What we collect
- Account details. Your name, email address and password. The password is stored only as a hash.
- Transactions from connected accounts. The rows your bank or e-wallet shows you, such as date, amount, type, balance, description and reference, sent to PaidHook by PaidHook Operator or the PaidHook browser extension.
- Payment notifications. If you use PaidHook Receiver on Android: the source app, title, text and time of notifications from the bank and e-wallet apps on its allow-list, plus an ID for the phone and for each notification. Notifications from other apps are not sent.
- Connected devices. A label, the bank or e-wallet, the account number and when each device was last online or checked.
- Integration settings. Your API keys (stored only as a hash), webhook URLs and signing secrets, and a log of webhook deliveries.
- Reconciliation files. Exports and statements you upload to PaidHook Reconcile, and the results of each run.
- Billing. Your plan, orders and their payment status. Payments are handled by our payment providers.
What stays on your devices
- PaidHook Operator keeps bank app passwords and its session on your computer, encrypted, with the key in the operating system's own vault (macOS Keychain, Windows Credential Manager or Linux Secret Service). They are never written to disk in plain text.
- The PaidHook browser extension does not store your internet banking PIN and never logs in to your bank by itself.
- PaidHook Receiver only works after you turn on Notification access for it in Android Settings, and you can turn it off at any time.
How we use it
- To show your transactions, devices and reconciliation runs in the dashboard and apps.
- To answer your API calls and send webhooks to the endpoints you add, so your system can approve matching orders.
- To run your subscription, and to protect accounts, for example by slowing down repeated failed log-ins.
Who we share it with
We do not sell your data. It leaves PaidHook only:
- to your own servers, through API keys and webhooks you set up;
- to our payment providers, to process the plan you buy;
- to the infrastructure providers that host PaidHook, to run the service.
Security
Traffic to PaidHook uses HTTPS. Passwords and API keys are stored as hashes, webhooks are signed with a secret only you and PaidHook know, and webhook URLs must be public HTTPS addresses.
Your choices
- Revoke API keys, remove webhooks or disconnect devices in the dashboard at any time.
- Turn off Notification access for PaidHook Receiver in Android Settings.
- Ask us to export or delete your account and its data by emailing [email protected].
Changes
When this policy changes we update the date at the top of this page. For important changes we also let you know by email.
Contact
Questions about this page: [email protected]. PaidHook is made by 0n3sec.