Privacy Policy: What We Collect and Why

Effective date: October 17, 2026. Last updated: November 1, 2026, to cover the emails we send merchants about their payouts and disputes, signing in and opening an account with a code by email, and passkeys and the settings on your account page. On October 31 we covered the Candor dashboard and sign-in links by email on your Candor account page, and what Stripe collects there; on October 26, the emails we send for merchants, the subscriber page and webhooks; on October 25, how long you stay signed in; and on October 19 we added your Candor account page, with payments through Stripe.

This policy covers candorpayments.com, the forms on it, your Candor account page, the subscriber and checkout pages we run for merchants, and the emails we send for them. Stripe, which processes payments for merchants on Candor, handles what it collects itself, such as your ID, your bank details and your customers' payment details, under the Stripe Privacy Policy.

What we collect

What you send us. When you fill in a form, we collect what you type: for example your name, email, phone number, business name, website, what you sell, your monthly card sales and your message.

What you type in the chat. Your messages to the chat assistant, and the page you sent them from. How the chat works explains where they go.

What your browser sends. Like every website, our hosting provider receives technical details when you visit, such as your IP address, browser type, the pages you request and the time. These are kept in server logs.

Your Candor account, if you're a merchant. As the platform your Stripe account is connected to, we can see your account's details and activity in Stripe, such as your business details, payments, refunds, disputes and payouts. Your Candor account page shows some of them to you, read from Stripe each time you open it. It also shows your Candor dashboard: Stripe's own screens, for your balance and payouts, payments, disputes, reports, bank and business details and documents. Stripe runs those screens, and what you enter or change in them, such as your bank details, goes straight to Stripe under the Stripe Privacy Policy. If you ask us to email you a sign-in code, we use the address you type only to find your account (or, if it has none, to let you open one) and to send the code, and we don't store it unless you open an account with it. If you add a passkey, your device keeps its private key and checks your face, fingerprint or screen lock itself: we never see or receive them. We keep only the passkey's public key, its ID, when you added it and which password manager made it, in your account's records at Stripe, and you can remove a passkey on your account page at any time. The settings you choose there (your payout schedule, the ways customers can pay you, the name on card statements, your brand color and logo) are saved in your account at Stripe, which uses them for your payments.

If you're a customer of a business on Candor. When a business sends you an invoice or you subscribe to one of its plans, the business gives Stripe your name and email address, and we read them from its Stripe account to email you for it: invoice reminders, a reminder before a free trial ends or a yearly plan renews, and a note if a payment fails or a subscription ends. On the subscriber page, we ask for your email address to send you a link to manage your subscription; we don't store it ourselves. Card details stay with Stripe.

What we don't collect here. We never ask for card numbers, Social Security numbers, bank account numbers or passwords on this website. Stripe collects ID and bank details itself, in its own secure forms.

Cookies and tracking

This website doesn't use advertising cookies, tracking pixels or third-party analytics. We don't track you across other websites, and we don't let third parties collect information about your activity over time and across websites through our site, except that the Stripe screens on your Candor account page are run by Stripe, which may use what it collects there, such as details of your device, to protect accounts across its services, under the Stripe Privacy Policy.

The only cookies it sets are for your Candor account page. When you sign in with a code from your email, one cookie keeps you signed in for up to 30 days after you last open your account page, but no longer than 90 days after you signed in. A second cookie tells the page that you're signed in. Both are needed for the page to work, and signing out removes them. So you don't have to type it again, your account page also remembers, in your browser on that device only, the email address you last asked for a code with; it isn't sent anywhere until you ask for a code, and clearing your browser's site data removes it. Stripe's pages and screens, such as payment pages, account setup and the Candor dashboard on your account page, set Stripe's own cookies under Stripe's policies.

Do Not Track

Because we don't track visitors across websites, the site works the same way whether or not your browser sends a Do Not Track signal or a Global Privacy Control signal.

How we use your information

To reply to you, and to review new accounts against our merchant rules.
To check a business's eligibility, including the identity and fraud checks Stripe carries out when you set up your account.
To run your account: to show where it stands, make your payment links, invoices and plans, and work out Candor's fee on each payment.
To email you about your own account: the sign-in codes you ask for, each payout sent to your bank (you can turn these off), payouts that fail, and disputes. They're about your account, never marketing.
To email a business's customers for it: invoice reminders and subscription notices. They're about the customer's own invoice or subscription, never marketing.
To keep the website secure and working.
To meet legal obligations, such as anti-money-laundering rules.

We don't sell your personal information, and we don't share it for advertising.

Service providers that run the website and its forms for us, such as our hosting provider, under contracts that limit their use of the data.
Our AI provider, Anthropic, which writes the chat assistant's replies from the messages you send it.
Our email provider, Resend, which sends our emails to merchants and to merchants' customers for us.
A merchant's own systems, when the merchant sets up a webhook or uses the API: we send it the events on its own account, such as a payment's amount or an invoice's customer name and email. The merchant's own privacy policy covers what it does with them.
Stripe, which processes payments for merchants on Candor. When we open your account, we send Stripe your business's name, email, website and what you sell; Stripe collects the rest itself, under the Stripe Privacy Policy.
Authorities, when the law requires it.
A buyer or successor, if Candor is ever merged or sold, under the same protections.

Seeing, correcting or deleting your information

Email privacy@candorpayments.com to ask what we hold about you, to correct it, or to delete it. We reply within 30 days. Some records, such as those tied to an application, may have to be kept for a period the law sets; if so, we tell you which and why.

How long we keep it

Messages and applications that don't lead to an account are deleted within 24 months. Server logs are kept for a short time, set by our hosting provider, for security; our payments service logs events such as a new payment link without personal details. Our email provider keeps a record of each email it sends, such as the address and the time, for a time set by its own policies. We don't keep chats with the assistant unless you send one to the team. Your account's records are kept by Stripe, under its policies and the law.

The chat assistant

The chat window on this site is an AI assistant, not a person, and it says so when it starts. A person on the team is one tap away through Talk to a person.

Where your messages go. When you send a message, the conversation so far and the page you're on go through our hosting provider to our AI provider, Anthropic, which writes the reply. Anthropic processes them for us as a service provider and doesn't use them to train its models. It deletes them within 30 days, except that content its automated safety systems flag can be kept for up to 2 years.

What we keep. We don't store chats on our servers. The conversation stays in your browser's session storage, so it follows you from page to page, and it's gone when you close the tab or start a new chat. Our hosting provider's logs record technical details of each chat request, such as the time, the page and how long the reply took, but not what you wrote.

When you ask for a person. Talk to a person sends us what you put in its form and, if you leave "Include this chat" ticked, the conversation, so the team has the context. We keep that like any other message.

Numbers we remove. Before a message leaves your browser, the chat removes anything that looks like a card number, bank account or routing number, Social Security number or tax ID. Please don't type them anyway: nobody from Candor will ask for them in chat.

Security

The site is served only over HTTPS. Form submissions are stored by our hosting provider and are available only to the Candor team members who need them. Sign-in codes we email are good for about 15 minutes, and an account stops accepting codes for an hour after too many wrong ones. Sign-in links from our team expire after 7 days. Both are signed, and our team can turn them off.

Children

This site is for businesses. It isn't directed at children, and we don't knowingly collect information from anyone under 16.

California residents

This policy is written to meet California's Online Privacy Protection Act (CalOPPA). If you're a California resident, you can use the request process above, and we won't treat you differently for using it.

Changes to this policy

If we change this policy, we update the dates at the top and describe material changes on this page.

Contact

privacy@candorpayments.com

Privacy policy