Privacy policy
Last updated 22 September 2026. The service is operated by Fantom Studio, Serbia. Questions: fedja@rugbuster.io.
StableCart is built to need as little personal data as possible. It never receives a buyer's name, email, address or card details, and it has no user accounts.
What we receive
| Data | When and why | Kept |
|---|---|---|
| Your wallet address on Base | When you register a shop or make payment links. It is where payments are sent, so it is the whole point of the service. | Until you ask us to delete the merchant |
| Your shop URL or name (optional) | Given at registration so your merchant id is readable and support is possible. | Same |
| The amount, currency and your own order reference | Sent by your shop or link when a checkout opens, so the payment can be matched to your order. | Payment records are kept for 24 months for accounting and dispute support |
| Public blockchain data | Transaction hash, sender address, amount and block, read from the public Base blockchain to confirm a payment. | Same |
| Technical logs | IP address, time and request path, written by the server and our host to run the service and stop abuse. | Up to 30 days |
Buyers do not enter personal data into the StableCart checkout. Whatever the buyer's name and address are, they stay in your shop, not with us.
Cookies
The checkout and this website set no cookies and run no advertising or analytics trackers. The payment-link builder stores your merchant id and key in your own browser's local storage so you do not have to set it up again; clearing your browser data removes it.
Who else is involved
- Railway (hosting) and Neon (database), which store the data above on our behalf inside the EU.
- Alchemy and the public Base RPC, which we query to read the blockchain.
- CoinGecko, for the USDC price. No merchant or buyer data is sent.
- exchangerate-api.com, queried by the WooCommerce plugin for daily currency rates. No shop data is sent.
- Cloudflare, which serves this website.
We do not sell data and we do not share it for advertising.
The blockchain part
Payments happen on a public blockchain. Transactions, wallet addresses and amounts are visible to anyone, forever, and neither we nor you can delete them. That is a property of the network, not a choice we make.
Your rights
If you are in the EU or a country with similar law, you can ask for a copy of your data, its correction, or its deletion, and you can object to processing. Write to fedja@rugbuster.io and we will answer within 30 days. Deleting a merchant removes the wallet address, the shop name and the keys; blockchain transactions remain public, as above.
Changes
If this policy changes, the date at the top changes with it.