Legal

SONRAILS PRIVACY POLICY

Effective Date: 13th October, 2026

Sonrails (“Sonrails,” “we,” “us,” or “our”) develops and provides software infrastructure for businesses seeking to integrate blockchain-based payment functionality into their websites, applications, and business systems.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, create an account, use our software, integrate our APIs, access our dashboard, contact our team, or otherwise interact with our technology services.

Our services are designed to help businesses create payment requests, provide payment instructions, monitor blockchain transactions, receive automated payment notifications, and facilitate settlement directly to merchant-designated wallets.

Sonrails is designed to provide payment technology infrastructure rather than hold or maintain merchant funds. However, operating software and transaction-monitoring services may involve processing personal information, technical identifiers, and transaction-related data.

This Privacy Policy should be read together with our Terms and Conditions and any applicable service agreement.

This Policy applies to information processed through:

  • The Sonrails website and associated online services.
  • Merchant registration and account-management systems.
  • Our software platform, dashboard, and hosted payment interfaces.
  • APIs, SDKs, webhooks, plugins, and other integrations.
  • Technical support, customer communications, and business enquiries.
  • Security, monitoring, analytics, and service-improvement activities.

Where a Merchant uses Sonrails to collect information from its own customers, the Merchant may have separate privacy obligations and responsibilities. The respective roles of Sonrails and the Merchant depend on how the relevant information is collected and used.

We collect information that is reasonably necessary to operate, secure, maintain, and improve our technology services.

3.1 Account and business information

When a Merchant registers or communicates with us, we may collect:

  • Name and business name.
  • Email address and telephone number.
  • Business address and country of operation.
  • Account credentials and authentication information.
  • Business website and integration details.
  • Billing and subscription information.
  • Information reasonably required to verify an account or assess service eligibility.

The information collected depends on the Services requested and the circumstances of the relationship.

3.2 Technical and device information

When you access our website or Platform, we may collect technical information such as:

  • IP address.
  • Browser type and version.
  • Device and operating-system information.
  • Access times and session information.
  • Referring pages and general usage activity.
  • Error logs, diagnostic information, and performance data.
  • Security events and attempted unauthorized access.

We use this information to maintain platform reliability, diagnose technical issues, prevent abuse, and protect our systems.

3.3 Payment and transaction-related information

When a Merchant uses Sonrails technology to create or monitor a payment request, we may process information such as:

  • Payment request identifiers and order references.
  • Requested and reported payment amounts.
  • Supported digital asset and blockchain network.
  • Merchant-designated wallet addresses.
  • Public transaction hashes and blockchain addresses.
  • Transaction timestamps and confirmation status.
  • Payment-related metadata supplied by the Merchant.
  • Webhook delivery records and integration logs.
  • Information concerning pending, incomplete, duplicate, partial, or excess payments.

Depending on the integration, transaction metadata may also contain information that identifies or can reasonably be linked to a Customer.

We use this information to provide payment-related software functionality, monitor transaction activity, reconcile payment requests, deliver notifications, troubleshoot integrations, and maintain technical records.

3.4 Communications and support information

If you contact us, we may collect your contact details, the content of your enquiry, attachments you provide, support history, and information needed to investigate and resolve the matter.

3.5 Cookies and similar technologies

We may use cookies, local storage, and similar technologies to:

  • Maintain sessions and account security.
  • Remember preferences.
  • Understand website performance and usage.
  • Diagnose errors.
  • Measure the effectiveness of our website.

Where required by law, we will request consent before using non-essential cookies or similar technologies. You may also be able to control cookies through your browser settings.

3.6 Information from third parties

We may receive information from service providers, integration partners, publicly available blockchain data, fraud-prevention services, or other sources where permitted by law.

We use such information only for relevant purposes, such as verifying transaction status, protecting the Platform, maintaining integrations, or complying with legal obligations.

Sonrails may use information for the following purposes:

  1. Providing technology services: To create payment requests, operate the dashboard, support APIs, monitor transactions, and provide payment status notifications.
  2. Account administration: To register users, manage access, communicate with Merchants, and provide customer support.
  3. Technical operations: To maintain, troubleshoot, test, and improve our software and infrastructure.
  4. Security and fraud prevention: To detect unauthorized access, abuse, suspicious activity, and threats to the Platform.
  5. Service communications: To send account notices, technical updates, incident notifications, and relevant service information.
  6. Billing and administration: To manage subscriptions, invoices, fees, and business records.
  7. Product development: To analyze aggregated usage patterns, improve functionality, and develop new technology features.
  8. Legal compliance: To comply with applicable laws, lawful requests, contractual obligations, and relevant regulatory requirements.
  9. Dispute resolution: To investigate technical incidents, respond to complaints, and protect our rights and the rights of others.

We aim to collect and use only information reasonably necessary for the purposes described in this Policy.

Sonrails provides software and technical infrastructure that can be integrated into a Merchant’s business systems.

Our technology is designed to support direct settlement to merchant-designated wallets. Sonrails does not intend to hold or maintain merchant funds in a custodial account as part of this design.

However, not holding merchant funds does not mean that no information is processed. We may still process transaction references, wallet addresses, technical logs, payment status information, and other data needed to operate the Platform.

The fact that a blockchain wallet address is publicly visible does not necessarily mean that information associated with it cannot be personal data. For example, an address may become identifiable when combined with other information.

We do not claim ownership of publicly available blockchain data simply because our software accesses or analyzes it.

A Merchant using Sonrails remains responsible for providing its customers with appropriate privacy information and establishing a lawful basis for the personal information it collects and shares with us.

Where applicable data protection law requires a lawful basis for processing, Sonrails may rely on one or more of the following:

  • Contract: Processing necessary to provide requested services or fulfil contractual obligations.
  • Legitimate interests: Processing necessary for legitimate business interests, such as securing the Platform, preventing abuse, and improving technical reliability, where those interests are not overridden by applicable rights.
  • Legal obligations: Processing required to comply with applicable laws or lawful orders.
  • Consent: Processing based on your consent, where consent is required or is the appropriate legal basis.

Where we rely on consent, you may withdraw it as permitted by law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The applicable legal basis depends on the information involved, the purpose of processing, and the laws that apply to the particular activity.

Sonrails does not sell personal information to third parties for their own direct marketing purposes.

We may share information in the following circumstances.

8.1 Technology and infrastructure providers

We may share relevant information with providers that help us operate the Platform, such as cloud hosting providers, database services, security vendors, monitoring tools, communications providers, and technical support services.

These providers may process information on our behalf under appropriate contractual or other safeguards.

8.2 Blockchain networks

Transactions submitted to public blockchain networks may expose transaction details, wallet addresses, amounts, timestamps, and other network-specific information publicly.

Public blockchain records are generally controlled by the relevant network and its participants, not by Sonrails. We may be unable to modify or delete information already recorded on a public blockchain.

8.3 Merchants and their service providers

We may provide payment status information, transaction references, and related technical data to the Merchant whose payment request is being processed, or to service providers authorized to support that Merchant’s integration.

8.4 Professional advisers and business partners

Where necessary, we may disclose relevant information to our lawyers, auditors, accountants, insurers, or other professional advisers, subject to appropriate confidentiality obligations.

8.5 Legal, regulatory, and security requirements

We may disclose information where reasonably necessary to comply with applicable law, respond to lawful requests, investigate suspected fraud, protect rights and safety, or enforce our agreements.

8.6 Corporate transactions

Information may be transferred as part of a merger, acquisition, financing, restructuring, or sale of business assets, subject to applicable confidentiality and data protection requirements.

8.7 With your direction or consent

We may share information where you request or authorize us to do so, or where another lawful basis permits the disclosure.

Sonrails may use infrastructure and service providers located in different countries. As a result, information may be processed or accessed outside the country in which it was collected.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing Services, maintaining security, meeting contractual obligations, resolving disputes, and complying with legal requirements.

Retention periods may vary depending on the type of information and the reason it is held.

For example:

  • Account information may be retained while an account remains active and for a reasonable period afterwards.
  • Technical and security logs may be retained for operational, investigation, or security purposes.
  • Transaction references and related records may be retained for reconciliation, support, contractual, or legal purposes.
  • Billing and accounting records may be retained for periods required by applicable law.
  • Support communications may be retained as necessary to resolve enquiries and maintain relevant business records.

When information is no longer required, we will take reasonable steps to delete it, anonymize it, or securely dispose of it, subject to legal and technical limitations.

Deleting information from Sonrails’ systems does not necessarily remove corresponding records from public blockchain networks or independent third-party systems.

Sonrails uses reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Depending on the Services and the risks involved, these measures may include access controls, authentication safeguards, encryption where appropriate, monitoring, backups, vulnerability management, and incident-response procedures.

No system, network, or method of electronic storage can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

Merchants are responsible for protecting their own systems, API credentials, private keys, wallet access, and integrations. They should use secure authentication, restrict access to authorized personnel, and notify us promptly of suspected compromise affecting the Platform.

If we become aware of a personal data breach affecting information for which we have relevant responsibilities, we will assess the incident and take reasonable steps to contain, investigate, and address it.

We will provide notifications to affected parties and relevant authorities where required by applicable law.

Depending on your location and the applicable law, you may have rights to:

  • Be informed about how your personal information is used.
  • Request access to personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of personal information where legally applicable.
  • Withdraw consent where processing is based on consent.
  • Request a portable copy of certain information where applicable.

These rights are subject to applicable legal conditions, exemptions, and limitations. For example, we may need to retain certain records to comply with legal obligations, establish or defend legal claims, or maintain essential security records.

To exercise a privacy right, contact us using the details in Section 20. We may request information reasonably necessary to verify your identity and protect against unauthorized disclosure.

The Platform is designed for businesses, developers, and users who are legally able to use the relevant Services.

Our Services are not intended to collect personal information directly from children in circumstances where doing so would violate applicable law.

If we become aware that we have collected personal information from a child in violation of applicable requirements, we will take reasonable steps to address the situation.

Sonrails may use automated technical processes to monitor transactions, detect unusual system activity, identify errors, assess integration performance, and improve platform security.

These processes are designed to support the operation of our technology services. They do not necessarily involve decisions about an individual’s legal rights or similarly significant matters.

If we introduce automated processing that triggers additional legal obligations or materially affects individuals, we will provide the notices and safeguards required by applicable law.

Our website or Platform may contain links to third-party websites, documentation, wallet providers, blockchain explorers, or external services.

Those third parties operate under their own privacy policies and terms. Sonrails does not control their independent privacy practices and encourages users to review the relevant policies before providing personal information.

A link or integration does not, by itself, mean that Sonrails endorses or controls the third party.

Where we use cookies or similar technologies, we may provide a cookie notice or preference tool explaining the available choices.

You may be able to disable or delete cookies through your browser settings. Some essential cookies may be required for login, security, and core website functionality, so disabling them may affect the operation of certain features.

Where required by law, non-essential analytics or advertising technologies will be used only after obtaining the necessary consent.

We may update this Privacy Policy to reflect changes in our technology, services, information practices, or legal obligations.

The updated version will be published on our website with a revised “Effective Date” date.

We encourage users and Merchants to review this Policy periodically.

This Privacy Policy will be interpreted in accordance with applicable data protection laws and any relevant contractual terms, subject to mandatory legal requirements.

If you believe that your personal information has been handled improperly, you may contact Sonrails so that we can review your concern.

For questions about this Privacy Policy, requests concerning personal information, or other privacy-related matters, contact:

Sonrails — Privacy Team

  • Website: www.sonrails.com
  • Privacy Email: legal@sonrails.com