Privacy policy

Last updated 29 Oct 2026

This describes what UnifyPay actually stores. Browsing fees and history requires no account and no personal data.

UnifyPay is operated by Agech Solutions, which is responsible for the personal data described here.

What we collect

If you create an account: Your first and last name, email address, and a phone number if you choose to give one. Your password is stored only as a bcrypt hash; we never store or see it in plain text. If you sign in with Google or Apple instead, we store the account identifier and the profile fields that provider returns, including a display name and avatar URL where it supplies one.
Profile details you add: Anything you fill in under settings: company, job title, city, date of birth, account type, a short bio, home country, time zone, and whether you want marketing email. All of it is optional and you can change or clear it at any time.
Sign-in codes and email links: One-time codes are stored only as a bcrypt hash, expire after ten minutes, and are marked as used the moment they work, so none can be used twice. Links to confirm your email address or reset your password are stored only as a SHA-256 hash and expire after 24 hours and one hour respectively. The plaintext code or link never touches the database.
Transactions you record: Amounts, dates, descriptions and the rail used. This is data you enter deliberately; it is visible only to your account and is deleted when you delete the record.
Messages you send us: The contact form stores your name, email address, company if given, the topic, subject and message, plus a truncated IP address and your browser’s user agent to spot abuse. We are notified by email and send you an automatic acknowledgement.
Operational logs: Errors and significant actions (sign-in, rate edits, outbound referral clicks) are logged with a timestamp, and where relevant a truncated IP address and user agent, to keep the service working and auditable. A referral click also records the page you came from and any campaign tags in the link. Rate edits are attributed to the account that made them, because an audit trail that cannot say who changed a price is not an audit trail.
What you type into the tools: Amounts, currencies and countries you enter into a comparison, and questions you ask the fee assistant or the search box, are used to look up the answer. We do not store them against you.

What we do not do

We do not sell personal data.
We do not run third-party advertising or cross-site tracking.
We do not connect to your bank or payment accounts.

Do not send us card numbers, bank credentials or passwords through the contact form or anywhere else on the site. Nothing here needs them.

Bot protection

The sign-up, sign-in, password-reset and contact forms are protected by Google reCAPTCHA. On those pages only, Google’s script loads in your browser and collects device and interaction data to judge whether you are a person. Google’s privacy policy and terms apply to that data.

Who processes it

Cloudflare: Hosts the site and serves every request, so it handles your IP address and the pages you request.
Supabase: Runs the database that holds accounts, transactions, messages and logs. It is hosted on Amazon Web Services in Mumbai, India.
Resend: Delivers the emails we send: sign-in codes, confirmation and reset links, and replies to messages.
Google and Apple: Google for reCAPTCHA, and either of them if you choose to sign in with that account.

Exchange-rate reference data is fetched from a third-party feed; that request carries no information about you.

Where your data goes

Stored data lives in India, and requests are served from Cloudflare’s network, which may handle them in a country near you or elsewhere. Either way your data may be processed outside the country you live in, under protections that differ from your own.

Retention

Account data is kept until the account is deleted. There is no self-service delete button yet: ask us and we will delete your profile and the transactions attached to it.
Used and expired sign-in codes, confirmation links and reset links stay in the database as hashes, which cannot be turned back into a working code or link.
Contact messages and operational logs are not yet deleted on a fixed schedule. Ask us and we will remove the ones linked to you.

Your rights

Depending on where you live you may have the right to access, correct, export or erase your personal data, to object to or restrict processing, and to withdraw consent where we rely on it. You may also complain to your local data-protection authority. To make a request, use the contact page or email info@unifypay.io. We may need to confirm the request comes from the account holder before acting on it.

Other websites

Provider pages, sources and referral links take you to sites we do not control. Their own privacy policies apply once you are there.

Children

UnifyPay is meant for a general adult audience and is not designed to collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes

When this policy changes, the date at the top changes with it. Where the law requires more notice than that, we will give it.

What we collect

If you create an account

Your first and last name, email address, and a phone number if you choose to give one. Your password is stored only as a bcrypt hash; we never store or see it in plain text. If you sign in with Google or Apple instead, we store the account identifier and the profile fields that provider returns, including a display name and avatar URL where it supplies one.

Profile details you add

Anything you fill in under settings: company, job title, city, date of birth, account type, a short bio, home country, time zone, and whether you want marketing email. All of it is optional and you can change or clear it at any time.

Sign-in codes and email links

One-time codes are stored only as a bcrypt hash, expire after ten minutes, and are marked as used the moment they work, so none can be used twice. Links to confirm your email address or reset your password are stored only as a SHA-256 hash and expire after 24 hours and one hour respectively. The plaintext code or link never touches the database.

Transactions you record

Amounts, dates, descriptions and the rail used. This is data you enter deliberately; it is visible only to your account and is deleted when you delete the record.

Messages you send us

The contact form stores your name, email address, company if given, the topic, subject and message, plus a truncated IP address and your browser’s user agent to spot abuse. We are notified by email and send you an automatic acknowledgement.

Operational logs

Errors and significant actions (sign-in, rate edits, outbound referral clicks) are logged with a timestamp, and where relevant a truncated IP address and user agent, to keep the service working and auditable. A referral click also records the page you came from and any campaign tags in the link. Rate edits are attributed to the account that made them, because an audit trail that cannot say who changed a price is not an audit trail.

What you type into the tools

Amounts, currencies and countries you enter into a comparison, and questions you ask the fee assistant or the search box, are used to look up the answer. We do not store them against you.

Who processes it

Cloudflare

Hosts the site and serves every request, so it handles your IP address and the pages you request.

Supabase

Runs the database that holds accounts, transactions, messages and logs. It is hosted on Amazon Web Services in Mumbai, India.

Resend

Delivers the emails we send: sign-in codes, confirmation and reset links, and replies to messages.

Google and Apple

Google for reCAPTCHA, and either of them if you choose to sign in with that account.

Exchange-rate reference data is fetched from a third-party feed; that request carries no information about you.

Retention

Account data is kept until the account is deleted. There is no self-service delete button yet: ask us and we will delete your profile and the transactions attached to it.

Used and expired sign-in codes, confirmation links and reset links stay in the database as hashes, which cannot be turned back into a working code or link.

Contact messages and operational logs are not yet deleted on a fixed schedule. Ask us and we will remove the ones linked to you.

Your rights