Privacy Policy

1. Data Controller

PayGlue.io
André Nünninghoff
An den Platanen 5
47279 Duisburg
Germany

Email: team@payglue.io
Phone: +49 1570 3546431

2. General Information

We take the protection of your personal data seriously.

This Privacy Policy explains what personal data we collect, how we use it, the legal basis for processing, and your rights regarding your personal information.

Personal data means any information relating to an identified or identifiable natural person.

3. Legal Bases for Processing

We process personal data based on one or more of the following legal grounds:

4. Data We Collect

Depending on how you interact with PayGlue, we may collect:

• Name
• Email address
• Account information
• Login information
• Billing information
• Payment information
• Communication records
• Technical device information
• IP address
• Browser information
• Usage information
• Analytics data

5. Hosting and Infrastructure

6. Cookies and Consent Management

We use vanilla-cookieconsent, an open source consent management solution, to inform you about our cookie use and to store your preferences locally in your browser. No data is sent to third parties for this purpose.

We only use cookies that are strictly necessary for the operation of this website. These include security and bot-protection cookies set by Cloudflare (including Cloudflare Turnstile), session cookies set by Supabase for authentication, and cookies set by Userback, which powers our feedback widget and contact form.

You can change or withdraw your consent at any time by clicking the cookie settings link in the footer of this page.
vanilla-cookieconsent

7. Server Log Files

When you visit our website, technical information is automatically collected and stored in server log files. The following information may be recorded:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL
• Requested pages and files
• HTTP status codes

This information is required to ensure the security, stability, and proper operation of our services. Processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

8. User Accounts and Registration

To access PayGlue services, users may create an account. During registration and account use, we may process name, email address, login credentials, account settings, subscription information, and customer account data. This processing is necessary to provide our services and fulfill contractual obligations pursuant to Art. 6(1)(b) GDPR.

9. Authentication

Dashboard sign-in is handled by Supabase (see Section 5). You can sign in with an email one-time code, or via single sign-on with Google or GitHub.

If you choose single sign-on, we receive only the information the provider shares with us (typically name, email address, and a provider account identifier):

• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Privacy Policy
• GitHub: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA — Privacy Policy

10. Customer and Contract Data

We process personal data necessary to establish, perform, and manage contractual relationships. This may include name, contact details, billing information, order and subscription information, customer communication, support requests, and transaction records. Processing is carried out pursuant to Art. 6(1)(b) GDPR.

11. Payments

12. Email Communication

13. Blog Newsletter

We publish a newsletter about Ghost payments at payglue.io/blog. Subscribing is voluntary, is not connected to a PayGlue account, and is not a condition for using anything.

How a subscription is created

When you enter your email address in the signup form, we do not add you to the list. We send you a confirmation email first, and your address is only added once you click the link in it. If you never click it, the request expires and no subscription comes into existence. This double opt-in also protects you from being signed up by somebody else.

What we process, and on what basis

Your email address, the date and time of the subscription and of the confirmation, and which page the signup came from (the blog index or an article page). We do not ask for your name. Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. The confirmation you clicked is what documents that consent, as required by Art. 7(1) GDPR.

Where the list is held and who sends the emails

The subscriber list is held in our Ghost site at demo.payglue.io, hosted at Hetzner in Falkenstein, Germany. The confirmation email is sent through Brevo and the newsletter itself through Mailgun on its EU infrastructure, both described in section 12.

No open or click measurement

We do not measure whether you open the newsletter or which links you click. Ghost is able to record both and we have switched it off.

Withdrawing, and how long we keep your address

Every newsletter carries an unsubscribe link. One click, no reason needed, and it takes effect immediately. You can also write to team@payglue.io. Withdrawing your consent does not affect the lawfulness of what we sent you before it.

We keep your address until you unsubscribe. Unsubscribing marks your record as unsubscribed rather than erasing it, so that we retain evidence that you asked to leave and do not accidentally add you again. If you would rather the record went entirely, write to us and we will delete it.

14. Customer Support and Communication

If you contact us for support, we process the information you provide to handle your request and provide customer assistance. Our in-app feedback widget and contact form are powered by Userback (Userback Pty Ltd). The information processed may include name, email address, account information, support messages, attachments, and communication history.
Userback Privacy Policy

Booking a call

You can book a call with us at cal.payglue.io. The booking page and calendar are provided by Trafft (TOUCH ME SOFT D.O.O., Belgrade, Serbia), with data stored on servers in Germany. When you book, Trafft processes on our behalf the details you enter: name, email address, phone number if given, the address of your Ghost site, your membership setup and anything you write in the free-text field, plus the appointment itself. If you choose to create a Trafft account or sign in with Google, Trafft also handles those credentials. We use this information only to prepare and hold the call. Calls take place on Google Meet (Google Ireland Limited). Trafft is bound by a data processing agreement including the EU Standard Contractual Clauses. Legal basis is Art. 6(1)(b) GDPR, steps taken at your request prior to a contract.
Trafft Privacy Policy

15. Analytics

PostHog

We use PostHog, a product analytics service provided by PostHog, Inc., hosted in the EU (eu.posthog.com). It helps us understand how our website and dashboard are used. It may process pages viewed, device and browser information, approximate location derived from your IP address, and interactions such as starting a checkout or completing a signup. PostHog also performs error monitoring for us: when your browser hits an unexpected error on our site, it reports the error message, the technical stack trace and the page it happened on, so that we can fix the fault. We use this only to find and repair defects, not to profile you. PostHog is only loaded after you consent to analytics cookies, which are switched off by default, and you can withdraw that consent at any time through the cookie settings. Data is stored in the EU; PostHog, Inc. is headquartered in the US, and transfers are covered by Standard Contractual Clauses.
Privacy Policy

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics helps us understand how visitors interact with our website and services. It may process page views, device information, browser information, approximate location, and usage behavior. Where legally required, analytics tracking is only activated after consent has been provided.
Privacy Policy

16. Embedded Videos

17. International Data Transfers

Some of our service providers operate outside the European Economic Area (EEA). Where personal data is transferred internationally, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses (SCCs), or equivalent legal mechanisms where required by law.

18. Data Retention

We retain personal data only for as long as necessary to provide our services, fulfill contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements. Where statutory retention periods apply, data will be retained for the legally required period and deleted thereafter.

19. Account Deletion and Data Retention

Users may request the deletion of their account and personal data at any time by contacting us at team@payglue.io.

Upon account deletion, personal data will generally be deleted unless retention is required for legal, regulatory, tax, accounting, or contractual purposes. Certain records, including invoices and payment records, may be retained for up to 10 years where required by applicable law. After the applicable retention period expires, such data will be securely deleted or anonymized.

Please note that backups and archived copies may remain temporarily until they are automatically removed according to our retention schedules.

20. Your Rights

Under the GDPR, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of data
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, please contact: team@payglue.io

21. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or business developments. The latest version will always be published on this page. We encourage users to review this Privacy Policy periodically. The date shown at the top of this Privacy Policy indicates when it was last updated.