zerofive
Request access

Privacy Policy

What zerofive collects, why we need it, and how you can exercise your privacy rights. This covers merchants, team members, customers and website visitors.

Effective 1 November 2026

1.Who is responsible for your data

ZeroFive, established in Hong Kong, operates zerofive at z5.gg. Our registered address is Hong Kong (full address to follow). Contact [email protected] about this policy or your personal data.

As a company established in Hong Kong, we also handle personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486).

We act as controller when we decide why and how to use data to run accounts, process payments, secure the platform and meet our own legal obligations. Merchants are responsible for their own customer relationships, order records and privacy notices. Where we handle customer data solely on a merchant's instructions, we act as its processor under our Data Processing Agreement at /dpa.

We receive information from you, from the merchant you pay, from authorised team members, from your browser, from public blockchain and screening sources, and from public registers and other independent sources we use to check a business. A merchant may give us your email, customer reference, invoice details or subscription information before you visit zerofive.

2.What we collect and why

WhatAccount and business details: name, email, store details, team membership, permissions and account preferences.
Why and on what basisCreate and manage accounts, communicate with you and provide the service. Contract where you are our contracting user; legitimate interests in administering a business customer's account for its representatives and team members.
WhatSecurity information: password hashes, two-factor authentication setup, recovery-code records, login challenges, sessions and API credential records.
Why and on what basisAuthenticate users and protect accounts and funds. Contract where needed to provide your account; legitimate interests in preventing unauthorised access and fraud.
WhatPayment records: wallet and deposit addresses, transaction hashes, coin, network, amounts, fees, confirmations, balances, refunds and payouts.
Why and on what basisDetect, settle and reconcile payments and investigate errors. Contract for services requested by our users; legitimate interests in providing payment services to merchants and their customers. Legal obligation where applicable accounting or other laws require records.
WhatCustomer and billing information: names or references, email addresses, invoices, subscriptions, order descriptions and metadata submitted by the merchant or payer.
Why and on what basisConnect payments to the right customer, send receipts and renewal messages, and support refunds. Contract where we provide a service directly to you; otherwise legitimate interests in operating the merchant's payment service. Where we act only as processor, the merchant determines the legal basis.
WhatTip information: supporter name, amount and message, plus an email address if provided.
Why and on what basisProcess the tip, send a receipt and deliver the requested message to the merchant. Legitimate interests in providing the tipping service. Merchant-selected tip walls and broadcast overlays may display the name, amount and message.
WhatTechnical information: IP address, browser and device information, request and error logs, country or region signals, and security audit records.
Why and on what basisDeliver pages, limit abuse, enforce location restrictions and troubleshoot failures. Legitimate interests in keeping the service secure and available; legal obligation where a particular restriction is required by applicable law.
WhatVerification information, where we ask for it: for a merchant and the people who own, control or act for it, names, dates of birth, nationality, addresses, identity documents, company documents, licences, ownership details and source-of-funds information. A merchant that gives us details of its owners or representatives must tell them it has done so and point them to this policy.
Why and on what basisVerify who we do business with and meet anti-money-laundering and sanctions duties, as the AML and KYC Policy at /aml describes. Legal obligation where applicable law requires these checks; otherwise legitimate interests in preventing financial crime and sanctions breaches.
WhatRisk information: sanctions and issuer-freeze matches, screening results, restricted addresses, payment timing, volume, destinations, store age, review notes and supporting information requested during a review.
Why and on what basisScreen transfers, detect suspicious pass-through activity and review restrictions. Legitimate interests in preventing fraud and misuse; legal obligation where a specific law requires screening, retention or disclosure.
WhatMessages to support and records of complaints or privacy requests.
Why and on what basisAnswer you, resolve disputes and keep a record of the outcome. Contract where relevant; legitimate interests in handling enquiries and defending claims; legal obligation for applicable privacy requests.

Some information is needed to open an account, process a payment or complete a review. If you do not provide it, we may be unable to provide that part of the service. Optional fields are not a condition of using unrelated features. Do not put private keys, passwords, identity documents or unnecessary sensitive data in invoice metadata or tip messages.

When we rely on legitimate interests, we consider the purpose, necessity and effect on your rights. Using zerofive is not blanket consent to data processing. If we ask for consent for a separate purpose, we will explain it and how to withdraw it.

3.Blockchains and public tip content

Blockchain addresses, transfers, amounts and transaction histories are public and generally permanent. They can be linked to a person when combined with other information. Sending or receiving crypto publishes data to a network we do not control. We cannot erase or edit a blockchain record.

We query blockchain providers using addresses and transaction identifiers. Those providers can see the queries and our server's connection information. We do not need to send your account password or customer email to look up a blockchain transfer.

A tip's name, amount and message may appear on a merchant's public supporter wall, public feed or OBS overlay, including in recordings of a broadcast. Avoid putting private information in those fields. Ask the merchant about removing content from its page or broadcast; we cannot remove copies others have made.

Treat checkout, deposit, subscription-management and receipt links as private. People who receive a link may be able to see payment details or use the actions it permits. Do not post claim links or private overlay links publicly.

4.Service providers and other recipients

We use the providers below to operate the service. Some act as processors for us; others operate public networks or act as independent controllers for their own services. The location of our main server does not mean all processing stays in the EU.

ProviderHetzner
Role, data and locationHosts the application and database in the EU and stores encrypted off-site backups in the EU. The hosted system contains the account and transaction records described above.
ProviderCloudflare
Role, data and locationProvides the network proxy and security layer. Processes traffic and connection information, including IP addresses and location signals. Operates a global network, with processing potentially outside the EU.
ProviderResend
Role, data and locationDelivers account, security, payment and subscription emails. Receives recipient addresses and message content, which can include transaction or login details. Processes customer data in the United States.
ProviderQuickNode
Role, data and locationProvides blockchain nodes and address monitoring. Receives watched addresses, blockchain queries and transaction data. Uses distributed infrastructure; processing may take place outside the EU.
ProviderPublic blockchain APIs
Role, data and locationDepending on the network and fallback used: Blockscout, PublicNode, Tenderly, NodeReal, network-operated RPC endpoints, TronGrid, mempool.space, litecoinspace.org, Blockstream, BlockCypher, Atomic Wallet's Dogecoin API, Haskoin, Blockchain.com and TON Center. Receive queried addresses, transaction identifiers or submitted blockchain transactions. Operators and server locations vary worldwide.
ProviderMarket-data APIs
Role, data and locationBinance, CoinGecko and TonAPI supply exchange-rate data. Requests concern coin symbols or identifiers, not customer account records. Providers can receive our server's connection information; infrastructure may be outside the EU.
ProviderTronSave
Role, data and locationSupplies Tron network energy where that option is used. Receives blockchain addresses and transaction information needed to allocate energy. Provider infrastructure may be outside the EU.
ProviderPublic block explorers
Role, data and locationLinks may open Etherscan, Basescan, Arbiscan, Optimism's explorer, Polygonscan, BscScan, Snowtrace, PlasmaScan, Arc or Tempo explorers, Tronscan, mempool.space, litecoinspace.org, Blockchair, Solscan or Tonviewer. If you follow a link, that site receives the requested address or transaction and your browser's connection information. These independent sites have their own policies and locations.
ProviderGitHub
Role, data and locationUsed for an external uptime check and to fetch a public OFAC address-list mirror. We do not send merchant or customer records with those checks or list downloads. GitHub may process technical connection data outside the EU.
ProviderSanctions list publishers
Role, data and locationWe download the public sanctions lists of the United Nations, the European Commission and the US Treasury. Names are matched on our own servers: we send them no merchant or customer records. They receive our server's connection information.
ProviderTelegram
Role, data and locationDelivers internal operational alerts to the people running zerofive. Alerts can contain merchant names, payment amounts, networks, review reasons and error details. It is not a customer messaging channel. Telegram's infrastructure may process these messages outside the EU.

Merchants and their authorised team members receive the payment and customer information needed to operate their stores. Merchant-configured webhooks and email notifications can send that information to systems the merchant controls. The merchant is responsible for those destinations and its own privacy practices.

We may share relevant information with professional advisers, courts or public authorities where lawfully necessary to obtain advice, resolve claims or meet a legal duty. We do not sell personal data or use advertising trackers. We do not use a third-party visitor analytics tracker in the application.

5.Transfers outside the EU

Our main hosting and off-site backup storage are in the EU. Email delivery, global network services, blockchain providers and internal alerts can involve transfers outside the European Economic Area, including to the United States. The protections available under local law may differ.

Where GDPR transfer rules apply, a transfer needs a valid mechanism, such as an applicable adequacy decision or appropriate contractual safeguards and any necessary supplementary measures. The safeguards we use are the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies. The providers that process customer data for merchants are listed at /dpa#subprocessors.

Write to [email protected] for information about the mechanism used for a particular transfer or a copy of relevant safeguards, with confidential information redacted where necessary. Public blockchain records are distributed globally; we cannot select where every network participant keeps a copy.

6.How long we keep data

We keep account and operational data for as long as needed to provide the service, maintain security and resolve outstanding matters. Financial records, and the verification, screening and monitoring records described in the AML and KYC Policy at /aml, are kept for the period required by applicable accounting, tax, anti-money-laundering or other laws. A genuine legal claim, investigation or preservation duty can require longer retention of relevant records.

The detailed schedule, including periods for financial records, closed accounts, support messages, security logs and backups, is: payment, transaction and account records, including merchant verification, screening and review records, for seven years after the account closes, which meets Hong Kong's record-keeping requirements for business and anti-money-laundering records; complaint records for three years after the complaint is closed; server logs for up to 90 days. Deleting an account does not immediately erase records we must retain.

Encrypted backups contain database snapshots. The backup system uses storage locks of 30 days for hourly copies and 400 days for monthly copies. These are minimum lock periods, not promises that every copy is deleted on those dates. Data in a locked copy cannot be individually removed before its lock expires. Backup deletion and any longer retention must follow the retention schedule.

We delete or anonymise personal data when it is no longer needed and no retention duty applies. This applies to records we control; it does not remove public blockchain history or copies independently held by a merchant or another recipient.

7.Cookies and browser storage

The application uses the following first-party cookies and browser storage. They support login, payment claims or a display preference. We do not use them for advertising or cross-site profiling.

Namezf_session
Purpose and durationKeeps you signed in and connects requests to your account. Expires after 30 days; removed on logout. The merchant's live/test setting is held in the server-side session, not a separate mode cookie.
Namezf_mfa
Purpose and durationConnects the login flow to a pending second-factor challenge. Expires after 10 minutes and is cleared when verification succeeds.
Namezf_admin_mode
Purpose and durationRemembers an administrator's live/test view within /admin. Expires after 365 days. This is for platform administrators, not ordinary checkout visitors.
Namezf_claim_<invoice id>
Purpose and durationKeeps the payer's claim token so the same browser can request an eligible overpayment refund. Scoped to that invoice's checkout API. Expires after 60 days; the self-service claim window is still only 30 days after payment.
Namezf-sliced (sessionStorage)
Purpose and durationRemembers that the logo's introductory animation has played in this tab. This is browser session storage, not a cookie. It lasts for the tab session and is not sent with HTTP requests.

Your browser lets you block or delete cookies and clear session storage. Blocking login or claim cookies can prevent those functions from working. If you lose an overpayment claim cookie, use the link in your receipt email or contact the merchant.

Cloudflare may set additional security cookies if a challenge or security feature is activated. Their use and duration depend on that feature. They are separate from the application cookies listed above.

8.Automated checks and human review

Automated checks compare addresses with sanctions and issuer restrictions, compare merchant, team member and customer names with the UN Security Council, EU and OFAC sanctions lists, examine token freeze status, apply location and amount rules, and flag patterns such as rapid incoming-to-outgoing flows or many new payout destinations. A match can prevent access, suspend a merchant account, refuse an outgoing transfer or hold a payment or payout. We keep a record of each screening result with our other compliance records.

These checks use transaction and account information to identify risk. They can be wrong or incomplete. Held payments are reviewed by the platform before a decision to clear or decline them. To challenge a restriction, explain your circumstances and request human review at [email protected].

Where applicable law gives you rights concerning a solely automated decision with legal or similarly significant effects, you may request human involvement, give your view and contest the outcome. A request cannot require us to make a transfer prohibited by law.

9.Your privacy rights

  • Ask whether we hold your personal data and request access or a copy.
  • Ask us to correct inaccurate data or complete missing information.
  • Request deletion or restriction where the legal conditions are met.
  • Object to processing based on legitimate interests for reasons connected with your circumstances.
  • Request a portable copy of data you provided where processing is automated and based on consent or a contract.
  • Withdraw consent where we rely on it. This does not affect processing that was lawful before withdrawal.
  • Complain to a data protection authority, including the authority where you live, work or believe an infringement occurred, or to the Privacy Commissioner for Personal Data in Hong Kong. You do not have to contact us first.

Email [email protected] to exercise a right. Include enough information to find your account or transaction, but never send a private key, password or two-factor code. We may ask for proportionate information to verify your identity. If the request concerns data controlled by a merchant, we will explain that and help direct it appropriately.

Where GDPR applies, we normally respond within one month. If complexity or the number of requests permits an extension, we will tell you within that month, explain why, and use no more than two additional months. Requests are normally free. If we cannot fulfil a request, we will explain the reason and available complaint options.

Rights have limits. We may need to retain financial or security records to meet legal obligations or handle claims. We cannot delete blockchain records or disclose another person's protected information in response to an access request. Where the law allows, we may also withhold information whose disclosure would prejudice the prevention or detection of crime, including information about a report to the authorities.

10.How we protect data

Our measures include password hashing, two-factor authentication, team and API permissions, security logs, encrypted off-site backups and controls on access to administrative actions. No system can guarantee complete security. We handle and notify personal data breaches as required by applicable law.

Protect your email account, authentication and recovery codes, API keys and private links. Report suspected account compromise to [email protected], and privacy concerns to [email protected].

11.Children

zerofive is intended for adults aged 18 or over. We do not knowingly offer accounts to children. If you believe a child has provided personal data, contact [email protected] so we can investigate and take appropriate action, while preserving any records the law requires.

12.Changes and contact

We will update this policy when our processing changes and show the new effective date. We will give appropriate notice of material changes and obtain consent where the law requires it. A policy update does not by itself authorise a new use of your data.

For questions or requests, email [email protected] or write to ZeroFive, Hong Kong (full address to follow).