Privacy Policy

STARTER DRAFT. Not legal advice. Have your attorney review and adapt this text before you publish it. Replace every item in double square brackets, such as [[Company legal name]]; the Portal will not publish a document while any remain. Delete this paragraph when you are done.

1. Who we are and what this covers

This Privacy Policy explains how [[Company legal name]], doing business as MyEzPay and PayMidWare ("we", "us"), collects, uses and shares personal information through the PayMidWare Admin Portal, the PayMidWare payment pages, the Register (point of sale) site, the PayMidWare API and our websites. When we handle information about a business's customers, we usually do so on behalf of that business, which decides why the information is collected. This policy explains what we do with it.

2. Information we collect

People who use the Admin Portal or API (employees, providers and merchants and their staff):

• Name, work email address, role, business details and, if you choose to add it, a mobile number.
• Sign-in and security information: a hashed password, sign-in times and results, the trusted browsers you choose to keep (browser type, internet address and last use), codes we send you (never kept after use) and activity logs of key account actions.
• Support requests, chat messages and attachments you send us.

Customers of our merchants and providers (as entered by them or by you on a payment page):

• Name, email address, phone number, billing or service address and an account reference.
• Invoices, payment amounts, dates, status and receipts, scheduled payment details, and records of consent to texts.
• Payment method details. Card and bank details are sent to the payment gateway or processor. We keep references to them (such as a token, card brand and last four digits) and not the full card number or security code. [[Confirm against your actual card data handling.]]

Everyone who visits: internet address, browser and device type, pages visited and dates and times, and cookies described below.

2A. Visitors, newsletter readers and people who ask about our services

If you use a form on our website, ask for a demo, sign up for the Sandbox or a merchant account, contact us, chat with us, or subscribe to a newsletter, we collect what you enter (such as your name, email address, company, phone number, what you are interested in, and anything you write to us), the page you used, and the date and time. We keep a sales record about you and notes of our contact with you, such as the emails we sent you and whether they were delivered, opened or clicked, so that we can follow up. We also keep the choices you make, such as that you unsubscribed or asked us not to email you.

Newsletter sign-up. When you subscribe we email you a link to confirm. Until you use it, you are not subscribed. When you do, we record the time, the page, and the internet address you used, as proof that you agreed. We do not ask for more than your email address unless the form says so.

2B. Bookings, setup help and support calls

If you book a demo, a setup or migration session or a support call, we collect your name, email address, phone number, company, the time zone and the time you chose, the answers you give about what you want help with (for example what you use today, what you want to move and rough counts of records), and notes taken by our staff during or after the session. A demo is also added to your sales record. For a paid session we keep the fee, the date, the last four digits and brand of the card, the refund status and any reason a staff member gave for a free session or a refund. The card number itself goes to the payment gateway and is not kept by us. We send you a confirmation and a calendar file, and the staff member who owns the session sees your details.

2C. Files you send us and information you move from another system

A merchant or provider may send us files of invoices through the Portal or the API, and may import customers, saved payment references and schedules from another gateway. These files contain information about the business's customers, such as names, contact details, invoice amounts and references. We process them on behalf of that business. The text of an invoice file is deleted once the file has finished processing, and a record of what happened to each row is kept for 30 days. We keep the file's name and size, who sent it, when it ran, and a fingerprint (hash) of its contents so that we can spot a repeated file. Where a file is encrypted, we keep only the public key that was registered, not the sender's private key. [[Confirm periods and wording against how it is run.]]

2D. Returned payments, disputes and signed documents

Returns and disputes. When a bank returns a payment or a customer disputes a card payment, we receive details from the gateway or processor, such as the amount, dates, the reason code and the deadline. We keep these and the actions taken, and we can assemble a pack for the business from records we already hold about the payment, such as the invoice, receipts and messages sent, signed documents, and the time and internet address of any agreement the customer made.

Signed documents. When a document is signed through our e-signature feature we keep the document as it was shown, the signer's name, email address, a masked phone number, the name typed, a drawn signature if one was added, the signature and sealed copy of the document, a fingerprint of each, and a record of what happened (sent, opened, code checked, signed or declined, with times, internet address and device details). We keep authorizations for as long as the law and the card or bank rules require, and for as long afterwards as we need to answer a claim. [[Attorney to confirm retention for signed authorizations.]]

2E. Short links

When someone opens a short link on our link domain, we count the click and the day it happened. We do not keep their name, internet address or any other detail with the count, and we do not set cookies on the link domain. Our servers may briefly use an internet address to limit how many links one address can open in a minute, but we do not record it with the click. The person who made a link, and the web address it points to, are kept so we can run and review the links.

2F. Records of what you agreed to

When you accept our Terms or Privacy Policy, confirm a subscription, agree to a text message, approve a payment schedule or sign a document, we keep a record of which version you agreed to, the time and your internet address. We keep these records as evidence of your choice, for as long as we may need it.

2G. Notices about a move to a new payment provider

When a business moves its customers to a new payment gateway, we keep a record of the move for that business: which customers it covered, when each one added a payment method with the new provider and by what route (for example the pay page or an add-a-card link), and which notices we sent them, on which channel (email or text) and when, including those we did not send because there was no address or no consent. We keep which scheduled payments were moved or paused because of the move, and a daily count of how many customers and payments had moved. We keep this information as part of the business's records of its customers while it keeps them, and it is visible to the business and to our staff. It is not used for our own marketing. [[Confirm wording and retention period.]]

2H. Merchant groups and shared gateway accounts

Several related businesses may be organized as a merchant group, and may share one account with a payment gateway. On a shared account the gateway holds the payment records and saved payment methods of all of those businesses' customers. In the Service each business's customers and saved payment methods stay with that business: one business cannot charge a payment method saved with another. We send the gateway an identifier of the business with each payment so that its records and messages can be matched to the right business. People the group allows to sign in for it can see the records of the businesses in the group, or of their part of it. When a business's saved payment methods are moved onto or off a shared account, we keep a record of the move, and where the processor sends one file for several businesses, we keep for each row that could not be matched to one business its row number, the old payment references in it and the reason, with no card or bank account numbers. We keep these records as part of the businesses' records while they keep them. [[Confirm wording and retention period.]]

3. How we use information

• To provide, secure and support the Service, including processing payments, sending invoices, receipts and reminders, and syncing with services you connect.
• To verify your identity, prevent fraud and abuse, and keep records required by law and by card networks.
• To send service messages such as sign-in codes, security notices and billing notices.
• To answer support requests, including with an automated assistant that answers from our help center content.
• When a signed-in merchant user asks the assistant about their own account, to look up the records the question needs and write the answer. Only a short summary of those records is sent to our AI provider, and it is not used to train models. A merchant can turn this off. [[Confirm against the AI provider data terms before publishing.]]
• To improve and troubleshoot the Service and meet our legal duties.

We do not sell personal information and we do not use it for third-party advertising.

3A. Email we send you for marketing

We send marketing email, such as newsletters, product news, tips and offers, only to people who subscribed, who have a business relationship with us, or whom the law lets us contact. Every marketing email says who we are, has our postal address and a link to unsubscribe, and the unsubscribe also works as a one-click option in your email app. Marketing email can be sorted into categories, and the preferences page lets you turn each off. Service messages such as sign-in codes, receipts and security notices are not marketing and are still sent. When you unsubscribe or an address cannot receive email, we keep that fact so that we do not email it again. Our marketing email uses images or links that tell us whether a message was opened or a link was clicked. Opens are not always accurate, because some email apps load images automatically. We use this to see what is useful, and we may switch it off for a message. We do not sell the list. [[Attorney to review marketing and consent wording, including CAN-SPAM and, if people from other countries subscribe, CASL, GDPR and ePrivacy.]]

4. Text messages

If you give us your mobile number and agree to receive texts, we use it only for the purpose you agreed to, such as payment links, receipts, reminders, sign-in codes and account alerts. Message and data rates may apply. Reply STOP at any time to stop, or HELP for help. We do not share mobile phone numbers or text messaging consent with third parties or affiliates for their marketing or promotional purposes. Our text messaging provider receives numbers and message content only to deliver the messages for us.

5. Who we share information with

• The business you are dealing with (a merchant or provider), who can see its own customers' and users' information.
• Payment gateways and processors chosen by the merchant, to process payments.
• Service providers that help us run the Service, such as hosting, email delivery, text message delivery, document generation and an AI provider for the support assistant. They may use the information only to serve us.
• Services you connect, such as accounting or e-commerce systems, to the extent you direct.
• Authorities and advisers when the law requires, to protect rights and safety, or to investigate fraud.
• A successor if we are involved in a merger, sale or financing.

5A. Service providers for these features

For these features we use providers of email delivery (including a separate sending service for marketing email), text message delivery, calendar and meeting links, document generation, hosting and storage, and an AI provider for the support assistant. They receive only what they need to do that for us. If a business sends us customers' information, we do not use it for our own marketing. [[List the providers that should be named.]]

6. Cookies and similar technologies

We use only the cookies the Service needs to work. We do not use advertising, analytics or tracking cookies, and we do not run a cookie banner because there is nothing optional to switch off. You can block cookies in your browser, but the Portal, the payment pages and the Register will not work without them. Below is every cookie we set, what it does and how long it lasts. Where a name ends in a long code, the code is specific to one person, business or register.

Admin Portal (people who sign in)

• .AspNetCore.Cookies: keeps you signed in. It ends when you close your browser, unless you choose Remember me, in which case it lasts up to the number of days our settings allow (14 by default; never for our employees). It also ends after a period of inactivity, after a maximum total time, and when your password or role changes.
• .PayMidWare.TwoFactorPending: holds your place for a few minutes while you enter a sign-in code sent by email or text. It is deleted when you finish or close your browser.
• .PayMidWare.Sso: used only if you choose Sign in with Microsoft. It holds a one-time code that links your return from Microsoft to the sign-in you started, and it is deleted as soon as you come back or after ten minutes.
• pmw_td_ followed by a code: remembers that you chose to trust this browser, so we do not ask for a sign-in code every time. It lasts the number of days set in our security settings after you last use it, and you can revoke it from your Devices page.
• .PayMidWare.SessionEnded: carries a one-line message to the sign-in page after a session ends, such as when you were signed out for inactivity. It lasts five minutes.
• pmw_emulation and pmw_merchant_emulation: used only when one of our staff, or a provider, views the Portal as another account to give support. They end when the browser closes or the viewing stops. You will never receive these in normal use.
• pmw_group_acting: used only when someone who signs in to a merchant group opens one of the group's merchants. It remembers which merchant is open and ends when the browser closes or they go back to the group.
• pmw_group_emulation: used only when one of our staff, or a provider, views the Portal as a merchant group to give support. It ends when the browser closes or the viewing stops. You will never receive this in normal use.
• .AspNetCore.Antiforgery followed by a code: protects forms against forgery. It ends when you close your browser.
• .AspNetCore.Mvc.CookieTempDataProvider: carries a short confirmation or error message from one page to the next, such as "Saved". It ends when you close your browser.

Payment pages (people who pay an invoice or approve a payment schedule)

• .AspNetCore.Antiforgery followed by a code: protects the payment form against forgery. It ends when you close your browser.
• .AspNetCore.Mvc.CookieTempDataProvider: carries a short message between pages when one is needed. It ends when you close your browser.
• .PayMidWare.CustomerPortal: used only if a business you pay offers you an online account and you sign in to it. It keeps you signed in on that account page. It ends when you close your browser, after 30 minutes of inactivity, after 8 hours at most, and when you choose Sign out.
• .PayMidWare.CustomerPortalDevice: used only if you tick "Remember this device" when you sign in to an online account. It lets that browser sign in to that one account page without a new emailed code, for up to 30 days, until you choose Forget my remembered devices or Sign out.

Register (point of sale) site and register pages

• .PayMidWare.Register: keeps a cashier signed in on a paired register. It ends when the browser closes, after a period of inactivity and after a maximum total time.
• .PayMidWare.Register.Af: protects register forms against forgery. It ends when the browser closes.
• __Host-PayMidWare.Device: identifies a tablet or till that a manager has paired with the business, so only paired devices can open the Register. It lasts about 13 months, after which the device is paired again.
• pmw_pos_register_ followed by a code: remembers which register this device is using. It lasts up to 12 months.

Other browser storage. The register screen remembers which product category you last picked, using your browser's local storage on your own device. It is never sent to us and you can clear it in your browser settings.

Cookies set by payment providers. To take a card payment, the payment pages load a script from the business's payment processor (for example Stripe, Braintree, Adyen, Authorize.Net or PayPal, depending on which one the business uses). Those companies may set their own cookies or similar technologies, for example to prevent fraud and keep the card fields secure. We do not control them, and each company's own privacy policy describes them.

If this changes. If we ever add cookies that are not strictly necessary, such as analytics or advertising, we will update this section and ask for your consent first where the law requires it.

7. How long we keep information

We keep information for as long as the account is active and as needed for legal, tax, accounting, dispute and security purposes. Text message content is kept for 90 days and then deleted, while records that a message was sent and opt-outs are kept longer so we can honor them. Sign-in codes are never stored after use. [[Add other retention periods.]]

7A. How long we keep records of these features

Some records are kept for a fixed time: the text of invoice files is deleted when the file has finished and row results are deleted after 30 days; records of requests sent to our servers by gateways are deleted after 30 days; short links that have expired or been disabled are deleted after 90 days, with their click counts. We keep records of agreements, signatures and consent for as long as we may need them as evidence. [[Add periods for sales records, newsletter subscribers who never confirmed, bookings, support records and signed documents.]]

8. Security

We protect information with measures such as encrypted connections, hashed passwords, encryption of the credentials you store for connected services, role-based access, optional and required sign-in codes, and activity logging. No system is perfectly secure, so please protect your own credentials.

8A. Protecting files, keys and links

Links we send to sign, pay, confirm, unsubscribe or manage a booking each contain a long random code that is kept by us only in a form that cannot be turned back into the code. Codes sent to you expire. We limit how many times a code can be tried. Files can be encrypted with PGP in both directions, and we keep only the public keys that senders register. Our own private key is protected in our systems and is used only to open files sent to us. [[Confirm how the key is held.]] Anyone who has a link or a key can use it, so keep them private.

9. Your choices and rights

You can ask to see, correct or delete information we hold about you, subject to legal limits. If your information was provided by a business you deal with, please contact that business first, since it decides how the information is used. You can ask us at the address below. Depending on where you live you may have additional rights, such as to know what we collect, to opt out of sale or targeted advertising (we do neither) and to appeal a decision. [[Attorney to review state privacy law notices.]]

10. Children

The Service is for businesses and the people who pay them. It is not directed at children under 13 [[confirm age]], and we do not knowingly collect their information.

11. Where information is handled

We operate in the United States, and information is handled there. [[Confirm hosting location.]]

12. Changes

We may update this policy. We will post the new version here with its date, and for material changes we will ask signed-in users to review it.

13. Contact

[[Company legal name]], [[mailing address]]. Email [[privacy contact email]].