AppNexPay

Privacy Policy

Last updated: 24 October 2026

1. Who we are

AppNexPay ("we", "us") is operated by AppNex Technologies, Philippines. Contact us, including our Data Protection Officer, at formulatesolutions@gmail.com.

AppNexPay connects a business's CRM platform account (the "CRM") with the business's own accounts at the payment providers it chooses (Xendit, PayMongo, Maya or DragonPay) so the business can accept payments. We are not a bank or payment processor; payments are processed by those providers.

2. Our role

  • For information about the businesses and their staff who install and use AppNexPay, we are the controller.
  • For information about the businesses' customers that passes through AppNexPay, we act as a processor on behalf of the business, which is the controller.

3. What we collect

  • Account data: CRM agency and sub-account IDs and names, the sub-account's business contact (name, email, phone, as its CRM business profile gives them), CRM user IDs, user display names and roles (received through the CRM's single sign-on).
  • Credentials: CRM access tokens and the business's payment provider keys (for example its Xendit or PayMongo secret key, Maya keys, or DragonPay merchant ID and API key) and webhook secrets. These are encrypted with AES-256-GCM and never shown back in full.
  • Payment records: amount, currency, status, payment method, dates, and IDs from the CRM and the payment provider (transaction, invoice, checkout, contact and subscription IDs).
  • Customer contact details: when a payment is created, the customer's name, email and phone number are read from the CRM and passed to the payment provider that takes the payment so it can show and send the payment page. If DragonPay needs an email address the CRM doesn't have, the customer types it in and it goes straight to DragonPay. We do not store them. We keep only the CRM contact ID.
  • Configuration and logs: settings, an audit log of changes, and technical logs (with secrets and personal data removed).

We do not collect card numbers. Cards are entered on the payment provider's own page, never on AppNexPay.

4. Why we use it (legal bases)

  • To provide the service you asked for — performance of a contract.
  • To keep the service secure and prevent fraud — legitimate interests / legal obligations.
  • To bill for subscriptions and keep financial records — contract and legal obligations.

We do not sell personal data and do not use it for advertising.

5. Who we share it with

  • The business's CRM platform — to read and update the business's CRM account as configured.
  • The payment providers the business connects (Xendit, PayMongo, Maya, DragonPay) — to create payment pages, refunds and to receive payment updates.
  • Cloudflare — hosting and database (our infrastructure provider).
  • Authorities, where the law requires it.

6. International transfers

Our infrastructure provider may process data in countries other than yours. Where required, we rely on appropriate safeguards such as contractual clauses with our providers, and we remain responsible for that data under the Philippines' Data Privacy Act of 2012.

7. How long we keep it

  • Payment records: 180 days by default; each business can choose 90–3650 days. The business's CRM keeps its own long-term record of transactions and invoices.
  • Daily payment totals per account are also kept in our reporting system for up to 25 months, and are deleted with the account's data.
  • Webhook delivery records: 30 days. Audit log: about 13 months.
  • When a business uninstalls AppNexPay, it stops working for that business at once, and its data is deleted 30 days later. Until then it is kept so that installing AppNexPay again carries on where it left off; meanwhile its customers get no renewal links or reminders for their subscriptions, and its payment pages take no new payments.
  • When a business's free trial ends without a paid plan, AppNexPay stops for it, and its data is kept until it chooses a plan or deletes the data itself.
  • After the data is deleted, only the sub-account's name and identifiers and its AppNexPay subscription and invoices are kept: the invoices where tax law requires, the subscription so a new install does not start a new free trial.
  • Subscription billing records may be kept longer where tax law requires.

8. Security

Encryption in transit (HTTPS) and at rest for credentials, single sign-on through the CRM, role-based access, signed and verified webhooks, rate limiting, least-privilege access and audit logging.

9. Your rights

Depending on where you live (for example Indonesia's Personal Data Protection Law No. 27 of 2022, the Philippines' Data Privacy Act of 2012, Thailand's PDPA, Malaysia's PDPA 2010, Vietnam's Decree 13/2023/ND-CP, or the GDPR), you may have the right to access, correct, delete, restrict or object to processing, and to data portability, and to complain to your data protection authority.

Business admins can download all of their sub-account's data at any time in AppNexPay → Settings → Data and privacy, and delete it in AppNexPay → Plan → Delete all my data: AppNexPay stops at once, and the data is deleted after 7 days, unless an admin undoes it before then. Customers of a business should contact that business first; we will help the business respond. You can also contact us at formulatesolutions@gmail.com.

10. Breach notification

If a personal data breach affects you, we will notify the affected businesses and, where required, the authorities and individuals within the time limits required by law.

11. Changes

We will post updates here and, for material changes, notify businesses in the app.