Where your documents live, for how long, and who can see them.

What we collect

Your identity document and a selfie, your address, contact details, the invoices and contracts you upload, the bank details of your beneficiaries, your wallet addresses and transaction hashes, and the usual technical data of a website (IP address, device, pages visited). For companies: registry documents, directors and beneficial owners.

Where it is stored

Documents and KYC data are stored encrypted on servers in the European Union, in a dedicated environment separate from the website. Identity checks run through a specialised verification provider that holds the document images under its own certification.

For how long

Five years after your last payment or after the account is closed, because anti-money-laundering rules require it. After that the files are deleted and the record of deletion is kept. Website analytics data is kept for 14 months.

Who can see it

• Compliance staff who verify you and review payments; each access is logged with who, when and why.
• The banks that execute your transfer see the beneficiary details and the purpose; they do not see your documents unless they ask for them to release a specific payment.
• Screening providers see names and addresses for sanctions checks, and wallet addresses for origin-of-funds scoring.
• Authorities, when the law requires a report or a response to a lawful request. We do not tip off, and we keep a record of every request.
• Nobody else. We do not sell data, share it with advertisers, or use it to train models.

How it is protected

Encryption in transit and at rest, keys held separately from the data, two-factor authentication for every staff login, role-based access, daily backups in a second region, and an independent penetration test before launch and yearly.

Your choices

• Export: ask in the dashboard and receive your documents and payment history as a ZIP within 5 business days.
• Correct: update contact details yourself; identity data is corrected by re-verification.
• Delete the account: close it in the dashboard. Active orders must finish first. We keep what the law requires for five years, then delete it; everything else is deleted within 30 days.
• Object or complain: write to [email protected]; we answer within 15 days. The supervisory authority is named in the policy.

Cookies

Necessary cookies keep you signed in and remember your language and theme; they need no consent. Analytics cookies are set only after you accept them on the banner, and you can withdraw at any time from the footer. We do not use advertising cookies.

Who is responsible

PT Global Payment Gateway (NIB 2412240053279), Graha Merdeka, Jalan Merdeka, Denpasar 80239, Bali, Indonesia, trading as Arkipo. Data questions: [email protected].