At PatronPay, LLC ("we," "us," or "our"), we are deeply committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your data. We use PCI-compliant semi-integrated payment software and hardware, meaning we do not directly store, process, or transmit cardholder data, and we are out of scope for PCI DSS compliance. Additionally, we do not share your data with any third parties under any circumstances, with no exceptions.
1. Information We Collect
We may collect the following types of information when you interact with our services, website, or applications:
1.1 Personal Information
- Contact Information: Name, email address, phone number, and mailing address (if provided for billing, shipping, or customer support purposes).
- Account Information: Username, password, and other credentials if you create an account with us.
- Payment-Related Information: We do not collect or store payment card details (e.g., credit/debit card numbers, expiration dates, or CVV codes). This information is handled entirely by our PCI-compliant third-party payment processor during transactions.
1.2 Non-Personal Information
- Technical Data: IP address, browser type, device type, operating system, and timestamps of your interactions with our website.
- Usage Data: Pages visited, time spent on our site, and other analytics data that does not identify you personally.
1.3 Location Data Collection
Location Data: We access and collect your device's precise location information (GPS and network-based). This data is accessed while the app is in use and, if permitted, in the background.
Purpose of Collection
How we use Location Data: We use location information solely for the purpose of processing secure payments. Specifically:
- Payment Security & Compliance: Our payment processing partner, Stripe, requires location data to verify the physical location of the transaction to comply with financial regulations and prevent fraudulent activity.
- Hardware Connection: Location services are required to discover and connect to nearby contactless card readers (Tap to Pay).
Disclosure & Sharing
Data Disclosure: Your location data is shared with our payment processor (Stripe) solely to facilitate transaction security and is not used for marketing or sold to third parties.
2. How We Collect Information
We collect information in the following ways:
- Directly from You: When you provide information during account creation, form submissions, or customer support inquiries.
- Automatically: Through cookies, web beacons, and server logs as you interact with our website or services.
- During Transactions: When you make a payment, cardholder data is collected directly by our PCI-compliant third-party payment processor, not by us.
3. How We Use Your Information
We use your information solely for the following purposes:
- To Facilitate Transactions: We pass your contact and order details to our third-party payment processor to complete purchases and issue refunds if necessary. We do not directly handle cardholder data.
- To Provide Services: To manage your account, fulfill orders, and respond to customer support requests.
- To Improve Our Services: Non-personal data (e.g., usage analytics) helps us understand how our website is used and improve user experience.
- To Communicate with You: To send transactional emails, such as order confirmations, account updates, or responses to your inquiries.
- To Ensure Security: To monitor for fraudulent activity and protect the integrity of our systems.
4. Data Sharing and Disclosure
We do not share, sell, rent, or disclose your personal information to any third parties, under any circumstances, with no exceptions. This includes all data we collect directly, such as contact and account information.
4.1 Third-Party Payment Processor
- We use a PCI-compliant semi-integrated payment software and hardware solution to process payments. When you make a purchase, your cardholder data (e.g., credit/debit card details) is collected and processed directly by our third-party payment processor, not by us.
- Our payment processor adheres to the Payment Card Industry Data Security Standard (PCI DSS), ensuring that your payment information is handled securely.
- We do not have access to your full cardholder data at any point, as we are out of scope for PCI DSS compliance. Any payment-related information we receive (e.g., transaction confirmation) is limited to what is necessary to fulfill your order.
4.2 Legal Obligations
We may access or disclose your information only if required by law (e.g., in response to a court order or subpoena) and only to the extent necessary to comply with such legal obligations. Even in such cases, we will take all reasonable steps to protect your privacy and notify you if permitted by law.
5. Data Security
We implement industry-standard security measures to protect the information we collect and control, including:
- Encryption: All sensitive data we collect (e.g., contact information) is encrypted during transmission using secure protocols (e.g., TLS 1.3).
- Access Controls: Only authorized personnel have access to your data, and access is limited to what is necessary for their role.
- Regular Audits: We conduct regular security reviews to ensure our systems remain secure.
- Payment Security: Since we do not store, process, or transmit cardholder data, your payment information is protected by our PCI-compliant third-party payment processor, which adheres to strict PCI DSS standards.
Despite these measures, no system is completely immune to breaches. In the unlikely event of a data breach involving the information we control, we will notify you promptly as required by applicable law and take immediate steps to mitigate any harm.
6. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:
- Payment-Related Information: We do not store cardholder data. Any transaction-related data we receive (e.g., order confirmation details) is retained for no longer than 30 days after the transaction is completed, unless required for refund processing.
- Account Information: If you have an account with us, we retain your data for as long as your account is active. If you close your account, we will delete your data within 60 days.
- Non-Personal Data: Usage data may be retained indefinitely in an anonymized form for analytics purposes.
7. Your Rights and Choices
You have the following rights regarding your personal information:
- Access: You can request access to the personal information we hold about you.
- Correction: You can request that we correct any inaccurate or incomplete data.
- Deletion: You can request that we delete your personal information, subject to legal retention requirements.
- Account Management: You can update or delete your account at any time through your account settings.
To exercise these rights, please contact us at the details provided in Section 10.
8. Cookies and Tracking
We use cookies and similar technologies to enhance your experience on our website:
- Essential Cookies: Necessary for the website to function (e.g., session management).
- Analytics Cookies: Collect non-personal data to understand how users interact with our site (e.g., Google Analytics, with IP anonymization enabled).
You can manage cookie preferences through your browser settings. However, disabling essential cookies may affect the functionality of our website.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on our website with a revised "Last Updated" date. If we make significant changes, we will notify you via email (if you have an account) or through a prominent notice on our website.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:
We will respond to your inquiries within 30 days.
