Claude Pay

Privacy Policy

Last updated 17 August 2026.

Claude Pay is a non-custodial payment gateway. We process the minimum data needed to route and confirm payments, and to protect merchants from payment fraud.

These rights apply to everyone. We do not grant one set of rights to customers in Europe and a lesser set to everyone else. Most of the businesses using Claude Pay, and most of their buyers, are in South and South-East Asia — Bangladesh, India, Pakistan, Vietnam, Indonesia, the Philippines and elsewhere. Whatever the law where you live says, and whether or not your country has a data protection act yet, the rights described below are available to you.

Who this policy is for

Claude Pay is used two ways, and the difference matters.

  • Merchants sign up with us directly. This policy governs our relationship with you.
  • Buyers pay a merchant that uses Claude Pay. You almost certainly have no account with us and may never have heard of us. We handle your data on the merchant's behalf — they decide what to collect, we process it for them. This policy explains what we do with it; your relationship, and your first point of contact, is with the merchant you bought from.

What we collect

  • Merchant account data: business name, email, hashed password, 2FA secret (encrypted).
  • Payment metadata: invoice amounts, methods, wallet addresses you configure, and optional customer email/order id the merchant passes us.
  • Operational logs: IP and user-agent for security and audit purposes.

Fraud prevention and the shared blocklist

Merchants using Claude Pay are often targeted by the same people, one business at a time. To stop that, we operate a shared prevention list. When a payment is started we check the buyer's email address and IP against it.

What is stored. Email addresses are stored only as a one-way cryptographic hash, together with a masked preview such as j••••@example.com. We do not keep the address itself and it cannot be recovered from the hash. IP addresses and domains are stored as given, because matching them requires it.

How something gets listed.

  • A merchant can block an identifier on their own account only. That is private to them and invisible to every other business.
  • A merchant can report an identifier for the shared list. A report changes nothing by itself. A person at Claude Pay reviews it, alongside the reporting merchant's own history, before it can affect anyone else.
  • We import lists of disposable email providers, and reputation data from StopForumSpam and AbuseIPDB.

How it is used. Signals are scored, never treated as verdicts. No single signal is enough to refuse a payment on its own — including using a disposable or privacy email address, which many entirely legitimate buyers do.

Retention. IP entries expire after 30 to 180 days. Other entries expire within a year unless a person renews them. Nothing is permanent by default.

If you think you have been blocked wrongly

Write to [email protected]. A person will look at it — not an automated system — and we can clear an entry along with the reports behind it. You do not need to be a Claude Pay customer to ask, and you do not need to quote any law to be taken seriously.

You can also ask us to show you what we hold about you, correct it, or delete it. Where a payment record must be kept for accounting or dispute resolution we will say so plainly rather than refuse without explanation.

Third parties

For fraud prevention we may check a single email address, domain or IP against:

  • StopForumSpam (United Kingdom) — reputation of an email or IP.
  • AbuseIPDB (United States) — reputation of an IP.

We send only the identifier being checked. We do not send names, order contents, or payment amounts.

What we do NOT do

  • We never hold private keys or take custody of funds.
  • We do not sell personal data.
  • We do not publish our blocklist, sell access to it, or submit reports to public "scammer" databases. It is an internal defence for merchants using Claude Pay, not a public accusation about anybody.

Data retention

Payment and audit records are retained for compliance and dispute resolution. Contact us to request deletion of personal data where legally permitted.

Contact

[email protected] — privacy questions, access requests, and blocklist appeals.