Legal notice

Version dated 16 October 2026. This notice includes the privacy policy and information about cookies.

Operator

The operator of pay.kvadrati.com and Kvadrati Payments (Kvadrati Pay) is Kvadrati, Aleksandar Hajduković s.p., Celovška cesta 95a, 1000 Ljubljana, Slovenia, VAT ID SI20040130, email hello@kvadrati.com.

Scope of this notice

This notice explains data processing on the public website, in user accounts, organizations and projects, in support and when technically relaying payment requests. We act as controller for account data, security and our business relationship; data supplied by the Customer to perform its service is processed under its instructions and the applicable data processing agreement.

Data we process

We may process Customer and contact details, tax identifiers, organization billing and bank details, user accounts and roles, project settings, protected integration credentials and payment operational data such as amount, currency, external reference, provider identifier, status and any actual processing fee. We also process security and technical records, browser information, IP addresses, language and support correspondence. Submit only data needed for each operation.

Production integration secrets stored in our database, including Stripe secret API keys, PayPal secrets and FURS API keys, are encrypted; the application obtains the decryption key from separate server configuration. This protection is intended to prevent disclosure of these secrets if only the database is stolen, provided the attacker does not also obtain encryption keys or access to the application server. It is not a guarantee of absolute security or protection against every form of intrusion, data modification or misuse. This statement applies to production integration secrets; test credentials in the development environment are stored separately in development configuration and are not covered by this encryption assurance. Customers must also protect their own copies of credentials and access to their systems.

Credit and debit cards

Kvadrati Pay does not collect or store credit or debit card details, including card numbers, expiry dates or CVC/CVV security codes. Card data collection, processing and any storage are handled exclusively by PayPal or Stripe, depending on the selected payment method, within their protected payment environment and under their own terms and privacy policies. We retain only payment operational data and provider references, not card details. Do not send card details through our API, forms or support channels.

Purposes and legal bases

We use data to enter into and perform contracts, secure access, relay payment requests, bill for the service and provide support. Processing is based on contractual necessity, legal obligations and legitimate interests in security, abuse prevention, reliability and legal claims, taking individual rights into account. Optional analytics relies on consent, which may be withdrawn at any time without affecting the lawfulness of earlier processing.

Operational and security records

We retain necessary operational evidence and security and audit records for traceability, error handling, duplicate request prevention and status checks. These do not replace the Customer's business records. Do not include unnecessary personal data or secrets in payment references or descriptions.

Retention and deletion

We retain data only as long as needed for the service, security, billing, legal claims and statutory obligations. Retention periods depend on the data category, purpose and applicable law. We then delete or anonymize it, taking backup lifecycles into account. Closing an account does not immediately erase evidence that must lawfully be retained. Contact us for retention information for a particular data category or to request deletion.

Recipients and international processing

We send data needed for payments to the selected provider, PayPal or Stripe, on the Customer's instructions. Contracted hosting, backup and support providers may also process data for the agreed purpose and under confidentiality obligations. If you consent to analytics, usage data is received by Google Ireland Limited as the Google Analytics provider. We disclose data to authorities when required by law. Transfers outside the EEA require an appropriate basis, such as an adequacy decision or standard contractual clauses, and any necessary additional safeguards. You may request information about recipients and safeguards using our contact address.

Security and continuity

We use measures such as HTTPS, access controls, organization and environment separation and protection of integration credentials. No electronic service is risk-free; we do not guarantee absolute security, uninterrupted availability, timeliness or error-free operation. Customers must protect their access credentials and verify payment outcomes.

Individual rights

Subject to applicable law, you may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent. You may lodge a complaint with the Information Commissioner of the Republic of Slovenia. For data controlled by the Customer, contact the Customer first; we may redirect the request or require evidence of identity or authorization. Send requests to hello@kvadrati.com.

Information and limitation of liability

Website content is general technical information, not legal, tax, accounting or financial advice. You use the service at your own risk. To the fullest extent permitted by applicable law, Kvadrati, Aleksandar Hajduković s.p. is not liable for any damage arising from use of, or inability to use, the product, including direct, indirect or consequential loss, loss of data, revenue or profit, business interruption, delays, rejections and incorrect or duplicate payments. This exclusion does not apply to intentional misconduct, gross negligence or other liability that mandatory law prohibits excluding or limiting. Further details are set out in the Terms of use.

Kvadrati, Aleksandar Hajduković s.p. reserves the right, at its discretion, to suspend or permanently discontinue the entire service for business, organizational, technical, security or other reasons, including with immediate effect where permitted by applicable law and expressly agreed contractual obligations. To the fullest extent permitted by law, we are not liable for damage, lost profits, business interruption or replacement solution costs resulting from that decision or discontinuation. This provision does not exclude liability that cannot lawfully be excluded or limited, nor does it remove mandatory notice periods, any payment refund obligations or other statutory and expressly agreed written obligations.

Contact

Send questions about privacy, security, data or this notice to hello@kvadrati.com.

Terms of use