Privacy Policy

Last updated: July 2026

This Privacy Policy explains how easyPay ("easyPay", "we", "us", "our") collects, uses and protects your personal information. It covers two services:

our website at https://easypay.money/, including the Apply Now enquiry form; and
the easyPay merchant app (iOS and Android), where businesses hold an account, onboard with a payment provider, and accept card payments.

Sections that apply only to one of these are clearly labelled. Where you act as a customer of a merchant paying through easyPay, your card details are handled directly by the payment provider — see §8 below.

1. Who we are

The controller of your personal information is Multi Channel Creative Ltd, a company registered in England and Wales (company number 08946867, VAT number GB 313 058 732) with its registered office at 25 Station Road, Office 5, Kings Heath, Birmingham B14 7SR, United Kingdom. We trade as "easyPay". We are registered with the UK Information Commissioner's Office under registration number ZB394739.

If you have questions about this policy or how your personal information is handled, contact us at [email protected].

2. Information we collect — website (easypay.money)

Information you give us — your name, business name, work email, phone number, monthly card volume, industry sector, preferred payment method and current provider, when you submit the Apply Now form.
Consent preferences — your choices about marketing communications and acceptance of the selected provider's terms.
Usage information — information collected automatically via cookies and analytics tools (see our Cookie Policy), including IP address, device and browser type, pages viewed, and referral source.

3. Information we collect — merchant app

When you sign up for and use the easyPay merchant app, we collect:

Account details — your name, email address, password (stored hashed, never in plain text), phone number, and date of birth (used to confirm you are 18 or over and to support the identity-verification ("KYC") requirements of your payment provider). When you sign up, sign in on a new device, or reset your password we send a one-time verification code to your email address.
Business details — your business or trading name, business type, address, and the country in which you operate.
Identity information passed to your payment provider — when you connect a payment provider (for example Stripe), the information that provider collects from you to complete its own identity and anti-money-laundering checks is governed by that provider's privacy policy. We hold a reference to your connected account so we can route your transactions to it.
Transaction information — for each payment you take we record the amount, currency, date and time, status (succeeded, failed, refunded, disputed, etc.), the platform fee, the processing fee, and an identifier from the payment provider. We do not store cardholder card numbers, expiry dates or CVV — those are handled directly by the payment provider.
Refund, payout and dispute records — generated by your activity and updates from your payment provider.
Your customers' contact details — if you choose to store contact details (name, email, phone) for the customers you take payments from, so that you can re-send receipts or payment links. You are the controller of those contact details; we process them on your behalf.
Devices and push notifications — when you sign in we register the device you are using and a push-notification token (issued by Apple Push Notification service or Google Firebase Cloud Messaging, via Expo) so we can send you notifications about payments, payouts and disputes. You can turn push notifications off in your device settings at any time.
Logs and security data — limited technical logs (IP address, timestamps, error diagnostics) that help us run the service securely and investigate problems. This includes brief request logs when a customer opens a payment link we host at easypay.money/pay/… before they are redirected to the payment provider's checkout page; these logs are kept for fraud prevention and security only.

The merchant app does not embed third-party advertising, tracking or in-app analytics SDKs.

4. How we use your information

Website (easypay.money):

To forward your enquiry to the payment provider you selected, so they can contact you with rates and options.
To operate, secure and improve our website.
To measure traffic and engagement using Google Analytics.
To send you marketing communications where you have opted in, and to comply with our legal obligations.

Merchant app:

To create and operate your easyPay account and to connect it to your chosen payment provider.
To enable you to accept card payments, take refunds and view your transaction history, payouts and disputes.
To send you push notifications about payments, payouts and disputes.
To meet our own legal, regulatory, accounting and anti-money-laundering obligations.
To protect our service against fraud and abuse, and to investigate security incidents.
To respond to support requests and to communicate service changes.

Account and transactional emails. We send service messages that are necessary to operate your account — verification codes, password resets, payment receipts, dispute alerts, deletion confirmations and security notices. These are not marketing communications and you cannot opt out of them while your account is open. Any genuinely promotional emails to merchants are sent only with your separate consent and you can withdraw that consent at any time.

5. Legal bases for processing

We process your personal information under the UK GDPR on the following legal bases:

Performance of a contract — operating your easyPay account, processing the payments you take, and providing the merchant app.
Steps taken at your request — passing your Apply Now enquiry to the selected provider before any contract exists.
Compliance with a legal obligation — keeping financial, tax and anti-money-laundering records, and responding to lawful requests from regulators or law enforcement.
Legitimate interests — running the website and app securely, preventing fraud, debugging, and improving our services. We balance these interests against your rights.
Consent — marketing communications and non-essential cookies. You can withdraw your consent at any time.

6. Who we share your information with

Website (Apply Now):

When you submit an application, the details you provide are shared with the payment provider you selected (for example Stripe, Worldpay, NatWest Tyl). That provider becomes an independent controller of your personal information and its own privacy policy will apply.

Merchant app:

Your connected payment provider — currently Stripe. Stripe is an independent controller for the payments it processes and for the identity information it collects to verify you. Stripe's handling of your information is governed by its own privacy policy at stripe.com/privacy.
Push-notification gateways — Expo (for delivery routing) and the operating-system gateways Apple Push Notification service and Google Firebase Cloud Messaging.
Infrastructure and operational providers — hosting, database, email-delivery and logging providers who process information on our behalf under contract.
Professional advisers and authorities — where required by law, to protect our rights, or in connection with a corporate transaction (such as a merger or sale of assets).

We do not sell your personal information.

7. International transfers

Some of our service providers (including Stripe, Google Analytics and our push-notification gateways) may process information outside the UK and the European Economic Area. Where they do, we rely on recognised safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy decisions where they exist.

8. Payments and cardholder data

Payments accepted through the easyPay merchant app are processed directly by the connected payment provider (currently Stripe). Cardholder card numbers, expiry dates and security codes are entered into, or read by, interfaces controlled by that provider and do not pass through, and are not stored by, easyPay. The provider acts as an independent controller of that information; its own privacy policy applies. For each payment we receive only the outcome from the provider — the amount, currency, date, status, the card brand and (where available) the last four digits of the card, and an identifier we can use to look the payment up.

Tap to Pay (contactless on the merchant's phone). When you accept a contactless payment using Tap to Pay on iPhone or the equivalent Android flow, the customer's card or device is read by the NFC reader built into your phone. The card data is transmitted directly from that reader to the payment provider's Terminal service — easyPay never sees the card number. We hold only the resulting transaction record described above.

Payment links and QR codes. When you share a payment link or QR code, the customer is taken to a checkout page hosted by the payment provider (for example Stripe Checkout). The customer's email address and card details are collected by the provider on that page. easyPay receives the outcome of the payment, as described above, and — for payment links — the customer's email address if the provider returns it, so that the merchant app can show you who paid.

9. How long we keep your information

Website:

We retain Apply Now enquiries for as long as needed to service the enquiry and for a reasonable follow-up period, and for longer where required by law (for example, for tax or audit purposes). Analytics data is retained in line with our Google Analytics settings.

Merchant app:

We retain your account information for as long as your account is open. When you delete your account (§10), we permanently remove the personal information listed there.

We are legally required to keep certain records of payment activity even after you close your account. Where this applies, we retain records of your transactions, refunds and payouts for the periods required by law — for example, up to six years for tax records and five years under the Money Laundering Regulations 2017. Before retaining these records we anonymise them: we remove the information that identifies you or your customers, keeping only the financial data (such as amounts, dates and reference IDs) needed to meet these obligations. Our lawful basis for this retention is compliance with a legal obligation, which is an exception to the right to erasure under Article 17(3)(b) of the UK GDPR.

10. Deleting your easyPay account

You can delete your easyPay account and personal data at any time:

In the app — go to Settings → Delete account and confirm with your password.
On the web — go to easypay.money/account/delete, enter your account email and confirm with the code we send you. No app or login required.
By email — contact us at [email protected] from your registered email address and we will action your request.

When you ask us to delete your account, we begin a 72-hour cooling-off period. During this time your account is scheduled for deletion but not yet removed, and you can cancel the request — from within the app, or using the link in the confirmation email we send you. After 72 hours, the deletion is carried out and cannot be undone.

What we delete. When the deletion is carried out, we permanently remove:

your account profile — your name, email address, phone number and date of birth;
your registered devices and push-notification tokens; and
the contact details (name, email, phone) you have stored about your own customers for sending receipts.

We also disconnect your connected payment provider account from easyPay. Where you have opted in (in the app) to also close your Stripe account, we will request its closure when your balance is zero; otherwise we leave it in place so you retain access to your own payout and tax history with the provider. Stripe retains its own records as an independent controller and in line with its legal and regulatory obligations — see stripe.com/privacy.

What we keep. Anonymised transaction, refund and payout records, retained for the periods set out in §9.

11. Your other rights

Under UK data protection law you have the right to access, correct, restrict, port or object to our processing of your personal information, in addition to the right of erasure described in §10. You also have the right to withdraw consent at any time, and to lodge a complaint with the Information Commissioner's Office (ico.org.uk). To exercise any of these rights, email [email protected].

12. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. Passwords are stored hashed, traffic to our services is encrypted in transit, and access to production systems is restricted. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

13. Children

The easyPay merchant app is intended for use by people aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows when this policy was last revised. Material changes will be communicated on this page and, where appropriate, in the merchant app.