Who runs PayoutCheck
PayoutCheck is run by Muhammad Afzal Ubbais, a sole proprietor in India.
Contact: support@payoutcheck.online
What happens to your file
- Your file is encrypted with AES-256-GCM the moment it arrives, before anything reads it. It is stored outside the web directory, under a name the server makes up, and no web address can serve it.
- A separate process reads it once, turns it into a structured ledger, and stores that ledger in our database.
- Your uploaded file is deleted within 25 hours of the audit finishing. It is due 24 hours after the audit finishes, and the deletion job runs every 15 minutes. A file that could not be checked is deleted on the same schedule.
- Your audit is built from the stored ledger, not from your file. That is why your report is still there after the file is gone.
What we store, and for how long
| What | How long |
|---|---|
| Your uploaded file, encrypted | Deleted within 25 hours of the audit finishing |
| Your results: the reconciliation, the findings, your file's name, and a copy of every row of your file (up to 600 characters of each row) | Free check: deleted within 25 hours of the audit finishing. Paid report: kept 3 days after payment. Report opened with a 3-Month Pass: kept until the pass ends, and at least 3 days after it was opened. |
| Audit-log record: your file's size, its SHA-256 fingerprint, and counts such as how many findings it had | No time limit. It never holds the contents of your file. |
| Payment record: payment reference, amount, currency, plan and date | No fixed end date |
| Your email, if you pay | Erased 120 days after payment |
| IP addresses on our records of uploads and deletions | Erased after 30 days |
| Web server log | Deleted within 15 days |
| Application log: ids and counts, never IP addresses | Deleted within 8 days |
| Database copies, one taken before each software update | The newest 5 are kept, so a deleted audit can stay in one until 5 more updates have happened |
| Hostinger's backups of the whole server | Taken every week. The latest few (currently two) are kept, so a copy can last up to about two weeks. We cannot delete anything from them. |
The data retention page explains each of these, including when a free check is kept longer.
Where your data is
PayoutCheck runs on a server rented from Hostinger, in Mumbai, India. Your uploaded file, your results, our database and its copies, and our logs are all on that server.
Checkout runs on Dodo Payments’ own pages, so your card details go to Dodo and never reach our server.
Who else is involved
| Company | What for | What they get |
|---|---|---|
| Hostinger | Hosting: the server PayoutCheck runs on, and weekly backups of it. Also our support email, support@ | Everything stored on our server, because it runs on theirs, and the emails you send to that address |
| Dodo Payments | Payments only. Dodo runs checkout and is the merchant of record. | What you enter at checkout, such as your card details and email. From us: which product you are buying, and an internal id for your audit or pass. |
When you pay, Dodo is given your audit link (or your pass code) as the address to send you back to.
We send no part of your file or your results to Dodo. PayoutCheck uses no analytics or advertising service, and it sends no email.
Personal information in your file
Some Shopify exports include the customer’s name. We drop the columns named Customer First Name and Customer Last Name when the file is read, so they are never stored with your audit. They stay only in the uploaded file until it is deleted.
In the file layouts PayoutCheck supports, no column is meant for an email address, a phone number or a postal address. Any extra column you add to a file yourself is kept as it is.
If something goes wrong
If we confirm that customer data was exposed, we will put a notice on this website and email the buyers whose email address we hold. We aim to do this within 72 hours of confirming it, where practically possible.
We hold no email address for anyone who used only the free check, and a buyer’s email is erased 120 days after payment. For them, the notice on this website is the only way we can tell them.
Report a security problem
Write to support@payoutcheck.online. The same address is in our security.txt file.
What we do not claim
- Your file is not end-to-end encrypted. Our server holds the key, because it has to read your file to audit it.
- Your results are stored as plain text in our database and in its copies.
- Hostinger’s backups can hold a copy of your data for up to about two weeks, and we cannot delete anything from them.
- Anyone with your audit link can open that audit, and delete it, until it is deleted. There are no accounts, so treat the link like a password.
- We hold no security certification, such as SOC 2 or ISO 27001.