Privacy policy
Last updated October 27, 2026
Who we are and what this covers
PingPaid is a service that confirms Interac e-Transfer® payments for WooCommerce stores. It is operated by Kapany Technologies Inc., doing business as Strand Systems ("PingPaid", "we", "us"), [business address].
This policy explains what personal information PingPaid handles, why, and for how long. It covers:
- Store owners who create a PingPaid account or connect their store to PingPaid Cloud with PingPaid Premium.
- People who send e-Transfers to those stores, whose payment details appear in Interac's deposit emails.
- Visitors to pingpaid.ca.
The free PingPaid plugin runs only on the store's own website and sends nothing to us. This policy applies to it only if the store also uses PingPaid Premium.
For payment details of a store's customers, the store is responsible for that information and PingPaid processes it on the store's behalf, as its service provider. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Information we collect
We collect only what's needed to receive Interac's deposit emails, tell the right store about them, and run your account.
| What | Examples | Where it comes from |
|---|---|---|
| Store details | Store web address, the plugin's webhook address, store owner's email, payment email, plugin version | The store's PingPaid plugin, when it connects |
| Forwarded Interac emails | The deposit notice Interac sends when an e-Transfer is auto-deposited | The store owner's Gmail, through the forwarding filter they set up |
| Payment details read from those emails | Amount, sender name, sender email, the e-Transfer message, Interac reference number, sender's bank, the address the email was sent to | Extracted by PingPaid Cloud from each deposit email |
| Checks we run | Whether Interac's digital signature was valid, a fingerprint (hash) of each email | Calculated by PingPaid Cloud |
| Gmail forwarding confirmation | Google's confirmation link or code and the requesting Gmail address | Google's email to the store's PingPaid forwarding address |
| Your account | Your email address, when you signed in | You, when you sign in to pingpaid.ca |
| Billing | Subscription status, renewal dates, invoice amounts and tax. Card details stay with Stripe. | Stripe, our payment processor |
| Support | Your messages to us and our replies, with your store's connection status | You, when you open a ticket or email us |
| Emails we send you | Which email we sent, to which address, when, and whether it was delivered | Our email sending provider |
| Website visitors | Standard request information (such as IP address) handled by our hosting provider | Your browser |
We never ask for, receive or store bank logins, Gmail passwords or card numbers. PingPaid never moves money: e-Transfers go straight from the sender's bank to the store's.
Emails that aren't store payments
Interac sends its emails to the one email on the bank's Interac profile, and the Gmail filter forwards all Interac emails from that inbox. Some of them may have nothing to do with the store.
- Other Interac notices are ignored. Notices about money the owner sent, payment requests, and transfers that need a security question are not stored. We keep only a fingerprint of the email (a one-way hash) and whether its signature was valid, so the same email isn't processed twice. No amount, name or message is kept.
- Personal auto-deposits can't be told apart. If the owner's Interac profile also receives personal e-Transfers, those deposit emails look the same as store payments. PingPaid stores their details like any other payment and shows them to the store owner to review, where they can be dismissed.
We strongly recommend using an Interac profile only for the store, such as a business bank account with its own Gmail address. PingPaid's setup says this before connecting. If you use a personal profile, your personal e-Transfers will be forwarded to PingPaid. You can ask us to delete any of them at any time (see Your rights).
How we use information
We use the information only to run PingPaid for the store:
- Check that each deposit email genuinely came from Interac.
- Send the payment details to the store's own website, so the plugin can match the e-Transfer to an order.
- Show the store owner the status of their connection and Gmail forwarding.
- Manage the store's account, free trial and subscription, and contact the store owner about the service (for example, a trial ending, a failed renewal or a forwarding problem).
- Answer support requests.
- Keep the service secure, find and fix problems, and prevent abuse.
We do not sell personal information, use it for advertising, or share it with data brokers. We do not use the payment details of a store's customers for any purpose of our own.
When our support team looks at a payment
Our support tools show whether each deposit email arrived and what PingPaid did with it, without the sender's name, email, amount or message. We open a payment's details only to fix a problem with that store's service, normally when the store owner has allowed it in a support ticket. Every time someone opens a payment's details, we record who did it, when and why.
Who we share it with
Payment details go only to the store they belong to. We use these service providers, who handle information for us under their own security and privacy terms:
| Provider | What they do for us | Information involved |
|---|---|---|
| Cloudflare | Hosts pingpaid.ca, PingPaid Cloud and its database, and receives the forwarded emails | Everything described in this policy |
| Stripe | Takes subscription payments and calculates sales tax | Your email, billing details you give them directly, and subscription status. We don't receive card numbers. |
| [Email sending provider, to be confirmed] | Delivers the emails we send you (sign-in links, reminders, support replies) | Your email address and the content of those emails |
| Pushover | Sends operational alerts to our team (for example, an email format we don't recognise) | A store's web address and technical details, not payment details |
We may also disclose information if the law requires it, or to protect the security of the service, and as part of a sale or reorganisation of the business, in which case this policy continues to apply.
Where information is stored
PingPaid runs on Cloudflare's global network. Information may be stored and processed in the United States and other countries outside Canada, where it may be accessible to courts and authorities under local law.
How long we keep it
We delete information automatically on a fixed schedule.
| Information | Kept for |
|---|---|
| Payment details read from deposit emails, and ignored-email fingerprints | 12 months after the email was received |
| A full copy of an email, kept only to re-check it when something needs review | Encrypted, deleted within 7 days |
| Everything about a store, after it disconnects or uninstalls PingPaid | Deleted 30 days after disconnecting |
| Billing records (invoices, amounts, tax) | 6 years, as Canadian tax law requires |
| Support conversations and the record of who viewed payment details | 2 years |
| The log of emails we sent you | 12 months |
| Sign-in links and sessions | Sign-in links expire after 15 minutes; sessions after 30 days |
The store's own website keeps its own payment and order records under the store's control. Deleting data from PingPaid Cloud doesn't remove those.
Cookies
pingpaid.ca uses one cookie, only after you sign in, to keep you signed in. We don't use tracking or advertising cookies.
How we protect it
- All connections use HTTPS.
- Each store has its own private forwarding address and its own secret key. Messages between PingPaid Cloud and the store are signed, so they can't be forged.
- Store secret keys are kept encrypted. Copies of emails, when kept, are encrypted.
- Only Interac emails with a valid digital signature can confirm an order automatically.
- Access to production systems is limited to the people who run PingPaid, protected by two separate sign-in checks.
No system is perfectly secure. If a breach creates a real risk of significant harm, we'll notify affected people and the Privacy Commissioner of Canada as the law requires.
Your rights and choices
You can ask to see the personal information we hold about you, correct it, or have it deleted. Email [privacy contact email]. We'll answer within 30 days.
- Store owners can stop at any time: disconnect in PingPaid → Settings and remove the Gmail filter. Forwarded emails stop being accepted right away, and the store's data is deleted 30 days later. Ask us if you want it deleted sooner.
- People who sent an e-Transfer to a store should usually contact that store first, since it is responsible for its customers' information. You can also contact us directly.
If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
For store owners
By connecting PingPaid, you confirm that:
- You own or are authorised to manage the Gmail inbox you forward from, and to forward its Interac emails to PingPaid.
- Your store's privacy policy tells customers that payment details from e-Transfers are processed by a service provider to confirm their orders.
- You understand that if your Interac profile also receives personal e-Transfers, they will be forwarded too (see Emails that aren't store payments).
Suggested wording for your store's privacy policy:
When you pay by Interac e-Transfer, we use PingPaid, a service provider, to confirm your payment. PingPaid receives Interac's deposit notice, including your name, email, the amount and your message, and uses it only to match your payment to your order.
Changes and contact
If we change this policy, we'll update the date at the top. If a change materially affects how we use your information, we'll tell connected store owners by email before it takes effect.
Our privacy officer is [name or title], Kapany Technologies Inc., [business address], [privacy contact email].
Interac and Interac e-Transfer are registered trademarks of Interac Corp. PingPaid is not affiliated with or endorsed by Interac Corp.