01Who is responsible

The data controller is Sunpot Corporation, a company incorporated in the British Virgin Islands, registration No. 1943422, registered address: Building 1, 2nd Floor, Tortola Pier Park, Wickhams Cay I, Road Town, Tortola, British Virgin Islands.

We process personal data in line with the BVI Data Protection Act, 2021. For customers in the European Economic Area and the United Kingdom, we also apply the standards of the GDPR / UK GDPR as described below. Contact for privacy matters: support@sunpot.co.

02What we collect

• Order data: invoice number, product, price, the cryptocurrency and network used, the payment address, transaction ID (hash), amounts and times. This is stored in our own self-hosted payment server.
• E-mail address — required at checkout on pay.sunpot.co: we use it to send your order confirmation and download links and to contact you about your order; also when you write to support.
• Correspondence: the content of your messages to support and our replies.
• Till customers: the login e-mail for your till, the setup details you send us, the till configuration and technical logs of your instance. Your till records your own buyers’ payments; we host it for you but do not use that data for our own purposes (see Section 4).
• Accounting customers: your sign-in e-mail; the wallet data you add (Bitcoin xpub and the addresses derived from it, TRON addresses); the transaction history of those wallets read from public blockchains and the ledger built from it; the labels, notes, report currency and time zone you set; a log of sign-ins and account actions. This data may include wallet addresses of people who pay you or whom you pay; you are responsible for having a basis to keep records about them.
• Sunpot Invoices customers: your sign-in e-mail; the company details and logo you put into your brand profile; your client list (name, company, e-mail, VAT number, address); the invoices you issue, with their amounts and the payment status you set; the payout addresses you save (public addresses only); a log of sign-ins. The cabinet does not connect to a wallet and does not read the blockchain. Data about your clients is processed on your behalf and on your instructions only (see Section 4); you are responsible for having a basis to store it and for informing them.
• Sunpot Autopilot customers: your intake form answers (company, tools, processes, contacts), the implementation plan and call notes, and — during implementation only — the access you grant us to your own n8n and connected accounts. We use it only to deliver the implementation and guidance, and stop using the access at handover or at the end of the guidance period, whichever comes last.
• Technical data: IP address, browser type and the pages requested, recorded in standard server logs.

03What we do not collect

• No seed phrases or private keys — ever. Our tools work only with view-only keys (xpub).
• No identity documents for purchases. We may ask you to confirm that you made a payment when you request a refund.
• No card numbers or bank details: we do not accept card or bank payments.
• No analytics, advertising or tracking cookies.

04Why we use data

• To take payment, deliver products and provide the Till, Accounting and Sunpot Invoices services — performance of a contract.
• To answer support requests and handle refunds — performance of a contract.
• To keep accounting records and meet legal obligations, including sanctions rules — legal obligation.
• To keep the Website and our servers secure and prevent abuse — legitimate interests.
• To send you transactional e-mails — the order confirmation with download links — and service messages about your order, implementation or till (for example renewal notices) — performance of a contract. We do not send marketing e-mails without your consent.

For Till customers: data about your own buyers that passes through your till is processed on your behalf and on your instructions only. You are responsible for informing your buyers about it. The same applies to Sunpot Invoices: the client data you keep in the cabinet is processed on your behalf and on your instructions only.

05Cookies and local storage

5.1. sunpot.co does not use cookies. It saves your language choice (EN/RU) in your browser’s local storage; this never leaves your device.

5.2. The payment page pay.sunpot.co, the Accounting service accounting.sunpot.co and the Sunpot Invoices cabinet invoice.sunpot.co use strictly necessary cookies to run the invoice and sign-in sessions. They are not used for tracking.

5.3. Our pages load fonts from Google Fonts. To deliver them, your browser connects to Google servers, which receive your IP address. See Google’s Privacy Policy.

06Blockchain data

Crypto payments are recorded on public blockchains. Wallet addresses, amounts and times are visible to anyone by design, and neither we nor anyone else can change or delete them. Our records link such a transaction to your order.

07Who we share data with

We do not sell personal data. We share it only with:

• OVH SAS (France) — hosting of our servers, including the website, the payment server, client tills, Accounting and Sunpot Invoices;
• our e-mail provider — to send and receive e-mail at support@sunpot.co;
• Brevo (Sendinblue SAS, France) — to deliver order confirmations, Accounting and Sunpot Invoices sign-in links and other transactional e-mails;
• Google — font delivery (Section 5.3);
• blockchain data providers (mempool.space for Bitcoin, TronGrid for TRON) — to look up transactions of the wallets you add to Accounting; they receive the wallet addresses we query and our server’s IP address, not your name or e-mail;
• price data providers (CoinGecko, Kraken, European Central Bank) — to fetch exchange rates; they receive no personal data;
• professional advisers (lawyers, accountants) bound by confidentiality, and our registered agent in the BVI;
• public authorities, where the law requires it.

08International transfers

We are based in the British Virgin Islands; our servers are in the European Union and some providers may be elsewhere. When personal data of EEA or UK residents is transferred outside those regions, we use appropriate safeguards such as standard contractual clauses where applicable.

09How long we keep data

• Order and accounting records: at least 5 years, as required for company records in the BVI.
• Support correspondence: up to 2 years after your last message, longer only if needed for a dispute.
• Autopilot implementation data (intake answers, plan, call notes): for the guidance period and up to 2 years after it; access to your accounts ends at handover.
• Till configuration and logs: for the service term, then 60 days after it ends (so the till can be restored), then deleted.
• Accounting data: for the service term; after the account becomes read-only, for 12 months, then deleted after 30 days’ notice by e-mail (earlier on request). Backup copies are overwritten within 14 days.
• Sunpot Invoices data (brand profiles, clients, invoices, saved payout addresses and sign-in logs): for as long as your account exists. If you ask us in writing to delete it, we delete it within 30 days. Backups are kept for 14 days and overwritten within that time.
• Server logs: rotated automatically and kept only for a short period.

10Your rights

Subject to applicable law, you can ask us to access, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable format. Write to support@sunpot.co; we reply within 30 days. We may keep data we are legally required to keep, and we cannot erase data recorded on public blockchains.

You may also complain to the Information Commissioner of the British Virgin Islands or, if you are in the EEA or UK, to your local data protection authority.

11Security

We run our own payment server instead of third-party processors, encrypt all connections (HTTPS), limit access to servers to authorised staff, and isolate each client till. Accounting stores only view-only wallet data and signs you in with one-time links instead of passwords. Sunpot Invoices signs you in the same way, with one-time e-mail links; we store no passwords for it. No system is perfectly secure, but we design our products so that a breach on our side cannot give anyone access to your funds.

12Children

Our products are for businesses and adults. We do not knowingly collect data from anyone under 18.

13Changes

We may update this Policy by publishing a new version on this page with a new date. If a change materially affects Till customers, we will also notify them by e-mail. If the English and Russian versions differ, the English version prevails.