Privacy Policy

01Who we are

Mavi Pay is a product of mavi Finans. For personal data processed through the Service, mavi Finans, with its place of business in Limassol, Republic of Cyprus is the data controller (unless we act as a processor for a specific seller instruction, in which case we will say so).

Place of business: Limassol, Republic of Cyprus. Privacy contact: privacy.

This policy explains what we collect, why, how long we keep it, and your rights under the GDPR and similar laws.

02Data we collect

• Account data — name, email, account type (person/business), business and tax details, payout destination (e.g. bank last digits).
• Transaction data — orders, invoices, credit notes, VAT records, refunds, subscriptions, and payout history (amounts in integer minor units + currency).
• Buyer data — email and billing country needed to complete a purchase, calculate VAT, issue an invoice, and deliver goods.
• Usage & security data — logs, device/browser information, and IP-based coarse location for security, fraud prevention, and reliability.

We do not store full card numbers. Payment card data is handled by our payment processor, Stripe, Inc.

03How we use data

We process personal data to:

• provide the Service (accounts, checkout, delivery, dashboard);
• process payments and act as merchant of record — including calculating, collecting, invoicing, and recording VAT (see Terms for how remittance is handled);
• send receipts, invoices, credit notes, dunning notices, and security/sign-in messages;
• prevent fraud, abuse, and security incidents;
• meet legal, accounting, and tax record-keeping duties;
• improve reliability and support you.

Legal bases include performance of a contract, legitimate interests (security, product improvement, limited service communications), legal obligation (tax and financial records), and consent where required (e.g. non-essential cookies, if introduced later).

04Who we share data with

We share data only with processors that help us run the Service:

• Stripe, Inc. — payment processing, fraud prevention, and (where enabled) payout rails.
• mittera.eu — transactional email (receipts, sign-in links, notices).
• Briven— database and object storage that hosts the Service's data.

The current list lives at /legal/subprocessors. We may also disclose data where required by law, regulation, or court order, or to protect rights and safety.

We do not sell personal data.

05Storage & security

Data is stored on infrastructure operated for mavi Finans. Files are served over short-lived, signed links where applicable. We apply access controls, encryption in transit (TLS), encryption at rest where the platform provides it, and an audit trail of changes to financial records. Multi-tenant isolation is enforced at the data layer so sellers do not see each other's data.

No method of transmission or storage is perfectly secure; please protect your account credentials.

06Retention

We keep financial, invoice, credit-note, and tax records for as long as required by law in Cyprus and other applicable jurisdictions (often several years). Other data is kept only as long as needed for the purposes above, then deleted or anonymised where feasible.

07Your rights

Under the GDPR and similar laws, you may request access, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where processing is based on consent. Some data must be retained to meet legal obligations (for example tax records).

To exercise your rights, contact privacy. You may also lodge a complaint with a supervisory authority. For Cyprus, the Office of the Commissioner for Personal Data Protection is the national authority.

08International transfers

Where data is transferred outside the EEA/UK (for example to a US payment processor), we rely on appropriate safeguards such as Standard Contractual Clauses and minimisation of what we send.

09Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it where required.

10Cookies

We use only cookies necessary to sign you in and keep the Service secure. We do not use advertising cookies. See our Cookie Policy for detail. During checkout, the payment processor may set its own necessary cookies.

11Changes

We may update this Privacy Policy from time to time. We will revise the "Last updated" date and, for material changes, provide notice where appropriate.

12Contact

Privacy questions or requests: privacy.

mavi Finans · Limassol, Republic of Cyprus · pay.mavifinans.sh