Privacy policy

PAID processes payments, which means it processes personal and financial information. This page is the canonical statement of what we collect, why, how long we keep it, who we share it with, and the rights you have. It is grounded in our internal data-governance audit and our security model; if any claim on this page conflicts with the audit, the audit wins and this page is wrong.

Last updated: 2026-07-09  ·  Effective: 2026-07-09

1. Who we are

"PAID" refers to the operator of the PAI'D Payments Intelligence platform — a payment-orchestration and technology platform. PAID coordinates payment acceptance and settlement between buyers, sellers, and the licensed sub-processors that perform the regulated activity; the movement, holding, and settlement of funds is performed by those licensed providers, not by PAID. PAID is NOT a bank, a credit underwriter, a card network, a fraud-decisioning service, a money transmitter, or a custodian of consumer funds, and does not hold money-transmission or banking licenses.

2. What we collect

We collect the minimum information required to process payments, satisfy regulatory obligations, and protect the platform.

2.1 From buyers (people who pay through a PAID-hosted checkout)

• Payment method credentials — Card data is tokenized in your browser by Stripe Elements before reaching any PAID server. PAID never stores card numbers (PAN) at rest. Bank-link credentials are encrypted with AES-256-GCM.
• Transaction metadata — Amount, currency, merchant name, descriptor, timestamp, idempotency key.
• Optional identification — When the merchant configures it, we may collect email, billing address, or shipping address.
• Device + session telemetry — IP address, User-Agent string, session timestamps. Sessions are bound to a SHA-256 fingerprint of (IP + UA).

2.2 From sellers (merchants using PAID)

• KYB / KYC identifiers — Legal entity name, jurisdiction, business type, projected volumes, beneficial-owner names and roles (self-declared in PAID), and government business identifiers (EIN / company number) submitted to Stripe Connect for verification.
• Sanctions + PEP screening — Lookups against OFAC, EU consolidated, UN, HMT lists and PEP databases (via Sardine).
• Merchant payout-bank credentials — Verified ACH routing + account numbers obtained via Plaid Link when a merchant links their payout bank. The Plaid access token is exchanged immediately for a Plaid Processor Token bound to Dwolla; PAID stores no raw bank credentials. Used only on the merchant payout rail — not for buyer-side data.
• API keys — Stored as SHA-256 hashes; plaintext is never persisted.

2.3 From third-party providers

• Merchant payout bank verification — Plaid provides verified ACH routing + account numbers (Auth), confirms the destination account is active (Balance), and matches the bank-account holder name to the legal entity we KYB'd (Identity). The access token is then exchanged for a Plaid Processor Token bound to Dwolla, which executes ACH payouts under its licenses. Plaid is NOT used for buyer-side data, transaction history, or any consumer financial profile.
• Acceptance rails — Stripe (cards), PayPal, Dwolla (ACH), ClearBank (UK Faster Payments), Binance Pay (crypto), Circle (USDC), FedNow (US real-time payments) all return transaction outcomes that we record.
• Merchant identity verification — Stripe Connect returns verification outcomes, requirement status, and document-verification results for connected accounts. Government ID images and biometric checks are collected and held by Stripe under its Connect onboarding flow — not stored by PAID.

3. Why we collect it (lawful bases under GDPR Article 6)

• Contract performance — We need transaction data and identifiers to execute the payment you initiated. This is the primary lawful basis for buyer + seller data.
• Legal obligation — KYC, KYB, sanctions screening, tax reporting (IRS 1099-K, regulatory equivalents), AML record-keeping. We are required to collect and retain this data.
• Legitimate interests — Fraud prevention, abuse detection, infrastructure security, audit trail integrity. We balance these against your rights and use the minimum data necessary.
• Consent — Plaid Link's bank-account connection flow asks you to consent at the linking step. Stripe Elements card entry and Stripe Connect hosted onboarding collect payment and identity data under Stripe's privacy policy. We rely on these third-party consent flows rather than collecting consent ourselves at the PAID-surface level.

4. How long we keep it (retention)

Retention policies match our internal Data Governance audit:

• Ledger events — Indefinite. Append-only by design; the hash chain is broken if any event is removed. Required for regulatory replay and dispute resolution.
• Payment intents, settlement records, reconciliation reports — 7 years (US tax + SOX + dispute window).
• Raw provider statements — 90 days raw; the reconciled summary is preserved for 7 years.
• API keys (hashed) — Until revoked, then 90 days additional for the audit trail of the revocation.
• Session tokens — Up to 24 hours; auto-expire in Redis.
• Rate-limit counters, CSRF tokens, ephemeral cache — Until expiry (typically minutes to hours).
• Trust Fabric admission certificates + Merkle transparency log — Indefinite. Certifications must remain verifiable forever.

The full retention matrix lives in DATA_GOVERNANCE.md in our public repository.

5. Who we share data with

We share data only when one of these applies:

• Payment-rail providers — Stripe, PayPal, Dwolla, ClearBank, Binance Pay, Circle, FedNow. Required to execute the payment you initiated.
• Merchant payout-bank verification provider — Plaid. Required when a merchant links their payout bank account; not used on the buyer side.
• Merchant identity verification — Stripe (Connect onboarding). Required for merchant KYB / representative KYC on card rails. PAID passes business profile and beneficial-owner details; Stripe collects and verifies identity documents under its licenses.
• Sanctions + PEP screening — Sardine. Required for AML compliance.
• Hosting + infrastructure — Render (US-region application servers + PostgreSQL); secrets at rest are AES-256-GCM-encrypted at the application layer in addition to Render's cloud-provider disk encryption.
• Legal compliance — Law enforcement, tax authorities, courts when compelled by valid legal process. We will challenge overbroad requests and will notify you where the law permits.
• Business successors — Acquirers in the event of a merger, acquisition, or asset sale (with your data subject to the same protections).

We do NOT sell your data, and we do NOT share it for advertising, marketing-target enrichment, or any non-payment commercial purpose.

6. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, LGPD, PIPEDA), you have some or all of these rights:

• Right of access — Get a copy of the personal data we hold about you.
• Right of rectification — Correct inaccurate data.
• Right of erasure — Delete data we no longer need to keep. Note: financial-record retention obligations override deletion requests for the legally-required retention window (typically 7 years).
• Right of portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests.
• Right to withdraw consent — Where consent is the lawful basis (e.g., the Plaid Link flow), you can disconnect your bank link at any time from your merchant dashboard or by contacting us.
• Right not to be subject to automated decision-making — PAID does not make automated fraud-decisioning calls (we surface signals to merchants and human reviewers; the decision sits with the merchant).
• Right to lodge a complaint — With your local data-protection authority.

To exercise any of these rights, email [email protected]. We respond within 30 days (or the local statutory window if shorter). We may need to verify your identity before acting on a request.

7. International data transfers

Our infrastructure is currently hosted in the United States (Render's US regions). If you access PAID from outside the United States, you understand and consent to your data being transferred to and processed in the United States. Where required (e.g., for EU traffic under GDPR), we rely on Standard Contractual Clauses with our sub-processors. EU expansion with EU-region hosting is on our roadmap.

8. Security

Our security model is documented in detail at /docs/security. Headlines:

• TLS 1.2+ in transit (1.3 for hosted deployments).
• AES-256-GCM at the application layer for Plaid credentials and provider-registry secrets.
• Database disk encryption at the cloud-provider layer (Render AES-256 at rest).
• Mandatory MFA on admin access via OIDC with mandatory MFA-claim enforcement.
• Tenant isolation enforced at the middleware layer.
• Hash-chained financial-event ledger with end-to-end verification endpoint.
• Per-IP and per-merchant rate limiting at the gateway.
• Automated dependency vulnerability scanning (Dependabot + CodeQL + govulncheck + Trivy + npm audit).

9. Children

PAID is a business-to-business platform. We do not knowingly collect data from anyone under 16 (or under 13 in jurisdictions where that floor applies). If you believe we have inadvertently collected data from a minor, email [email protected] and we will delete it.

10. Cookies and similar technologies

We use a small number of strictly necessary cookies (session cookie, CSRF token, Stripe Elements iframe state). We do NOT use third-party analytics, tracking pixels, advertising cookies, or behavioral-profiling cookies on the buyer-facing checkout surface. Some merchant dashboard surfaces may include first-party analytics for product-improvement purposes; these are described in the relevant dashboard page.

11. Changes to this policy

When we materially change this policy, we will update the "Last updated" date at the top and — where the change affects how we use personal data already collected — notify affected users via email or in-app notice. The full revision history is available in our public repository.

12. Contact

This policy is grounded in code, not marketing copy. The retention periods, lawful bases, and security measures cited here are auditable against the public source repository. If a third-party auditor finds a discrepancy between this page and the actual system behavior, that discrepancy is a bug we want to know about — email [email protected].