Privacy Policy

Effective date: 29-03-2026

This Privacy Policy explains how mavi pay, operated by mavi finans ("we", "us", "our"), collects, uses, stores, and protects your personal data when you use our merchant payment platform at pay.mavifinans.sh and related services.

We process your data in compliance with the General Data Protection Regulation (GDPR) and applicable Belgian and European data protection laws.

1. Data Controller

mavi Ltd (Cyprus — to be filled), trading as mavi finans. For questions about your data, contact us at legal@mavifinans.sh or via mavifinans.sh/contact.

2. What Data We Collect

Account data: Name, email address, organisation name, and authentication credentials (via Google, Apple, or email magic link).

Merchant data: Business information, product details, pricing, payout preferences, and Stripe Connect account information.

Transaction data: Payment amounts, currency, timestamps, customer details, order history, subscription records, and payout records.

Technical data: IP address, device type, browser type, operating system, referral source, and session information.

Usage data: Pages visited, features used, dashboard interactions, and API usage patterns.

Communication data: Support requests and any correspondence you send us.

3. Why We Collect Your Data

Service delivery: To operate the mavi pay platform, process payments, manage merchant accounts, and facilitate payouts via Stripe Connect.

Compliance: To meet KYC, AML, and tax reporting obligations as required by European and international law.

Fraud prevention: To detect and prevent fraudulent transactions and unauthorised access.

Product improvement: To understand how the platform is used and improve the merchant experience.

Communication: To send transactional emails (order confirmations, payout notifications, security alerts) and, with your consent, product updates.

4. Legal Basis (GDPR)

Contract performance (Art. 6(1)(b)): Processing necessary to provide the Services — account management, payment processing, payouts.

Legal obligation (Art. 6(1)(c)): Tax reporting, AML compliance, and regulatory requirements.

Legitimate interest (Art. 6(1)(f)): Fraud prevention, security monitoring, and platform improvement.

Consent (Art. 6(1)(a)): Optional marketing communications. Withdraw consent at any time.

5. Third-Party Processors

We share data with the following processors, each bound by data processing agreements:

Stripe — Payment processing and merchant payouts. PCI DSS Level 1 certified. Stripe Privacy Policy.

GitHub, Google, Apple — Authentication providers (only if you choose to log in via these services).

Resend — Transactional email delivery.

PostHog — Product analytics (self-hosted where possible).

We do not sell your personal data.

6. International Data Transfers

Some processors operate outside the EEA. Where data is transferred outside the EEA, we ensure adequate safeguards via Standard Contractual Clauses (SCCs) or adequacy decisions.

7. Data Retention

Account data: Retained for the duration of your account. Deleted within 30 days of account closure, except where legal retention applies.

Transaction data: Retained for 7 years for tax and regulatory compliance.

Technical logs: Retained for up to 12 months for security and debugging.

8. Your Rights (GDPR)

You have the right to: access, rectify, erase, restrict processing, data portability, object to processing, and withdraw consent.

You may also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) at www.dataprotectionauthority.be.

To exercise your rights, contact us via mavifinans.sh/contact. We respond within 30 days.

9. Cookies

mavi pay uses essential cookies for session management and authentication. We use PostHog for product analytics. We do not use advertising or third-party tracking cookies.

10. Security

We implement encryption in transit (TLS) and at rest, access controls, and regular security monitoring. Payment data is handled entirely by Stripe and never stored on our servers.

11. Children

mavi pay is not directed at individuals under 18. We do not knowingly collect data from minors.

12. Changes

We may update this policy with at least 30 days notice for material changes. The effective date at the top reflects the most recent update.

13. Contact

For questions about this Privacy Policy, contact us via mavifinans.sh/contact.