Privacy Policy
Last Updated: August 28, 2026
1. Overview & Core Philosophy
MSU Pay respects your privacy and operates on a principle of minimal data collection. Because MSU Pay is non-custodial, we do not collect financial accounts, bank details, or Identity Verification (KYC) documents.
2. Data We Collect and Why
| Data Collected | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Business Account Email | Account creation, authentication, password resets, and optional transactional notifications (e.g., payment alerts). | Contractual Necessity & Legitimate Interest |
| Hashed Password | Secure account authentication. Stored exclusively using memory-hard cryptographic hashing. | Contractual Necessity |
| Payer Email (Optional) | One-time entry during customer checkout for bot-prevention, session mapping, and issuing a digital payment receipt. | Legitimate Interest (Security/Anti-Abuse) |
3. Email & Data Handling Principles
- No Marketing: We will never send marketing, promotional emails, or share your email address with third-party advertisers.
- Receipts Only: Payer emails are strictly used to process the single transaction and generate a payment receipt.
4. Data Retention & Automatic Purging
- 6-Month Inactivity Purge: Customer transaction emails and inactive session records are automatically and permanently deleted from our live databases after 6 months of inactivity.
- Account Deletion (Right to Erasure): When a business clicks the "Delete Account" button in the dashboard, all associated personal data—including the registered email, hashed password, and session tokens—is immediately and permanently scrubbed from our active databases.
5. On-Chain Data Disclaimer
Please note that transactions conducted on public blockchains are inherently public, immutable, and permanent. MSU Pay has no ability to modify, censor, or erase data written to a public blockchain.
6. Contact
For any privacy-related inquiries or questions regarding account data, please manage your settings directly through your MSU Pay account dashboard or contact the administrator.