Privacy Policy

Last updated: February 2026

Eine deutsche Fassung ist auf Anfrage erhältlich — hello@paywatcher.dev

1. Data Controller

masemIT e.U.

Mario Semper

Alleegasse 26, 3851 Kautzen, Austria

Email: hello@paywatcher.dev

Commercial Register: FN 661236g

VAT ID: ATU82330407

2. Data We Collect

We collect only the data necessary to provide and improve our service. Here is exactly what we collect, when, and why:

DataWhenLegal BasisRetention
Email address (request access)Landing page formArt. 6(1)(b) — pre-contractualUntil onboarding or 6 months
Name, company, use case (request access)Landing page formArt. 6(1)(b) — pre-contractualUntil onboarding or 6 months
Email address (login)Magic link loginArt. 6(1)(b) — contract performanceDuration of business relationship
Auth session token (cookie)After loginArt. 6(1)(b) — contract performanceSession duration (max 30 days)
Tenant API key (encrypted)After onboardingArt. 6(1)(b) — contract performanceDuration of business relationship
Payment data (amount, status, txHash)API usageArt. 6(1)(b) — contract performance7 years (Austrian retention law)
Webhook URLsSettings configurationArt. 6(1)(b) — contract performanceDuration of business relationship
IP address, browser infoAutomatically on page visitArt. 6(1)(f) — legitimate interest (security)30 days (server logs)
Analytics events (anonymized)With consent onlyArt. 6(1)(a) — consent26 months

4. Cookies & Tracking

Essential Cookies (always active)

These are required for the service to function. No consent needed.

  • Auth session cookie (NextAuth)
  • CSRF protection token
  • Consent preference (your cookie choice)
  • Device ID (anonymous identifier for consent audit trail)

Analytics (only with your consent)

We use masemIT Analytics (self-hosted at analytics.masem.at) — a privacy-focused analytics solution. The analytics script is only loaded if you explicitly grant consent. No data is collected before you click "Accept All".

5. Sub-Processors

We use the following third-party services to operate PayWatcher:

ServicePurposeLocationTransfer Mechanism
VercelHosting & CDNUSAEU Standard Contractual Clauses
NeonPostgreSQL databaseEU (Frankfurt)
ResendTransactional emailUSAEU Standard Contractual Clauses
QStash / UpstashMessage queue & cacheEU

6. Data Sharing

We do not sell, rent, or share your personal data with third parties beyond the sub-processors listed above. Your data is only used to provide and improve our service.

7. Retention Periods

  • Auth tokens: Session duration (max 30 days)
  • Request access data: Until onboarding is completed or 6 months, whichever comes first
  • Payment verification data: 7 years (Austrian statutory retention requirement)
  • Analytics data: 26 months
  • Server logs: 30 days

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Right of access — Request a copy of your data
  • Right to rectification — Correct inaccurate data
  • Right to erasure — Request deletion of your data
  • Right to restriction — Limit how we process your data
  • Right to data portability — Receive your data in a portable format
  • Right to object — Object to processing based on legitimate interest
  • Right to withdraw consent — Revoke analytics consent at any time via "Cookie Settings"

To exercise any of these rights, contact us at hello@paywatcher.dev.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: dsb.gv.at

9. International Transfers

Some of our sub-processors (Vercel, Resend) are based in the USA. Data transfers to these services are safeguarded by EU Standard Contractual Clauses (SCCs), ensuring your data receives an adequate level of protection as required by GDPR.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be published on this page with an updated "Last updated" date. We encourage you to review this page periodically.