Privacy Policy

PayKard ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, use our dashboard, or integrate with our payment orchestration APIs (the "Services").

By using the Services, you acknowledge the practices described in this policy.

Depending on how you interact with us, we may collect:

• Account data: name, business email, company details, and role.
• Transaction data: payment metadata, routing outcomes, settlement and reconciliation records.
• Technical data: IP address, device type, browser, API logs, and usage analytics.
• Communications: support requests, feedback, and marketing preferences.

We use information to:

• Provide, secure, and improve the Services.
• Process and route transactions on your behalf.
• Detect fraud, abuse, and security incidents.
• Comply with legal, regulatory, and card scheme obligations.
• Communicate service updates and respond to enquiries.

We do not sell personal information. We share data only with connected payment gateways and acquirers you configure, trusted infrastructure and service providers bound by confidentiality agreements, and authorities where required by law.

Card data is encrypted and stored in our PCI-DSS Level 1 compliant Token Vault using HSM-backed keys. You retain ownership of your tokenized credentials and may export them at any time under our Zero Lock-In commitment.

We maintain PCI-DSS v4.0 Level 1, ISO 27001, and SOC 2 Type II controls, including encryption in transit and at rest, role-based access, continuous monitoring, and regular penetration testing. No system is completely secure, but we work continuously to protect your information.

We use essential cookies to operate the Services and, with your consent, analytics cookies to understand usage. You can manage preferences through your browser or our cookie banner at any time.

We retain personal information only as long as necessary to provide the Services, meet legal and financial record-keeping obligations, resolve disputes, and enforce agreements. When data is no longer required, it is securely deleted or anonymized.

Depending on your location (including under GDPR, UK GDPR, and CCPA), you may have the right to access, correct, delete, restrict, or port your data, and to object to certain processing. To exercise these rights, contact our Data Protection Officer using the details below.

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses. We may update this policy from time to time and will notify you of material changes before they take effect.