Article 22 GDPR applies, you may request human review, express your point of view, and contest the decision — unless an Art. 22 exception applies (e.g. necessary for contract with suitable safeguards, or authorised by law). Contact [email protected].

18. Your rights

Under the GDPR you have the following rights (subject to legal limits):

Email [email protected] from the address on your account (or provide sufficient identity evidence). We may request proportionate additional verification.

How our systems work

Access (Art. 15) and portability (Art. 20): Request a copy of your personal data in a structured, commonly used, machine-readable format, subject to the biometric-template exclusion above.
Rectification (Art. 16): Correct inaccurate data. Some changes may require re-verification for AML reasons.
Erasure (Art. 17): Ask us to delete data. We cannot erase records we must keep (transactions, AML, e-invoices under statutory retention) while the obligation applies; those are retained and restricted. Biometric templates are deleted when you withdraw consent.
Restriction (Art. 18) and objection (Art. 21): Ask us to restrict processing, or object to legitimate-interest processing or to direct marketing (absolute for marketing).
Withdraw consent: Where processing is based on consent (biometrics, marketing, POS analytics), withdraw anytime without affecting prior lawful processing.
Automated decisions (Art. 22): See §17.

19. Security measures

We apply technical and organisational measures appropriate to the risk: TLS in transit; encryption at rest for sensitive stores; access control and least privilege; audit logging; segregation of biometric data; SCA for sensitive actions; network segmentation on our cloud; and incident response procedures.

No method of transmission or storage is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL and, where required, affected individuals, under Articles 33–34 GDPR.

20. Children

BaxPay services are not directed at children under 16. We do not knowingly create accounts for children under the age of legal capacity for payment services in France. If you believe we hold data about a child incorrectly, contact [email protected].

21. Complaints and supervisory authority

You may lodge a complaint with a supervisory authority in the EEA, in particular where you live, work, or where an alleged infringement occurred.

Our lead supervisory authority in France is the Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

We would appreciate the chance to address your concern first at [email protected].

22. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or business changes. The “Last updated” date at the top will change. Material changes affecting you will be communicated through the service or by email where appropriate.

23. Contact

How our systems work

Data protection: [email protected]
General support: [email protected]
Security: [email protected]
Postal: BAXPAY SARL, 679 Avenue de la République, 59800 Lille, France