Privacy policy

Last updated 26 October 2026

This policy explains what Lona ("Lona", "we") collects when merchants use the dashboard and API, and when customers pay through a Lona checkout page.

Merchants

When you create an account we store:

• your business name, email address and a hashed password
• your payout wallet and Zcash refund address
• invoices, payment links, API key hashes and webhook endpoints you create
• basic request logs (IP address, time, page) kept for security for up to 30 days

Customers paying at checkout

We do not ask customers to create an account. A checkout page records the payment details needed to complete the payment: the quoted ZEC amount, the deposit address, transaction hashes, and a refund address if the customer chooses to give one. We do not see or store the customer's wallet balance or history. Merchants may attach their own reference or a customer email to an invoice; that data belongs to the merchant.

What is public on blockchains

Payments move on public networks. The ZEC amount sent to a deposit address and the stablecoin payout to the merchant's wallet are visible to anyone. We cannot remove or change data recorded on a blockchain.

Who we share data with

• The swap network (currently NEAR Intents through the 1Click API) receives the payout address, refund address and amounts it needs to complete each payment.
• Our hosting and database providers, who process data on our behalf.
• Authorities, where the law requires us to.

We do not sell personal data and we do not use advertising trackers.

Cookies

We use one cookie to keep you logged in and one to remember whether the dashboard is in test or live mode. Checkout pages set no cookies.

Keeping and deleting data

We keep invoice records while your account is open and for as long as financial record-keeping rules require afterwards. You can ask us to export or delete your data by writing to hello@lona.example.

Your rights

Depending on where you live, you can ask to access, correct, delete or move your personal data, or object to how we use it. Contact us at the address above and we will reply within 30 days.

Changes

If we change this policy in a way that matters, we will tell merchants by email before it takes effect.