Comprehensive Privacy Policy

VectorPay LLC, a Montana limited liability company with its registered office at 1001 S Main St # 11903, Kalispell, MT 59901-1498, is the controller of personal information described in this policy. This policy applies to our website, merchant application process, merchant portal, payment gateway, and terminal services. It covers merchant applicants and their principals, authorized portal users, and individuals who authorize a payment to one of our merchants.

In the twelve months preceding the date above, we collect or may collect the following categories: identifiers (name, postal address, email, telephone, IP address, government identification number); commercial information (transaction records, processing history); financial information (bank account and routing numbers, settlement details, tax identification number); internet activity (browsing and interaction with our site and portal); geolocation data (approximate, derived from IP address); professional information (business role, ownership percentage); and inferences drawn for risk and underwriting purposes.

We do not collect biometric information, and we do not knowingly collect sensitive personal information beyond government identification collected to satisfy customer identification requirements.

We collect information directly from you when you apply, communicate with us, or use the portal; automatically through your device when you use our website; from your financial institution through Plaid when a bank account is connected; from identity verification, credit, and sanctions screening vendors; from our processors and the card networks in the course of processing and dispute handling; and from public records, including state business registries.

We process personal information to perform our contract with you (account administration, payment processing, settlement, support); to comply with legal obligations (customer identification, beneficial ownership collection, sanctions screening, suspicious activity reporting, tax reporting, and record retention); and for our legitimate interests in preventing fraud, managing credit and chargeback risk, securing our systems, and improving our services. Where we rely on consent, such as for optional analytics cookies, you may withdraw it at any time.

Where you or your customer elects to connect a bank account, that connection is made through Plaid Inc. Authentication occurs directly with the financial institution. VectorPay does not receive, view, or store online banking credentials at any point. We request only the data elements required to originate and verify a payment: verified account and routing numbers, the account holder name for ownership matching, and account or balance status to reduce returned entries. We do not request transaction history, income, liability, or investment data. Plaid's processing of information it collects is governed by Plaid's own privacy policy. A connection may be revoked at any time, which will prevent future debits but does not reverse payments already authorized and submitted.

We disclose personal information to our processing partners for the purpose of providing the services; to service providers bound by contract and acting on our instructions, including identity verification, bank account verification, hosting, communications, and support vendors; to the card networks and the ACH operator as their rules require; to a party's financial institution in connection with a dispute, return, or reversal; to professional advisers, auditors, and insurers; and to law enforcement, regulators, or courts where required by law or valid legal process. Personal information may be disclosed in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this policy. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Merchant account records, customer identification records, and beneficial ownership documentation are retained for at least five years following account closure. Payment authorizations and transaction records are retained for at least five years following settlement, consistent with NACHA authorization retention requirements and applicable anti-money-laundering recordkeeping rules. Dispute and chargeback evidence is retained for at least two years following resolution. Website and portal access logs are retained for up to thirteen months. Records subject to a legal hold are retained until the hold is released.

Card data is encrypted within the terminal at the point of interaction and is not transmitted to or stored on merchant systems. We apply encryption in transit and at rest, role-based access control with least-privilege administrative rights, multi-factor authentication for administrative access, logging and review of portal and administrative activity, network segmentation, vulnerability management, and periodic access recertification. No system is perfectly secure. Where a security incident affects personal information, we will notify affected individuals and regulators as and when required by applicable law.

Depending on your state of residence, you may have the right to know the categories and specific pieces of personal information we have collected; to request correction of inaccurate information; to request deletion; to obtain a portable copy; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information; and to appeal a denial of a request. Residents of California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy statutes may exercise the rights those statutes provide.

Submit requests to privacy@vector-pay.com or by mail to the address below. We will verify your identity before acting on a request, ordinarily by confirming information already in our records. An authorized agent may submit a request with written permission. We respond within 45 days, extendable once by a further 45 days where reasonably necessary. We may decline a request where retention is required by law, in which case we will explain the basis. We do not discriminate against anyone for exercising these rights.

Merchant applications are screened using automated risk and sanctions tools. No application is declined solely on the basis of automated processing without human review. If your application is declined, you may request a review by contacting compliance@vector-pay.com.

Our services are directed to businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children, and we will delete such information promptly if we learn we have received it.

We may amend this policy by posting a revised version with an updated effective date. Where changes materially affect how we handle personal information about active merchants, we will provide notice to the email address of record before the change takes effect.

VectorPay LLC, 1001 S Main St # 11903, Kalispell, MT 59901-1498, United States. Privacy requests: privacy@vector-pay.com. Compliance matters: compliance@vector-pay.com.