Draft - not yet reviewed by a lawyer. This describes how Payly actually behaves today and is written in good faith, but it has not had legal review and is not yet a binding agreement. It must be reviewed before Payly takes on real customers.

Privacy policy

What Payly collects, why, and what we will never do with it. Last updated 21 August 2026.

The short version

We do not sell your data, or your customers' data, to anyone. Ever.
We do not run advertising on your site, and we load no third-party advertising trackers on it.
Analytics are first-party: collected by your own site, for you.
Card details never reach our servers. They go directly to Stripe or PayPal.

1. Who we are

Payly is operated by WPPlugin LLC. For anything in this policy, write to us through the contact form.

2. What we collect from merchants

Account details. Your name and email address, held so you can sign in and so we can reach you about your account.
Your site content. The pages, products and settings you create. Stored so we can publish them.
Payment connections. The account identifier and an access token for the Stripe or PayPal account you connect. Never the card details or the balances.
Support messages. What you write to us, and our replies.
Operational logs. Request records needed to keep the service running and to investigate faults.

3. What we handle on behalf of your visitors

When someone visits or buys from a site you built, we process data as your processor - you decide what is collected, and we act on your instructions:

Page views and referrers, aggregated daily for your analytics. No profile is built and no visitor is followed between sites.
Order records, including the email address, delivery address and items bought, so your store can fulfil the order.
Customer accounts, where a shopper creates one on your store, including any membership they hold.

4. Cookies

We use the minimum a working service needs:

A session cookie to keep you signed in to your dashboard.
A session cookie on a storefront where a shopper has signed in, which expires after twelve hours.
First-party analytics, which do not identify individuals.

No advertising cookies, and no third-party trackers.

5. Payment data

Card numbers are entered directly with Stripe or PayPal on their own pages and never touch Payly's servers. Money moves from your customer to your own processor account - Payly is never in the middle and never holds your funds. Their handling of that data is covered by their own privacy policies.

6. Who we share with

Only the providers needed to run the service:

Cloudflare - hosting, content delivery and storage.
Supabase - the database and sign-in system.
Stripe and PayPal - payment processing, where you have connected them.
An email provider - to send account and support email.

We do not sell data, and we do not share it for advertising.

7. How long we keep things

Account and site data is kept while your account is open. Delete a site and its content goes with it. Close your account and we remove your personal data, keeping only what we are required to keep - and anything already anonymised, which cannot be traced back to you.

8. Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Most of it you can export or delete yourself from the dashboard. For anything else, use the contact form and we will respond within 30 days.

If your customers exercise these rights against a store you run, you are the data controller for that store and we will help you comply.

9. Where data is stored

Content is served from Cloudflare's global network. Account and order records are held in our database provider's region. Using the service means data may be processed outside your own country.

10. Children

Payly is not intended for anyone under 16, and we do not knowingly collect their data.

11. Changes

If we change this policy we will update the date above, and tell you by email if the change is significant.

12. Contact

Privacy questions: contact us.