Privacy policy

1. Who is responsible

Qint is operated by SwizzX GmbH, Baarerstrasse 107, 6300 Zug, Switzerland. SwizzX GmbH is the controller for the processing described in this policy, unless a section says otherwise. You can reach us at info@qint.ch.

We apply the Swiss Federal Act on Data Protection (FADP) and, where it applies to people in the European Economic Area, the EU General Data Protection Regulation (GDPR). We have not appointed a data protection officer or an EU representative; all requests go to the address above.

2. What this policy covers

Qint has several surfaces, and each one touches different data:

• qint.ch — the public website, including the contact form.
• dashboard.qint.ch — the merchant dashboard where businesses manage payments, team members, API keys and payouts.
• Business verification — the know-your-business (KYB) check carried out by our execution partner before a merchant can transact.
• checkout.qint.ch — the hosted checkout and invoice pages that a merchant's customers ("buyers") use to pay.
• api.qint.ch and webhooks — the developer interface.

Custody of crypto assets, conversion to fiat, compliance checks and bank payouts are performed by our execution partner, 24crypto GmbH, Basel, a Swiss financial intermediary affiliated with the self-regulatory organisation VQF. Where 24crypto processes personal data under its own legal obligations (for example anti-money-laundering law), it does so as a controller in its own right.

3. Visiting qint.ch

The website sets no cookies, runs no analytics and loads no advertising or tracking scripts. That is why there is no cookie banner.

What is processed when you visit:

• Server logs. The site is served by Vercel. Like any web host, Vercel records short-lived request logs (IP address, browser type, page requested, time) to deliver pages and defend against abuse. We use them only to keep the site running.
• Fonts. The typefaces Inter and JetBrains Mono are served from qint.ch itself. Visiting the website makes no requests to third-party servers: no fonts, scripts or images are loaded from anyone but us.
• Contact form. If you write to us through the form, we receive the fields you fill in (name, work e-mail, company, message). The message is delivered to our mailbox by e-mail and we use it to answer you.

4. Merchant accounts and team members

When you open an account or are invited to a merchant's team, we process:

• Account data. Your e-mail address, a hash of your password (Argon2id — we never store the password itself), whether your e-mail is verified, and the role you hold in each merchant (Owner, Admin, Developer, Finance or Viewer).
• Two-factor authentication. If you enable it, an encrypted TOTP secret and hashed one-time recovery codes.
• Sessions. For every sign-in: a hashed session token, the IP address, the browser's user-agent string, and when the session was created, last used, expired or revoked.
• Acceptance of the terms. When you accept the General Terms and Conditions we keep evidence of it: the document version and its SHA-256 hash, the time you scrolled to the end, your e-mail, IP address, user-agent, a random device identifier stored in your browser, and browser metadata (platform, screen and window size, time zone, language, local clock, pixel ratio, number of CPU cores, touch support). We keep this so that we can show what was accepted, by whom and when, for 10 years from the acceptance, and then delete it (see section 10).
• Audit trail. Security-relevant actions (sign-ins and failed sign-ins, password changes, 2FA changes, team invitations, API key creation and revocation, exports and similar) are written to an append-only log with the acting user, the IP address and the time. Audit records of account and payment events are kept for 10 years from the event and then deleted (see section 10).
• Merchant profile. The business details you enter: legal and display name, country and registration number, business type, website, address, phone, support e-mail, logo and brand colour, statement descriptor, and the bank account for payouts (account holder, IBAN, currency).
• Team invitations. The invitee's e-mail address, the role offered and who sent the invitation.
• Notifications and e-mails. In-dashboard notifications and the e-mails we send about your account: verification, password reset, team invitations, verification status, suspensions, payment reviews and reversals.
• Support. Whatever you send us by e-mail when you ask for help.

5. Business verification (KYB)

Before a merchant can accept payments, the business and the people behind it are verified. Qint collects the information in the dashboard and transmits it to 24crypto, which carries out the verification together with its provider KYC Spider (online and video identification, document checks and sanctions screening).

• Company data: legal name, country of registration, registration number, business type, website, registered address and a compliance questionnaire about the business.
• People: for each director, beneficial owner or shareholder above 25 %: full name, e-mail, ownership share, gender, phone, date of birth, nationality, residential address and role. These people receive an invitation e-mail from Qint that names 24crypto and KYC Spider and leads them to the identification.
• Documents: company and identity documents you upload. Qint passes them to 24crypto and keeps no copy of its own; it stores only the status of the case and its reference.

The legal basis is the contract with you and the statutory anti-money-laundering duties of the execution partner (Swiss Anti-Money Laundering Act and VQF rules). Without this verification we cannot provide the service.

6. Paying through a Qint checkout

If you pay a merchant through a Qint payment link, invoice or checkout page, you do not need an account and we do not ask for your name. We process:

• The payment itself: amount and currency, the coin and network you chose, the deposit address issued for your payment, the expected and received crypto amount, the payment status and timestamps, and the execution partner's transaction reference. Qint itself does not store the address you paid from; our execution partner, 24crypto GmbH, records it under its anti-money-laundering duties and does so as a controller in its own right.
• Receipt e-mail (optional): if you ask for a receipt, the e-mail address you enter is stored with the payment and used to send the receipt.
• Invoice details: when a merchant sends you an invoice, the details on it (name, company, e-mail, address, tax ID) were entered by the merchant. Qint stores them for the merchant and sends the invoice and the payment confirmation on the merchant's behalf. For questions about those details, please contact the merchant; we will support them in answering you.

Qint does not store the IP address or browser details of buyers in its database; our hosting providers keep short-lived request logs as described above. The checkout page sets no cookies and loads no third-party scripts; it loads the typefaces Inter and JetBrains Mono from Google Fonts (fonts.googleapis.com / fonts.gstatic.com), whose servers therefore see your IP address and browser details.

Blockchain data is public. A transaction on a public blockchain is visible to anyone and cannot be deleted. The deposit addresses are operated by the execution partner, which processes the on-chain data needed to credit your payment.

7. API keys and webhooks

• API keys are shown once and stored only as a SHA-256 hash, together with a label, the key prefix, its scopes (read, write), who created it and when it was last used.
• Webhook endpoints: the URL you register, an encrypted signing secret and who created it.
• Delivery log: for each webhook delivery, the event type, the exact payload sent (payment data, no buyer e-mail), the number of attempts, the delivery time and the last error. The log lets you and us debug integrations.
• Requests to the API are rate limited per key; counters are kept in memory, not stored.

8. Purposes and legal bases

We process personal data to:

• provide the service and perform the contract with the merchant (account, dashboard, payments, invoices, payouts, support) — GDPR Art. 6(1)(b);
• meet legal obligations, in particular anti-money-laundering verification carried out by the execution partner, and bookkeeping and record-keeping duties — GDPR Art. 6(1)(c);
• keep the service secure: sign-in protection, session management, rate limiting, audit trail, abuse prevention, evidence of accepted terms — our legitimate interest, GDPR Art. 6(1)(f);
• send a receipt to a buyer who asks for one — consent, GDPR Art. 6(1)(a), which can be withdrawn at any time;
• answer your enquiries — contract or legitimate interest.

Under the Swiss FADP, processing is lawful without a specific legal basis as long as the principles of the Act are respected; the bases above are given for people to whom the GDPR applies. We do not use personal data for advertising, profiling or automated decisions with legal effect.

9. Recipients, processors and international transfers

We share personal data only with the parties needed to run the service:

Hosting providers act on our instructions under data processing agreements. Our application servers and database are located in the EU (Frankfurt). Where a provider is established in the United States or may access data from there, we rely on the provider's standard contractual clauses with the Swiss addendum and, where the provider is certified, the Swiss–U.S. and EU–U.S. Data Privacy Frameworks.

We disclose data to authorities only where the law requires it. The execution partner may be obliged to report to the Swiss Money Laundering Reporting Office or other authorities under its own obligations.

10. How long we keep data

We keep personal data only for as long as its purpose or a legal duty requires. The categories and periods below are those of our data retention schedule, which is the authoritative list and also gives the reason for each period:

• Merchant agreement / framework agreement: 10 years after termination of the business relationship.
• Merchant master data (company, address, UID/VAT no., contact persons): 10 years after termination, insofar as contractually relevant.
• Merchant bank / payout account details: 10 years from the end of the financial year of the last settlement or payout linked to them.
• Invoices, settlement statements, payout reports and fee statements: 10 years from the end of the financial year in which they were created.
• Transaction data relevant to accounting, settlement or reconciliation: 10 years from the end of the financial year in which they were created.
• Audit records of account and payment events, and records of the merchant's acceptance of the Terms & Conditions: 10 years from the event, then deleted.
• Historic versions of the Terms & Conditions: At least as long as any acceptance record that refers to the version is kept; preferably permanently version-archived.
• Buyer order / receipt / confirmation e-mails: 10 years if they document a transaction or accounting-relevant event.
• General support or marketing e-mails: Only as long as necessary; typically 1–3 years.
• Formal shareholder / corporate meeting minutes: At least 10 years.
• Ordinary internal meeting notes: As long as operationally necessary; 10 years for material decisions.
• Video / audio recordings of online meetings: Typically 30–90 days, then deleted unless specifically needed.
• Login / security / access logs: Typically 12 months.
• Logs subject to Art. 4 of the Swiss Data Protection Ordinance (DPO), where applicable: At least 1 year.
• Passport / ID copies of merchant representatives: Not automatically 10 years.
• Verification result / representation check: 10 years after termination of the business relationship, where retained as contractual evidence.
• Raw verification data: selfie, video, biometric material, temporary uploads: Deleted after verification plus a short complaint/security period; e.g. 90 days to max. 12 months unless justified.
• Identification and anti-money-laundering records held by the execution partner (24crypto): Kept by 24crypto for at least 10 years after the end of the business relationship or the completion of the transaction (Art. 7(3) AMLA).

Session records, sign-in logs and webhook delivery logs count as login, security and access logs. Sessions themselves expire after 30 days of inactivity and at the latest 90 days after sign-in. Request logs at our hosting providers are short-lived (see section 3).

A legal hold overrides these periods: if a dispute, chargeback, fraud case, regulatory inquiry, claim or litigation is pending or reasonably foreseeable, the affected records are kept until the matter is resolved. How we handle deletion requests is set out in the schedule.

11. How we protect data

Data is encrypted in transit (TLS) and at rest by our database provider; secrets such as 2FA seeds and webhook signing secrets are additionally encrypted by the application, and passwords, session tokens, API keys and recovery codes are stored only as hashes. Access is restricted by role. The full list of controls is on our Security page.

12. Cookies and browser storage

qint.ch and checkout.qint.ch set no cookies and store nothing in your browser.

The dashboard uses one strictly necessary cookie, qint_session, which keeps you signed in. It is HttpOnly, Secure and SameSite=Lax, is extended with each visit for up to 30 days and expires at the latest 90 days after sign-in. It also keeps three values in local storage: a random device identifier (qint:deviceId, part of the terms-acceptance evidence), the merchant you last worked in (qint:merchantId) and your display theme (qint:theme). None of these are used for tracking, so no consent banner is shown.

13. Your rights

You have the right to:

• ask whether we process personal data about you and receive a copy of it (access);
• have inaccurate data corrected (rectification);
• have data deleted where we no longer need it or have no legal duty to keep it (erasure);
• have processing restricted and to object to processing based on our legitimate interests;
• receive the data you gave us in a common machine-readable format (portability);
• withdraw consent at any time, for example for a receipt e-mail;
• complain to the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland or, if the GDPR applies to you, to your local supervisory authority.

Send requests to info@qint.ch. We may ask you to confirm your identity, for example by writing from the e-mail address of your account. Where data must be kept by law (business records, anti-money-laundering evidence) we will tell you, confirm in writing the date on which it will be deleted and restrict it until then. Requests about verification data held by 24crypto can be sent to us and we will forward them, or directly to 24crypto.

14. Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the current version. Material changes that affect merchants are announced in the dashboard or by e-mail.

15. Contact

SwizzX GmbH
Baarerstrasse 107
6300 Zug, Switzerland
info@qint.ch