Privacy policy

Privacy Policy

Last updated: May 2026 · Applies to the AG Pay Links iOS app

This policy describes how We are AG (“we”, “us”) handles information when you use the AG Pay Links mobile app for iPhone. We are AG is the data controller for the app and its supporting webhook-routing service.

1. What the app does

AG Pay Links lets merchants create hosted payment links using their existing acquirer accounts (e.g. AIBMS Authipay, Fiserv / Clover UK, Lloyds Bank Cardnet, Tyl by NatWest, Worldline). We are AG does not process card payments, hold funds, or act as a payment service provider.

2. Data stored on your iPhone

  • Merchant credentials (Store ID, API Key, API Secret) — stored in the iOS Keychain, never uploaded to We are AG servers.
  • Payment links and customers — stored locally on your device using SwiftData.
  • Signing key — a P-256 key pair generated on first use to sign link metadata (private key in Keychain).
  • App preferences — notification sound, haptics, biometric lock, and subscription state (managed via Apple).

3. Data sent to your payment provider

When you create a payment link, the app sends information required by your acquirer directly from your iPhone — including amount, currency, customer details you enter, order reference, webhook URL, link expiry, and attestation fields. These requests go to your provider’s API over HTTPS. We do not proxy payment API calls.

4. Data sent to We are AG (push routing only)

To deliver push notifications when your provider sends a webhook, the app registers a minimal route mapping with our Cloudflare Worker backend:

  • Route ID, APNs device token, installation ID
  • Hashed per-route registration secret
  • Public key and link attestation metadata (amount, currency, nonce, signature, creation time)
  • Payment alert sound preference

We do not store merchant API keys, card data, customer records, or payment URLs on our servers.

5. Webhooks and push notifications

When a customer pays, your acquirer may notify our backend. We verify the notification cryptographically, then send an Apple Push Notification to your device. Push copy says “Payment update received” — not “Payment received”. Paid status in the app is confirmed only via your provider’s API on your device.

6. Retention

  • Device routes on our backend are deleted after approximately 45 days (aligned with link validity).
  • Webhook logs are kept for a short period (typically 72 hours) for debugging and rate limiting.
  • Webhook deduplication records are kept for approximately 7 days.
  • On-device data remains until you delete links or customers in the app, or uninstall the app.

7. Subscriptions

Pro subscriptions (£6.99/month or £69.99/year) are sold via Apple In-App Purchase. Apple processes payment and provides entitlement status to the app; we do not receive your card details for subscriptions.

8. Biometric lock

If you enable Face ID or Touch ID in the app, authentication is handled entirely by iOS. We do not receive or store your biometric data.

9. Your rights

You can delete local app data by removing payment links and customers, or by uninstalling the app. To exercise UK GDPR rights regarding data we control on our backend, contact us via support. For data held by your acquirer or Apple, contact those parties directly.

10. Third parties

  • Apple — App Store distribution, In-App Purchase, and APNs
  • Cloudflare — hosting of the webhook routing service used by the app
  • Your payment provider — Fiserv, Clover, Lloyds, etc.

11. Children

AG Pay Links is intended for business users and is not directed at children under 16.

12. Changes

We may update this policy from time to time. Material changes will be reflected here with an updated date. Continued use of the app after changes constitutes acceptance of the revised policy.

13. Contact

Questions about this policy: We are AG support