Privacy Policy

1. Who is responsible for your data

The data controller is Clearpoint Data LLC, trading as FlyThePay, a limited liability company organized under the laws of the State of Wyoming, United States, with its principal office at 1021 E Lincolnway #10515, Cheyenne, WY 82001, United States.

For any question or request about your personal data, write to sales@flythepay.com with "Privacy" in the subject line.

2. What we collect

Website visitors. Our hosting provider records standard server logs (IP address, browser type, pages requested, timestamps) for security and capacity purposes. We do not set cookies on this website and we do not run analytics or advertising trackers. Fonts are loaded from Google Fonts, which means your browser sends a request, including your IP address, to Google when a page loads. Google's handling of that request is described in Google's privacy policy.

Enquiries. When you use the contact form or email us we receive the details you provide: name, business email, website, industry, expected monthly volume and your message. The contact form is processed by our hosting provider, Netlify, Inc. (San Francisco, USA), which stores submissions on our behalf and forwards them to us by email.

Merchant applicants and merchants. During onboarding and for the life of the account we collect company information (legal name, registration details, addresses, tax IDs, bank account details), information about directors, shareholders and beneficial owners (names, dates of birth, nationality, addresses, copies of identity documents, proof of address, sanctions and adverse-media screening results), commercial information (products, websites, pricing, refund and delivery policies, processing statements, chargeback and fraud history) and account activity (transactions, settlements, disputes, support tickets and communications).

End customers. When a customer buys from a FlyThePay merchant, we act as Merchant of Record and receive the data needed to complete and account for the sale: name, email address, billing and, where relevant, shipping address, country and tax location, payment method details (card data is tokenized by our PCI DSS Level 1 processor and never stored by us in clear form), transaction amount, currency and description, IP address, device and browser information used for fraud screening and 3-D Secure, and any refund, dispute or support correspondence.

3. Why we use it and on what legal basis

• To assess and onboard merchants and to perform the Merchant Agreement (performance of a contract; steps taken at your request before entering a contract).
• To process payments, taxes, refunds and payouts for end customers and merchants (performance of a contract).
• To comply with law, including anti-money-laundering and know-your-customer rules, sanctions screening, tax reporting, card network rules and lawful requests from authorities (legal obligation).
• To prevent fraud, abuse and chargebacks, including transaction scoring, velocity checks, 3-D Secure and dispute-alert programmes (legitimate interest in protecting our business, merchants and customers; legal obligation under card network rules).
• To operate and secure the website and our systems (legitimate interest).
• To answer enquiries and communicate with you about your application or account (performance of a contract; legitimate interest).
• To send marketing about our services to business contacts, from which you can opt out at any time (legitimate interest, or consent where required by law).

4. Who we share it with

We share personal data only where needed for the purposes above, with:

• acquiring banks, payment processors, card networks (such as Visa and Mastercard), alternative payment method providers and banks that hold or move funds;
• identity verification, sanctions screening, credit and fraud prevention providers, including 3-D Secure and dispute-alert programmes such as Ethoca and Verifi;
• tax calculation and filing providers and tax authorities in the countries where we collect and remit tax;
• cloud hosting, email, customer support and document storage providers acting on our instructions;
• the merchant whose product or service you bought, so they can deliver it and support you (end customers only);
• our professional advisers, auditors and insurers;
• courts, regulators, law enforcement and card networks where required by law or network rules, including reporting to card network fraud and termination databases;
• a buyer or successor in the event of a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data and we do not share it with third parties for their own marketing.

5. International transfers

We are established in the United States and work with providers in the United States, the European Economic Area, the United Kingdom and other countries. Where personal data protected by EU, UK or Swiss law is transferred outside those territories, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) or another lawful transfer mechanism, together with appropriate technical and organisational safeguards.

6. How long we keep it

• Enquiries that do not lead to an application: up to 24 months after our last contact.
• Merchant onboarding and KYB records, including identity documents: for the life of the account and at least 5 years after it closes, or longer where anti-money-laundering or tax law requires.
• Transaction, settlement, tax and dispute records: at least 7 years after the transaction, as required by tax and accounting rules.
• Fraud and chargeback data: for as long as needed to protect against repeat fraud, and as required by card network rules.
• Server logs: up to 12 months.

When data is no longer needed we delete it or anonymise it.

7. Security

Card data is handled by processors certified to PCI DSS Level 1 and is tokenized at checkout. We use encryption in transit and at rest, access controls, logging and staff confidentiality obligations. No system is completely secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. Residents of the European Economic Area, the United Kingdom and Switzerland also have the right to lodge a complaint with their data protection authority. Residents of certain US states have rights under state privacy law, including the right not to be discriminated against for exercising them.

To exercise any right, email sales@flythepay.com. We will verify your identity and respond within the time the law allows, normally one month. Some data cannot be deleted while we are required to keep it for anti-money-laundering, tax or dispute purposes; we will tell you when that is the case.

End customers can also contact the merchant they bought from, who holds their own copy of the order data.

9. Cookies

This website does not set cookies or use local storage. If that changes, we will update this policy and, where the law requires, ask for your consent before setting non-essential cookies. Payment pages and any merchant area we operate use strictly necessary cookies for session security and fraud prevention, which do not require consent.

10. Children

Our services are for businesses and for adult customers. We do not knowingly collect data from anyone under 18. Merchants selling age-restricted products must operate age verification as required by our Acceptable Use Policy.

11. Changes to this policy

We may update this policy from time to time. The effective date at the top of the page shows when the current version took effect. For material changes affecting merchants we will notify the account contact by email.