Privacy Policy

This policy describes how FinLinks Technology Ltd. handles merchant account data in the FINLINKS portal.

Account records include the business name, email address, generated merchant ID, password hash, email verification state, and authenticator status. Passwords are stored only as hashes. The authenticator shared secret is stored encrypted on the server so sign-in can be checked. Backup codes are stored only as hashes.

The portal keeps two cookies: finlinks-auth-token for the session, and finlinks-merchant-id for the merchant ID. A short-lived sign-in challenge for an authenticator code stays in page memory and is not written to a cookie. Transaction PIN material is also kept in memory for the signing step and is not written to a cookie.

Verification, password reset, and security notices are sent through Mailgun to the email address on the account. Those messages contain a single-use link. Invoice, ledger, payout, and refund activity is processed by the FinLinks service so the portal can show it back to the signed-in merchant.

Questions about this policy can be sent through the contact details published on finlinks.io.