Privacy Policy

How StableOps collects, uses, retains, and protects workspace, payment, webhook, and support data.

Last updated: 2026-10-09

Data we process

Account and workspace data such as organization name, user email, role, environment, API key metadata, and audit logs.
Payment operations data such as merchant order IDs, chain, asset, amount, receiving address, order status, normalized chain events, confirmation history, and webhook delivery metadata.
Address risk data such as sender addresses, sanctions list matches, third-party risk labels, data sources, screening status, and query times. We retain screening results as needed to display notices and reuse recent queries.
Support and diagnostic data such as request IDs, error messages, metrics, and communications you send to StableOps.

How we use data

Data is used to provide payment event infrastructure, authenticate API calls, deliver webhooks, operate dashboards, detect abuse, and maintain reliable service.
Aggregated operational metrics, incident analysis, and support workflows are used to improve product quality over time.
Personal data is not sold, and customer payment data is not used to train general-purpose AI models unless explicitly instructed by the customer.

Retention and security

Audit logs are retained for 12 months by default; Enterprise plans include 1-year retention with export. Webhook delivery logs are retained according to your plan: 7 days (Free), 14 days (Launch), 30 days (Starter), 90 days (Growth), or as negotiated for Enterprise.
Secrets are hashed or encrypted where applicable. Webhook secrets support rotation and API key plaintext is only shown at creation time.
Customers are responsible for configuring their own wallet, address, and downstream accounting controls because StableOps is non-custodial.

Data sharing and sub-processors

We share data with infrastructure sub-processors that host our database, run chain RPC providers, deliver email, collect metrics, and report errors, strictly to operate the service.
For address risk labels, StableOps queries GoPlus using the public sender blockchain addresses and the network identifier. These queries do not include order details, amounts, merchant identity, or private keys. GoPlus processes the queries under its applicable terms and privacy policy. Public OFAC lists are downloaded for address matching without sending customer addresses to OFAC for screening.
We may disclose data when required by law, to enforce our terms, to prevent fraud or abuse, or as part of a merger, acquisition, or asset transfer with continued protection commitments.
On-chain transaction data is public by nature; StableOps reads it but does not control the underlying blockchain ledgers.

International data transfers

StableOps may process and store data in regions where we or our sub-processors operate. Cross-border transfers rely on appropriate safeguards consistent with applicable data protection law.
Enterprise customers with data residency requirements should agree on region and retention terms in a written contract before production use.

Your rights

Depending on your jurisdiction, you may request access, correction, deletion, portability, or restriction of your personal data, and you may object to certain processing.
Workspace operators control their own end-user relationships; for data held on their behalf, please direct requests to that operator. We assist customers in fulfilling verified data-subject requests.
You can exercise these rights or ask questions by contacting the address listed in the changes and contact section.

Cookies and analytics

The dashboard uses strictly necessary cookies for authentication and session security, plus limited analytics to understand product usage and reliability.
We do not use advertising cookies or sell behavioral profiles. Where required, we honor consent and do-not-track signals according to applicable law.

Changes and contact

We may update this policy as the product and our compliance posture evolve. Material changes will be reflected in the "last updated" date and, where appropriate, announced in-product.
For privacy questions or data-subject requests, contact [email protected].