Skip to main content

​
GDPR Compliance

PayRequest is the tool you use to run your billing — for GDPR purposes, you (the business using PayRequest) are typically the data controller for your customers’ data, and PayRequest acts as a data processor. This page describes the concrete technical controls PayRequest provides; it isn’t a legal statement that PayRequest or your use of it is fully GDPR compliant. Talk to your own legal advisor about what your business specifically needs.
PayRequest does not currently offer a self-service “delete this customer’s data” or “export this customer’s data” tool for a single customer record. The controls below operate at the account level (your own PayRequest account) or as bulk exports, not as a per-customer erasure/portability workflow.

​
Data Controls Available Today

1

Export your business data

From Bulk Actions, you can export customers, subscriptions, products, invoices, and orders as CSV — useful for data portability requests or your own records, covering the fields you’d need to hand over (name, email, phone, company, tags, etc. for customers).
2

Archive a customer

From a customer’s record, you can archive them (with a reason and note). This flags the customer as inactive and hides them from active lists — it does not delete or anonymize their underlying data. All order, invoice, and subscription history for an archived customer remains intact and can be restored by reactivating them.
3

Delete your own account

From Settings → Delete Account, typing DELETE to confirm permanently deletes your PayRequest login, removes your API tokens, and removes your profile photo. This is account-level and applies to your own PayRequest user account.
4

Two-factor authentication

Add 2FA to reduce the risk of unauthorized access to the customer data stored in your account.

​
What’s Encrypted at Rest

  • Two-factor authentication secrets and recovery codes.
  • API keys, OAuth access tokens, and refresh tokens for connected services and payment providers.
  • Card data is never stored in the first place — see PCI Compliance for how card payments are handled entirely by your connected payment processor.

​
Multi-Tenant Data Isolation

Every business’s data — customers, orders, invoices, subscriptions — is scoped to that business’s account. One PayRequest user cannot query or see another business’s customer records.

​
FAQ

Not as a one-click action. Archiving a customer hides them from active views but keeps their records (needed for invoicing/tax history in most jurisdictions). For a request to fully delete a specific customer’s data, contact support to discuss options.
Customers can view and download their own invoices and order history from the customer portal. There isn’t a dedicated “download all my data” export button distinct from that.
Deleting your account removes your own login and account access. Before deleting your account, export any data you need to retain — see the export step above.
Contact support directly for DPA requests — this isn’t something documented as a self-serve download at this time.
PayRequest’s database runs on a Hetzner server in the EU. For specifics relevant to your compliance obligations, contact support.

​
Next Steps

PCI Compliance

How card payment data is handled

Audit Logs

Track who accessed or changed what

Two-Factor Authentication

Add a second login factor

Support Requests

Reach support for data requests