Privacy policy

PAID processes payments, which means it processes personal and financial information. This page is the canonical statement of what we collect, why, how long we keep it, who we share it with, and the rights you have. It follows our public data governance summary, which says what our code keeps and deletes today, and our security model. If this page and the summary ever disagree, the summary describes what the code does, and this page is wrong.

Last updated: 2026-11-01  ·  Effective: 2026-11-01

1. Who we are

"PAID" refers to the operator of the PAI'D Payments Intelligence platform — a payment-orchestration and technology platform. PAID coordinates payment acceptance and settlement between buyers, sellers, and the licensed sub-processors that perform the regulated activity; the movement, holding, and settlement of funds is performed by those licensed providers, not by PAID. PAID is NOT a bank, a credit underwriter, a card network, a fraud-decisioning service, a money transmitter, or a custodian of consumer funds, and does not hold money-transmission or banking licenses.

2. What we collect

We collect the minimum information required to process payments, satisfy regulatory obligations, and protect the platform.

2.1 From buyers (people who pay through a PAID-hosted checkout)

• Payment method credentials — Card data is tokenized in your browser by Stripe Elements before reaching any PAID server. PAID never stores card numbers (PAN) at rest. Bank-link credentials are encrypted with AES-256-GCM.
• Transaction metadata — Amount, currency, merchant name, descriptor, timestamp, idempotency key.
• Optional identification — When the merchant configures it, we may collect email, billing address, or shipping address.
• Device + session telemetry — IP address, User-Agent string, session timestamps. A signed-in session is checked against the User-Agent string it was created with.

2.2 From sellers (merchants using PAID)

• KYB / KYC identifiers — Legal entity name, jurisdiction, business type, projected volumes, beneficial-owner names and roles (self-declared in PAID), and government business identifiers (EIN / company number) submitted to Stripe Connect for verification.
• Sanctions screening — Lookups against the OFAC SDN and consolidated lists and any additional government sanctions feeds we configure (UN, EU, HMT), run by PAID's own screening engine. We do not currently screen against PEP databases and no third-party screening vendor receives your data for this purpose.
• Merchant payout-bank details — When a merchant links a payout bank account through Plaid Link, we keep the Plaid access token, encrypted with AES-256-GCM, and the last four digits of the account. Used only on the merchant side — not for buyer-side data.
• API keys — Stored as SHA-256 hashes; plaintext is never persisted.

2.3 From third-party providers

• Merchant payout bank verification — Plaid confirms the merchant's payout bank account and its holder (Auth, Balance, Identity). We keep the encrypted access token and the last four digits of the account. Payouts are made by Stripe, from the merchant's own Stripe account, to the merchant's bank. Plaid is NOT used for buyer-side data, transaction history, or any consumer financial profile.
• Card payments — Stripe returns the outcome of each card payment, which we record. Card payments through Stripe are the only payment method PAID offers today.
• Merchant identity verification — Stripe Connect returns verification outcomes, requirement status, and document-verification results for connected accounts. Government ID images are uploaded from PAID's onboarding UI directly to Stripe's Files API and held by Stripe — not stored by PAID.

3. Why we collect it (lawful bases under GDPR Article 6)

• Contract performance — We need transaction data and identifiers to execute the payment you initiated. This is the primary lawful basis for buyer + seller data.
• Legal obligation — KYC, KYB, sanctions screening, tax reporting (IRS 1099-K, regulatory equivalents), AML record-keeping. We are required to collect and retain this data.
• Legitimate interests — Fraud prevention, abuse detection, infrastructure security, audit trail integrity. We balance these against your rights and use the minimum data necessary.
• Consent — Plaid Link's bank-account connection flow asks you to consent at the linking step. Stripe Elements card entry collects payment data under Stripe's privacy policy; merchant identity data is submitted from PAID's own onboarding UI to Stripe's verification APIs under the agency appointment the merchant signs. We rely on these third-party consent flows rather than collecting consent ourselves at the PAID-surface level.

4. How long we keep it (retention)

These retention rules are enforced by our code today:

• Signed-in sessions — 8 hours at most, and they end after 30 minutes without activity.
• Passkey sign-in challenge data — Short-lived, and cleared by a weekly clean-up.
• Expired keys and other expired short-lived records — Cleared by a weekly clean-up.
• A merchant account with an erasure request — Personal fields cleared after a 7-day grace period (see section 6).
• Audit log and financial event log — Never deleted. Append-only; the database refuses deletion.

Everything else (merchant records, payment records, beneficial-owner details and screening results) has no automatic deletion schedule yet: it is kept while the account is open and after it closes. Setting deletion periods for these records, and enforcing them in code, is open work. The detail is in our data governance summary.

5. Who we share data with

We share data only when one of these applies:

• Card payments — Stripe. Required to execute the card payment you initiated; card payments through Stripe are the only payment method PAID offers today.
• Merchant payout-bank verification provider — Plaid. Required when a merchant links their payout bank account; not used on the buyer side.
• Merchant identity verification — Stripe (Connect onboarding). Required for merchant KYB / representative KYC on card rails. PAID passes business profile and beneficial-owner details; Stripe collects and verifies identity documents under its licenses.
• Sanctions screening — performed by PAID's own engine against public government sanctions lists (OFAC and configured feeds); no personal data leaves PAID for this purpose.
• Fraud-risk signals — Sardine, only where configured; receives transaction and device risk attributes to score fraud. Not used for sanctions or PEP screening.
• Hosting + infrastructure — Fly.io (US-region application servers + PostgreSQL) and Cloudflare (static frontend delivery); secrets at rest are AES-256-GCM-encrypted at the application layer in addition to the cloud providers' disk encryption.
• Legal compliance — Law enforcement, tax authorities, courts when compelled by valid legal process. We will challenge overbroad requests and will notify you where the law permits.
• Business successors — Acquirers in the event of a merger, acquisition, or asset sale (with your data subject to the same protections).

We do NOT sell your data, and we do NOT share it for advertising, marketing-target enrichment, or any non-payment commercial purpose.

6. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, LGPD, PIPEDA), you have some or all of these rights:

• Right of access — Get a copy of the personal data we hold about you.
• Right of rectification — Correct inaccurate data.
• Right of erasure — Delete data we no longer need to keep. A signed-in merchant can ask for their account to be erased; what that clears today, and what it does not reach yet, is in our data governance summary. Payment records and the audit log stay after an erasure: the log cannot be changed, and payment records may be needed for disputes and tax.
• Right of portability — Receive your data in a structured, machine-readable format. A signed-in merchant can download an export of their account; today it contains basic account fields only.
• Right to object — Object to processing based on legitimate interests.
• Right to withdraw consent — Where consent is the lawful basis (e.g., the Plaid Link flow), you can disconnect your bank link at any time from your merchant dashboard or by contacting us.
• Right not to be subject to automated decision-making — PAID does not make automated fraud-decisioning calls (we surface signals to merchants and human reviewers; the decision sits with the merchant).
• Right to lodge a complaint — With your local data-protection authority.

To exercise any of these rights, email privacy@trustfabric.ai. We respond within 30 days (or the local statutory window if shorter). We may need to verify your identity before acting on a request.

7. International data transfers

Our infrastructure is currently hosted in the United States (Fly.io US regions for application servers and PostgreSQL; Cloudflare for static delivery). If you access PAID from outside the United States, you understand and consent to your data being transferred to and processed in the United States. Where required (e.g., for EU traffic under GDPR), we rely on Standard Contractual Clauses with our sub-processors. EU expansion with EU-region hosting is on our roadmap.

8. Security

Our security model is documented in detail at /docs/security. Headlines:

• HTTPS only, with a one-year Strict-Transport-Security header; in production, database connections must use TLS.
• AES-256-GCM at the application layer for Plaid credentials and provider-registry secrets.
• Database disk encryption at the cloud-provider layer (Fly.io volumes, AES-256 at rest).
• A second factor for every merchant account, and for any change made through the operator tools; operator single sign-on, where used, must confirm a phishing-resistant second factor.
• Tenant isolation enforced at the middleware layer.
• Hash-chained financial-event ledger with end-to-end verification endpoint.
• Per-IP and per-merchant rate limiting at the gateway.
• A release gate that builds and tests every change before it is pushed; dependency vulnerability scanners (govulncheck, Trivy, npm audit) run in an extended gate that is not yet required on every release.

What is in place and what is not is in our public information security and access control summaries.

9. Children

PAID is a business-to-business platform. We do not knowingly collect data from anyone under 16 (or under 13 in jurisdictions where that floor applies). If you believe we have inadvertently collected data from a minor, email privacy@trustfabric.ai and we will delete it.

10. Cookies and similar technologies

We use a small number of strictly necessary cookies (session cookie, CSRF token, Stripe Elements iframe state). We do NOT use third-party analytics, tracking pixels, advertising cookies, or behavioral-profiling cookies on the buyer-facing checkout surface. Some merchant dashboard surfaces may include first-party analytics for product-improvement purposes; these are described in the relevant dashboard page.

11. Changes to this policy

When we materially change this policy, we will update the "Last updated" date at the top and — where the change affects how we use personal data already collected — notify affected users via email or in-app notice.

12. Contact

This policy is grounded in code, not marketing copy. The retention rules and security measures cited here describe what our code does today, and our public data governance and information security summaries say the same in more detail. If a third-party auditor finds a discrepancy between this page and the actual system behavior, that discrepancy is a bug we want to know about — email privacy@trustfabric.ai.