Privacy Policy

1. Who is responsible

PayAndes, a software service operated from Peru, is responsible for the personal data it processes to provide its service. You can write to us at codegsm.peru@gmail.com.

2. Who this applies to

• Merchants: the stores that use PayAndes and the people who sign in to their dashboard.
• Merchants' customers: people who pay on a store's checkout.
• Resellers: those listed in the official directory.
• Visitors to the payandes.com website.

3. What data we process

About merchants:

• name, business name, email and logo;
• password (stored in an irreversible form: no one, not even PayAndes, can see it) and two-step verification data;
• the ID of the linked Telegram chat;
• receiving settings: Binance Pay ID, wallet addresses, Yape number and QR, exchange rate and the read-only keys you register;
• order and payment history, IP address and browser at sign-in, and a security activity log.

About merchants' customers (on behalf of the merchant):

• order data sent by the store: number, amount, description and, if the store sends them, name and email;
• payment data: method, transaction ID or hash, source wallet and the Yape details the customer enters to confirm (name and security code);
• IP address, to prevent abuse.

About resellers: name or business, country, city, languages, WhatsApp, Telegram, email, website and payment methods, which are published in the directory with their permission.

About visitors: minimal technical data in the server logs (IP, browser and pages requested) and your language and theme preferences.

We do not process sensitive data and we never ask for payment card details.

4. What we use it for

• Providing the Service: creating and managing accounts, showing your checkout, verifying payments, confirming orders and notifying your store and your Telegram.
• Security and fraud prevention: detecting unauthorized access, limiting attempts, blocking abuse and reviewing doubtful payments.
• Support: answering your questions.
• Service notices: plan expiry, important changes and maintenance.
• Complying with legal obligations and requests from authorities.

We do not sell personal data, we do not use it for third-party advertising and we do not send you advertising without your consent.

5. Legal basis

We process data because it is necessary for the Service contract, because of our legitimate interest in keeping it secure, because of your consent (for example, to be listed in the reseller directory) or because a law requires it.

6. Data of merchants' customers

For this data, the merchant is the controller and PayAndes is the processor: we use it only to verify payments and notify the merchant, following its instructions. If you bought from a store that uses PayAndes and want to exercise your rights, write to that store or to us and we will pass your request on.

The merchant is the one who must inform its customers about this processing, obtain their consent when needed and handle their rights. PayAndes is not responsible for how the merchant uses that data outside the Service.

7. Who we share data with

Only with those needed to provide the Service:

• hosting and database providers;
• Binance, to check payments with the merchant's read-only key;
• lookup services for the TRON and BNB Smart Chain networks, which receive the transaction hash or the address;
• Telegram, to send notifications to the chat linked by the merchant;
• the Google Apps Script that the merchant sets up to verify Yape;
• Google Fonts: the website loads its fonts from Google, which shares your IP address with Google;
• the merchant's store, which receives the order and payment data;
• authorities, when the law requires it.

Each of these third parties has its own privacy policy.

8. International transfers

Some providers may be located outside Peru. We choose providers with appropriate safeguards and send them only the data they need.

9. How long we keep data

• Account data: while the account is active and, after that, for as long as needed to meet legal obligations or handle claims.
• Orders and payments: while the account is active and for the period required by accounting or tax rules; then they are deleted or anonymized.
• Security and server logs: for limited periods.
• Resellers: while they are listed in the directory. When they are removed, their data is deleted from the directory.

10. How we protect your data

We apply technical and organizational measures to protect data: a secure connection (HTTPS), personal data stored in a way that cannot be read directly from the database, passwords that are never stored as they are, two-step verification, sessions that close after inactivity, activity logs and access limited to the staff who need it.

No system is infallible. If an incident affects your data, we will tell you and report it to the authority when required.

11. Cookies and browser storage

We only use what the website needs to work:

• the dashboard session cookie, to keep you securely signed in;
• the pa_lang cookie, which remembers the language you chose (it lasts one year);
• browser storage, to remember the light or dark theme and to resume a payment in progress if you switch to another app.

We do not use advertising or third-party analytics cookies.

12. Your rights

You can ask to access your data, correct it, delete it and object to its processing. You can also ask us to restrict its use, receive it in a format you can take to another service and withdraw your consent when the processing is based on it.

Write to us at codegsm.peru@gmail.com, preferably from your account email, saying what you need. We will reply within the time limits set by law. If you are not satisfied with our answer, you can contact Peru's National Authority for Personal Data Protection.

13. Minors

The Service is not intended for people under 18 and we do not knowingly collect their data. If you believe a minor gave us data, write to us and we will delete it.

14. Changes to this policy

We may update this policy. We will publish the new version with its date and, if the changes are significant, we will tell you through the dashboard, by email or on Telegram.

15. Contact

For any privacy question, write to us at codegsm.peru@gmail.com.