Your data, accounted for.

Scope — two different roles

This policy covers personal information we handle for our own purposes: website visitors, account holders, and people who contact us. For that data we act as the controller.

Separately, when your systems submit mandates, agent records, and transaction evidence through the API, we process that data on your instructions as a processor / service provider. Your own privacy notice governs that data and your end users; requests about it go to you as the controller. A data-processing addendum is available under your service agreement.

What we collect

• Account data — email address and a one-way password hash (we never store plaintext passwords), plus session and membership records.
• API credentials — keys you mint are stored only as SHA-256 hashes; provider credentials you register are stored encrypted and never returned or logged.
• Operational logs — request metadata (timestamps, endpoints, status codes, rate-limit counters, client IP) used for security, throttling, and abuse prevention.
• Usage and device data — browser type and pages you view on the dashboard, collected by our own infrastructure only.
• Transaction evidence you submit — the payment, mandate, and decision records your systems send us for scoring and audit. This is your business data, processed under your instructions.
• Communications — emails and access requests you send us, including the delivery audit for messages we send you.

What we don't collect

• Your customers' payment credentials, card numbers, or bank account details.
• Advertising identifiers, cross-site trackers, or third-party analytics cookies. The only cookie we set is the session cookie that keeps you signed in.
• Funds — we never hold, receive, or route money; there is no balance or account of yours here to hold.
• Sensitive personal data (government IDs, health data, biometrics) — don't submit it through the API unless your service agreement expressly permits it.

How we use it — and why

• Operate the service — authentication, scoring, screening, evidence records, and the audit trail (contractual necessity / legitimate interest).
• Security — throttles, lockouts, collusion and anomaly detection (legitimate interest / legal obligation).
• Communicate with you — verification, reset, and lifecycle emails (contractual necessity).
• Improve the service — de-identified and aggregated telemetry only; never identifiable personal data (legitimate interest).
• We never sell your data and never share it for third-party marketing or cross-context behavioral advertising.

Automated decision-making

The platform scores and screens automatically — that's the product. Those outputs are decision-support for your systems and release policies: you configure the thresholds and you decide what proceeds. We don't make decisions with legal or similarly significant effect about individuals on our own behalf.

Cookies and tracking

One HttpOnly session cookie — that's it. No advertising pixels, no analytics trackers, no cross-site fingerprinting. We don't respond to Do Not Track or Global Privacy Control signals because there's nothing to opt out of.

Sharing

Data is shared only with: infrastructure providers that host and deliver the service (compute, transactional email); provider endpoints you explicitly configure (e.g. your sponsor bank, using your own credentials); professional advisors under confidentiality; and law enforcement or regulators where legally required. Subprocessors are bound by confidentiality and security obligations; a current list is available on request.

Retention

Account data is kept while your account is active and deleted within a reasonable window after closure. Operational logs age out on a rolling basis. Audit and evidence records are retained per your plan — up to seven years — because their purpose is surviving audit; deletion requests for those records are governed by your service agreement and applicable law.

Security

Secrets are stored hashed or encrypted, transport is TLS, access is least-privilege and audited, and provider keys are envelope-encrypted. See Security for how we handle vulnerability reports.

Your rights

Depending on your jurisdiction you may have rights to access, correct, delete, export, or port your personal data, to object to or restrict processing, and to complain to a supervisory authority. Exercising them won't get you discriminated against. Email contact@paymnts.ai — we verify identity before acting, respond within the legally required window, and an authorized agent may act for you with proof of authorization.

For data we process on behalf of a customer (mandates, transactions, agent records), contact that customer — they're the controller. If you can't reach them, email us and we'll direct the request where we can.

Regional notes

EEA/UK — the legal bases above apply; transfers use appropriate safeguards (including standard contractual clauses where required). California and other US states — we don't sell or share personal information as those laws define it; the rights above are available to you. International — data is processed where our infrastructure runs; by using the service you consent to those transfers.

Children

The service is not directed at children under 18 and we do not knowingly collect their data.

Changes

We may update this policy; the effective date above reflects the current version and material changes will be flagged on this page.

Contact

Privacy questions, requests, and complaints: contact@paymnts.ai.