KleanPay Legal
Privacy Policy
1. Introduction
KleanPay Sàrl is committed to protecting user privacy. This Policy explains how we collect, use, store, share and protect personal data when you use the KleanPay platform.
The platform allows professional Sellers to receive escrow payments and authorised Buyers, companies or private individuals, to fund projects and milestones. Payment flows, fund holding and regulatory checks are operated by OPP Worldline.
2. Controller
- Company:
- KleanPay Sàrl
- Address:
- Chemin des Taborneires 8, 1350 Orbe, Switzerland
- Email:
- contact@kleanpay.ch
For identity verification, KYC/KYB, payment and escrow data processed directly by Online Payment Platform B.V. (OPP / Worldline), OPP acts as an independent controller or regulated provider depending on the processing concerned.
3. Legal framework
This Policy is primarily governed by the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance.
The GDPR may apply additionally when data of persons located in the European Union is processed or when a provider is subject to it.
4. Personal data collected
| Category | Examples |
|---|---|
| Company Buyers | Company name, UID, registered office address, contact person, email, phone. |
| Private Buyers | Name, email, phone and, where needed, information required for a refund or OPP verification. |
| Sellers | Company name, UID, registered office address, contact person, IBAN, KYB status and information required to receive funds. |
| Authentication | Account credentials, session metadata, login timestamps, security information and WebAuthn/passkey metadata where applicable. |
- Project descriptions, milestones, deliverables, acceptance criteria and schedules.
- Amounts, funding statuses, release statuses, refunds and KleanPay commissions.
- OPP references, transaction statuses, KYC/KYB statuses and webhook events.
- Uploaded documents: contracts, project files, delivery evidence, dispute evidence and QR invoices.
- Messages, notifications, comments and communication elements between the parties.
- IP addresses, browser, operating system, device identifiers, session data and audit logs.
5. Legal bases and purposes
| Legal basis | Main purposes |
|---|---|
| Contract performance | Account creation and management, project and milestone coordination, notifications, validation and dispute facilitation. |
| Legal obligations | Commercial records, accounting, tax obligations, cooperation with authorities and preservation of audit evidence. |
| Overriding interest | Platform security, fraud prevention, transaction monitoring, logging, user support and service improvement. |
| Consent | Non-essential marketing communications when enabled separately. |
6. Hosting and data location
KleanPay’s main application data is hosted in a self-hosted Convex deployment operated on servers located in Switzerland. This infrastructure serves as the database, application backend, server functions and business source of truth for the Platform.
Production backups are encrypted and stored in a Swiss region separate from the main server, according to the internal backup and disaster recovery policy.
7. Data sharing and providers
| Provider / category | Purpose | Main location |
|---|---|---|
| Self-hosted Convex | Backend, database, server functions, realtime, application storage and audit trail. | Switzerland |
| OPP Worldline | Payments, escrow, KYC/KYB, IBAN verification, webhooks and regulatory compliance. | Netherlands / EU |
| Resend or equivalent email provider | Transactional emails, security alerts and service notifications. | European Union or Switzerland |
| Vercel or equivalent frontend host | Web interface, static assets, deployments and network security. | Switzerland or European Union |
| Zefix / Swiss public registers | Verification or pre-filling of company information. | Switzerland |
| PostHog or equivalent analytics tool, if enabled | Product usage measurement, diagnostics and improvement, preferably aggregated or pseudonymised. | European Union or Switzerland |
Where data is transferred outside Switzerland, KleanPay ensures that an appropriate level of protection exists, including adequacy decisions, standard contractual clauses or equivalent safeguards.
8. Data security
- Encryption of communications in transit (TLS).
- Encryption of data and backups where technically applicable.
- Role-based access controls and least privilege.
- Strong authentication for critical actions where available.
- Timestamped logging of sensitive actions and append-only audit trail.
- Monitoring of fraud alerts and transmission of confirmed suspicious cases to OPP.
Biometric data used by passkeys or WebAuthn remains processed by the User’s device or authentication system. KleanPay does not receive fingerprint or facial biometric templates.
9. Data retention
| Category | Indicative retention period |
|---|---|
| Account data | For the account duration, then up to 2 years after closure unless a legal obligation or dispute is ongoing. |
| Transaction, escrow, accounting and audit trail data | 10 years, in line with recordkeeping and accounting obligations. |
| KYC/KYB statuses and OPP references | For the service duration, then retained according to audit obligations; complete KYC/KYB documents are primarily managed by OPP. |
| Dispute or fraud files | 10 years from file closure where necessary for legal defence, audit or compliance. |
| Technical and security logs | Usually 12 months, unless incident, fraud, legal obligation or security need requires longer retention. |
| Marketing communications | Until consent is withdrawn or the user unsubscribes. |
10. Your rights
- Right of access to personal data processed about you.
- Right to rectify inaccurate or incomplete data.
- Right to erasure when retention is no longer necessary or legally required.
- Right to restriction or objection for certain processing.
- Right to portability where legal conditions are met.
- Right to information about recipients, international transfers and retention periods.
To exercise your rights, contact us at contact@kleanpay.ch. We generally respond within 30 days and may request reasonable identity verification.
11. Cookies, sessions and tracking
The Platform uses cookies and similar technologies strictly necessary for authentication, session management, security, fraud prevention and service operation.
We do not use third-party advertising cookies. If analytics tools are enabled, they are configured to limit data collection and favour aggregated or pseudonymised measurements.
12. Automated decisions
KleanPay does not make fully automated individual decisions producing significant legal effects. Alerting rules may flag a transaction or account for human review in security or fraud prevention matters.
OPP may apply its own automated compliance, payment or fraud prevention controls as part of its regulatory obligations.
13. Protection of minors
KleanPay services are not intended for persons under 18. We do not knowingly collect personal data from minors.
14. Data breaches
In the event of a data breach likely to create a high risk, KleanPay will notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible in accordance with the FADP.
Affected Users will be informed where required by law or where the information is necessary to reduce the risk.
15. Changes to this policy
- We will publish the updated policy on the Platform.
- We will notify Users by email in case of material changes.
- We will indicate the last update date.
16. Complaints
If you believe your data protection rights have been violated, you may contact us directly at contact@kleanpay.ch.
17. Contact
- Company:
- KleanPay Sàrl
- Email:
- contact@kleanpay.ch
- Website:
- kleanpay.ch
- Address:
- Chemin des Taborneires 8, 1350 Orbe, Switzerland
Last updated : June 2026