Privacy Policy

1.Information we collect

The information we collect depends on how you interact with Paydude and the services you use.

A. Account and contact information

We may collect:

• first and last name;
• business name;
• job title;
• email address;
• telephone number;
• mailing or business address;
• usernames;
• account identifiers;
• authentication-related information; and
• communications with Paydude.

B. Merchant and business information

When a business applies for or uses Paydude payment services, Paydude, Tilled, or associated service providers may collect information such as:

• legal business name;
• trade or DBA name;
• business type;
• entity type;
• business address;
• business website;
• industry;
• business description;
• tax identification information;
• transaction history or anticipated payment volume;
• merchant category information;
• ownership information;
• information regarding officers, directors, managers, beneficial owners, or controlling persons; and
• other information required for underwriting, payment processing, compliance, or risk management.

C. Identity and compliance information

Payment services are subject to identity-verification, banking, card-network, fraud-prevention, and regulatory requirements. Paydude, Tilled, or their service providers may therefore collect:

• date of birth;
• Social Security number or portions of a Social Security number;
• Employer Identification Number;
• tax identification information;
• government-issued identification information;
• beneficial ownership information;
• identity-verification results;
• business-verification results;
• sanctions or watchlist screening results;
• fraud indicators;
• underwriting information; and
• information necessary for Know Your Customer (“KYC”), Know Your Business (“KYB”), OFAC, MATCH, fraud-prevention, underwriting, or similar compliance processes.

Certain information may constitute sensitive personal information under applicable law.

Paydude uses sensitive personal information only as reasonably necessary to provide and secure services, verify identities and businesses, prevent fraud, manage risk, comply with legal obligations, or perform other permitted business purposes.

D. Financial information

Depending on the services used, Paydude, Tilled, financial institutions, or other payment providers may collect:

• bank account information;
• routing information;
• payout information;
• settlement information;
• billing information;
• transaction history;
• account balances where applicable; and
• other financial information necessary to provide payment services.

E. Card and payment information

When transactions are processed using Paydude-powered services, information associated with the transaction may include:

• transaction amount;
• transaction date and time;
• merchant information;
• payment method;
• card type;
• transaction status;
• authorization results;
• refunds;
• disputes;
• chargebacks;
• tokenized payment credentials;
• truncated card information;
• billing information; and
• fraud and risk indicators.

Paydude designs its payment integrations to minimize its exposure to raw payment-card information.

Where payment credentials are collected using Tilled-hosted or Tilled-controlled payment components, payment-card information is transmitted to Tilled’s payment infrastructure and Paydude does not intentionally store full card numbers or card security codes within Paydude-controlled application systems.

F. Customer and cardholder information

Businesses using Paydude may provide information concerning their customers and transactions. Depending on the transaction, this may include:

• customer name;
• email address;
• telephone number;
• billing address;
• shipping address;
• transaction information;
• payment information;
• IP address;
• device information; and
• fraud or risk information.

The merchant ordinarily controls its relationship with its customers and is responsible for its own privacy notices and obligations.

Paydude and Tilled may process customer information as necessary to facilitate payments and provide related services.

G. Device, website, and usage information

When you use our websites or services, we and our service providers may automatically collect:

• IP address;
• browser type;
• device type;
• operating system;
• approximate location derived from an IP address;
• referring website;
• pages viewed;
• dates and times of access;
• account activity;
• system logs;
• error information;
• security events; and
• diagnostic and usage information.

H. Cookies and similar technologies

We may use cookies, local storage, pixels, SDKs, or similar technologies for:

• authentication;
• account security;
• fraud prevention;
• maintaining sessions;
• remembering preferences;
• website functionality;
• analytics;
• diagnosing technical problems; and
• measuring performance.

Where required by applicable law, Paydude will provide appropriate choices regarding non-essential cookies or tracking technologies.

2.Sources of personal information

Paydude may obtain information:

• directly from you;
• from merchants using Paydude;
• from Tilled;
• from acquiring or sponsoring banks;
• from card and payment networks;
• from fraud-prevention providers;
• from identity-verification providers;
• from compliance and risk providers;
• from service providers;
• from publicly available sources;
• automatically through our websites and applications; and
• from other lawful sources.

3.How we use personal information

Paydude may use personal information to:

• provide and operate our services;
• establish and maintain accounts;
• process and facilitate payments;
• authorize transactions;
• settle and reconcile transactions;
• facilitate payouts;
• calculate fees;
• onboard merchants;
• underwrite merchants;
• verify identities and businesses;
• perform KYC and KYB;
• conduct sanctions or watchlist screening;
• manage risk;
• detect and prevent fraud;
• investigate suspicious activity;
• administer refunds;
• administer disputes and chargebacks;
• provide technical and customer support;
• authenticate users;
• secure our systems;
• monitor system activity;
• troubleshoot technical problems;
• improve our products and services;
• communicate service-related information;
• maintain business records;
• perform accounting and financial reporting;
• enforce our agreements;
• protect Paydude, merchants, customers, Tilled, banks, payment networks, and others;
• comply with applicable laws, regulations, legal process, banking requirements, and payment-network rules; and
• establish, exercise, or defend legal rights.

We may also use information for other purposes disclosed when information is collected or when authorized by you.

4.Tilled and our payment infrastructure

Paydude is an enterprise partner of Tilled and uses Tilled technology to provide core payment functionality under the Paydude brand.

Tilled may provide or support functionality including:

• payment processing;
• merchant onboarding;
• merchant account administration;
• transaction processing;
• payouts and settlement;
• card tokenization;
• hosted payment components;
• identity and business verification;
• KYC and KYB;
• fraud and risk monitoring;
• compliance screening;
• dispute management;
• reporting; and
• related payment services.

Information submitted through Paydude may therefore be transmitted to or processed by Tilled.

Tilled may also provide information to Paydude as reasonably necessary to administer merchant relationships, support users, process transactions, manage risk, reconcile accounts, manage disputes, calculate fees, and provide Paydude services.

Depending on the particular processing activity and applicable law, Paydude, Tilled, merchants, banks, and other participants may act as independent businesses or controllers or as processors or service providers on behalf of another party.

Tilled’s independent collection and processing of information is also governed by its agreements and privacy practices.

Please review Tilled’s Privacy Policy for additional information.

5.How we disclose personal information

Paydude may disclose personal information to the following categories of recipients.

Tilled

We disclose information to Tilled as reasonably necessary to provide Paydude payment services.

Banks and financial institutions

Information may be disclosed to acquiring banks, sponsoring banks, settlement banks, and other financial institutions involved in processing or settling transactions.

Card and payment networks

Information may be transmitted through Visa, Mastercard, American Express, Discover, ACH networks, or other payment systems when necessary to process transactions.

Compliance, identity, fraud, and risk providers

We may disclose information to providers supporting:

• identity verification;
• business verification;
• KYC;
• KYB;
• sanctions screening;
• fraud prevention;
• risk monitoring;
• underwriting;
• consumer or business reporting where permitted; and
• regulatory compliance.

Operational service providers

We may use service providers supporting:

• cloud infrastructure;
• hosting;
• software development;
• communications;
• email;
• customer support;
• analytics;
• cybersecurity;
• monitoring;
• accounting;
• legal services; and
• other operational functions.

We seek to limit service providers’ use of information to the services they perform for Paydude or other purposes permitted by law and contract.

Merchants

Where necessary to process or administer a transaction, information may be made available to the merchant associated with that transaction.

Legal and compliance disclosures

We may disclose information where reasonably necessary to:

• comply with applicable law;
• respond to lawful process;
• comply with regulatory requirements;
• investigate fraud or suspected illegal activity;
• protect our systems;
• enforce agreements;
• respond to card-network or banking requirements;
• protect the rights or safety of Paydude, our merchants, customers, partners, or others; or
• establish, exercise, or defend legal claims.

Corporate transactions

Personal information may be transferred or disclosed in connection with:

• a merger;
• acquisition;
• financing;
• corporate restructuring;
• sale of assets;
• bankruptcy; or
• similar business transaction.

6.Sale, sharing, and targeted advertising

Paydude does not sell payment-processing or financial information for monetary consideration.

Paydude does not use payment-processing information for cross-context behavioral or targeted advertising.

Paydude may disclose information to the service providers, financial institutions, and other parties described in this Privacy Policy to operate and secure our services.

If Paydude’s practices change in a manner that creates additional statutory opt-out rights, Paydude will provide legally required notices and choices.

7.Data security

Paydude maintains administrative, technical, and organizational safeguards designed to protect personal information. These safeguards include, as appropriate:

• multi-factor authentication;
• access controls;
• least-privilege access;
• encryption;
• secure payment components;
• tokenization;
• monitoring and logging;
• vulnerability management;
• security review of service providers;
• security incident procedures; and
• personnel security requirements.

Paydude also relies on security controls maintained by Tilled and other infrastructure providers for systems those providers operate.

No system, service, or method of electronic transmission can be guaranteed to be completely secure.

Please review Paydude’s Security Overview for more information.

8.Payment card security and PCI DSS

Paydude maintains Payment Card Industry Data Security Standard (“PCI DSS”) compliance applicable to its payment environment and responsibilities.

Paydude uses Tilled as a core payment technology provider. Tilled is a validated Level 1 PCI compliant service provider.

Paydude seeks to reduce PCI scope through secure payment components, tokenization, and by limiting Paydude-controlled systems’ exposure to raw payment-card credentials.

Merchants using Paydude remain responsible for satisfying the PCI DSS requirements applicable to their own systems, websites, personnel, and payment environments.

9.Data retention

Paydude retains information only for as long as reasonably necessary for legitimate purposes, including:

• providing services;
• maintaining accounts;
• processing transactions;
• financial and accounting requirements;
• fraud prevention;
• regulatory requirements;
• legal obligations;
• banking requirements;
• payment-network requirements;
• contractual obligations;
• dispute resolution; and
• enforcing agreements.

Different categories of information may have different retention periods.

When information is no longer reasonably necessary, Paydude will delete, destroy, deidentify, anonymize, or otherwise securely dispose of it where reasonably practicable and permitted by law.

Information maintained independently by Tilled, financial institutions, card networks, or other providers is subject to their respective retention requirements.

10.Your privacy rights

Depending on your state or country of residence and applicable law, you may have the right to:

• confirm whether we process your personal information;
• access personal information;
• correct inaccurate information;
• request deletion;
• obtain a portable copy of certain information;
• obtain information regarding categories of information collected;
• obtain information regarding categories of recipients;
• opt out of certain sales or sharing where applicable;
• opt out of certain targeted advertising where applicable;
• limit certain uses of sensitive personal information where applicable;
• withdraw consent where processing is based on consent;
• appeal certain privacy-request decisions; and
• exercise privacy rights without unlawful discrimination.

These rights are subject to exceptions. For example, Paydude may be required or permitted to retain information related to:

• transactions;
• fraud;
• disputes;
• chargebacks;
• taxes;
• compliance;
• banking;
• payment-network requirements;
• legal claims; and
• financial recordkeeping.

If Paydude processes information solely on behalf of another business, we may direct your request to that business or assist it in responding.

11.Privacy requests

To exercise an applicable privacy right, contact Paydude LLC at support@paydude.io.

Please describe your request and provide sufficient information for us to reasonably verify your identity.

We may request additional information when reasonably necessary to verify a request and protect information against fraudulent access.

Authorized agents may submit requests where permitted by law. Paydude may require proof of the agent’s authority and may verify the identity of the person making the request.

If applicable law provides a right to appeal a privacy decision, an appeal may be submitted using the same contact information with the subject or heading “Privacy Appeal.”

12.Opt-out preference signals

Where required by applicable law, Paydude will recognize legally applicable browser-based opt-out preference signals, such as Global Privacy Control, for processing activities to which such signals apply.

13.Children

Paydude’s merchant services are intended for businesses and adults.

Paydude does not knowingly solicit personal information directly from children under 13.

If Paydude learns that it collected personal information directly from a child under 13 in violation of applicable law, Paydude will take reasonable steps to delete that information.

This section does not prevent ordinary payment processing where a minor lawfully makes a purchase from an independent merchant using Paydude-powered payment services.

14.Third-party services

Paydude websites and services may contain links to or integrations with third-party services.

Paydude’s Privacy Policy does not control the independent privacy practices of those organizations.

15.Changes to this privacy policy

Paydude may update this Privacy Policy to reflect changes in:

• our products or services;
• our payment infrastructure;
• our service providers;
• our business;
• applicable law;
• technology; or
• our privacy practices.

The “Last updated” date above identifies the latest version.

Where required by law, we will provide additional notice of material changes.

16.Contact us

Questions regarding privacy or security may be directed to Paydude LLC at support@paydude.io.