PayToMe privacy policy: what we collect and why

This draft will be reviewed by counsel before it is finalized.

This is the PayToMe privacy policy for the website at paytome.si, the free tools, the optional newsletter and the PayToMe app at app.paytome.si, where you create an account, send invoices and take payments. It is written in plain English and covers what we do today. PayToMe is in public beta, and this draft will be updated as the product changes.

The short version

• If you create an account, we hold your email address, how you sign in (a passkey, a wallet or an emailed code) and the invoices, clients and items you add.
• Payments are processed by Stripe. PayToMe does not store card numbers.
• If you join the optional newsletter, we collect your email address, the time you signed up and the page you signed up from.
• We keep a salted hash of your IP address on the newsletter form, only to prevent abuse. We do not store the raw address.
• The website uses no cookies and no analytics.
• What you type into the free generators never leaves your browser.
• Cloudflare, Resend and Stripe process data on our behalf.
• You can ask us to delete your data by emailing privacy@paytome.si.

What we collect

Account data

When you create an account at app.paytome.si, you sign in with a passkey, a wallet or a code we send to your email address, so we hold your email address and the details needed to recognize your sign-in method. We also hold what you put into PayToMe to run your invoicing: your invoices, estimates, clients and items. We use this data to provide the service to you, to send the invoices you ask us to send and to contact you about your account.

Payments and plans

Payments are processed by Stripe. When a client pays an invoice, or when you buy a paid plan, card and bank details are entered with Stripe, and PayToMe does not store card numbers. Paid plans (Pro and Business) are subscriptions billed by Stripe, and you can cancel any time. Stripe handles your data under its own privacy policy as well as under our instructions.

Newsletter email address

The newsletter is optional. When you join it, you give us your email address.

Item	Where it is stored	Purpose	How long we keep it
Email address, the time you signed up and the page you signed up from	Cloudflare D1 (a database)	To send a confirmation email and, once you confirm, the newsletter	Until you unsubscribe or ask us to delete it

We use a double opt-in: we send a confirmation email, and you are only added to the newsletter once you confirm. Every email we send you will tell you how to unsubscribe. We do not sell your email address and we do not share it for advertising.

Hashed IP address

To stop bots and repeated sign-ups, the newsletter form uses a salted hash of your IP address. A hash is a one-way scrambled value, so we cannot turn it back into your IP address. The raw IP address is not stored by us. The hash is used only to prevent abuse.

Technical data processed by our host

Our website is hosted on Cloudflare. Like any host, Cloudflare handles network requests, which include your IP address and browser details, in order to deliver pages and protect the site. We do not use that information for marketing.

What we do not collect

• Cookies on the website. The website at paytome.si sets no cookies.
• Analytics. We run no analytics or advertising trackers and no third-party scripts on the website.
• Card numbers. PayToMe does not store card numbers. Stripe handles them.
• Generator inputs. The free tools, including the invoice generator and the calculators listed on the tools page, run in your browser. The client names, line items and amounts you enter never leave your browser and are not sent to us.

Who processes data for us

Processor	What it does for PayToMe
Cloudflare	Hosts the website and runs the database that stores newsletter signups
Resend	Sends the emails we send, such as newsletter confirmations and emails from your account
Stripe	Processes card and other payments and bills paid plan subscriptions

These providers may process data in countries other than your own. We use them only to run the services described here.

Your rights

Depending on where you live, laws such as the GDPR (in the European Economic Area and the United Kingdom) and the CCPA (in California) may give you rights over your personal data. In general terms, these can include the right to:

• know what personal data we hold about you;
• ask us to correct it;
• ask us to delete it;
• object to or restrict certain uses of it;
• withdraw consent you have given, at any time.

We do not sell personal data.

How to ask for deletion or access

Email privacy@paytome.si from the address you used for your account or the newsletter, and tell us what you want: access, correction or deletion. Using the same address lets us confirm the request is yours. You can also use the unsubscribe link in any email we send. When we delete your data, we remove it from our database and stop sending you messages. Copies held by our email provider as part of delivery logs are governed by that provider’s retention practices.

Children

The website, the newsletter and the app are not directed at children, and we do not knowingly collect data from them. If you believe a child has created an account or joined the newsletter, write to us and we will delete the entry.

Security

We protect the data we hold with measures described on the security page. No system is perfectly secure, so we also aim to hold as little data as possible.

Changes to this policy

We will update this policy when what we do changes, especially as the product changes. The “updated” date shows the latest revision. If a change is material, we will tell account holders and newsletter subscribers by email.

Contact

Questions about this policy go to privacy@paytome.si. Other ways to reach us are on the contact page. Use of the site is also covered by our terms of service.