Privacy policy

Last updated 31 October 2026

In short: we collect very little. There is no email or name needed to use the Free plan, no cookies and no tracking. We store your test payments and webhook settings to run the service, and you can delete everything yourself at any time.

1. Who is responsible

The controller of your personal data is [operator name not set], [operator address not set]. Contact for any privacy question or request: [contact email not set].

2. What we process and why

Data	Why	Legal basis (GDPR)
Account data. A random account ID, a one-way fingerprint (hash) of your API key, your plan, monthly usage count, and the dates the account was created and last used. We never store the key itself.	To give you an account and enforce plan limits.	Contract (Art. 6(1)(b))
Test payment data you send. Amounts, currency, method, transaction types, your request IDs, results and status codes, and the last four digits of any test card number you send. The full card number is used only to decide the simulated outcome and is not stored. For 3-D Secure test payments we also keep the simulated message log (made-up device data and identifiers, with only the last four card digits) for your most recent 20 such payments, so you can read it in the 3-D Secure lab.	To run the simulation and show you your transactions.	Contract (Art. 6(1)(b))
Webhook settings and logs. The webhook URL you register, the secret used to sign events, and a log of recent delivery attempts (event type, time, response status or error).	To send you signed notifications and show you whether they arrived.	Contract (Art. 6(1)(b))
IP address. Held only in the server's memory for a short time to limit sign-ups and abuse. It is not written to our database. Our hosting provider may keep it in its network logs.	To keep the service secure and available.	Legitimate interests (Art. 6(1)(f))
Billing data (Pro plan only). Payment is handled by Stripe, which collects your payment details and billing information and issues invoices. We receive and store only a Stripe customer ID, a subscription ID and the subscription status. We do not see or store your card details or your email.	To sell and manage the Pro subscription, and to meet accounting and tax duties.	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Messages you send us. If you email us, we process the message and your address.	To answer you.	Legitimate interests (Art. 6(1)(f))

You are not required by law to give us any of this, but without it we cannot provide the service. We do not make decisions about you by automated means that have legal or similarly significant effects.

Please do not send real personal data or real card numbers to the service. It is a test tool, and the terms forbid it.

3. Cookies, browser storage and third parties on the site

The website sets no cookies and uses no analytics, advertising or tracking tools. It loads no scripts, fonts or images from other sites. To keep you signed in, the page saves your API key in your browser's local storage on your own device. You can remove it with "Forget key in this browser" or by clearing your browser's site data. That storage is strictly necessary for the page to work after a reload, and it is never sent to anyone except to this service as your API key.

4. Who receives data

Fly.io, Inc., our hosting provider. The service and its data volume run in Amsterdam, in the Netherlands (EU). Fly.io may process technical data such as IP addresses in network logs.
Stripe (Stripe Payments Europe, Ltd. and affiliates), only if you subscribe to Pro. Stripe is an independent controller for the payment and identity data it collects and has its own privacy policy.
The webhook URL you register receives the notification events about your own test payments. You choose that destination.
Authorities or advisers, where the law requires it or where we need to protect our legal rights.

We do not sell personal data.

5. Transfers outside the EU/EEA

Our data is stored in the EU. Fly.io, Inc. and Stripe are or have affiliates outside the EU/EEA (for example in the United States), so access from there is possible. Where this happens, it relies on safeguards such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask us for details at [contact email not set].

6. How long we keep data

Account, payment and webhook data: until you delete your account.
Test payments: we keep at most the latest 500 per account, and older ones are dropped automatically.
Free accounts that have not been used for 365 days are deleted automatically.
Pro accounts: while the subscription is active.
Invoices and payment records are kept by Stripe and by us for as long as tax and accounting law requires (often several years). Deleting your Zanboxx account does not delete these.
Hosting snapshots and backups can keep deleted data for a few days before it is overwritten.

7. Your rights

You have the right to ask for access to your data, correction, deletion, restriction of processing and a portable copy. You can object to processing that is based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time (we do not rely on consent for the core service).

Delete everything yourself: sign in with your key on the website and choose "Delete account", or call DELETE /v1/account with {"confirm": true}. An active Pro subscription is cancelled at the same time.
Your data: GET /v1/payments, GET /v1/webhook and GET /v1/usage return what we hold about your account in a machine-readable format.
For anything else, write to [contact email not set]. We answer within one month.

Because we do not store names or email addresses on the Free plan, we may not be able to link a request to you unless you prove you control the API key. You also have the right to complain to your national data protection authority, for example the supervisory authority in the EU country where you live or work.

8. Security

All traffic uses HTTPS. API keys are stored only as hashes. Access to the server is restricted to the operator. No system is perfectly secure, so please do not store anything sensitive in the service. If a breach affects your personal data, we will notify you and the authorities as the law requires.

9. Children

The service is for developers and businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

10. Changes

If we change how we handle personal data, we will update this page and the date at the top. For significant changes, we will also show a notice on the website.