Privacy Policy

1. Information we collect

Business information. When a business applies for an account or is invited to be paid, we collect its legal name, Employer Identification Number (EIN), address, state of formation, contact email and the information on its Form W-9, including its taxpayer identification number, federal tax classification, the name of the person who certified it and the IP address the certification was made from.

Owners and controllers. To meet our identity-verification obligations, the people who own or control a business that sends payments provide their name, email address and ownership percentage, and complete identity verification with our provider Plaid. Plaid may collect information such as date of birth, address, Social Security number, a government ID document and a photo, and returns the verification result to us.

Users. For each person with portal access: name, work email, role, a hashed password, an encrypted two-factor authentication secret, and a record of security events such as sign-ins, role changes and API key changes, with the IP address involved.

Verification documents. If we ask for documents to verify a business (for example formation or ownership records), the files you upload go from your browser directly to encrypted storage we control; we record the kind of document, a cryptographic fingerprint of the file (SHA-256) and who uploaded it, and our review staff view them. They are kept under the retention periods below.

Bank accounts. When you link a bank account through Plaid, we receive the account and routing numbers, the account holder name (to confirm it belongs to your business), balances, statements you choose to download, and transactions we use to confirm that payments arrived. When a payee adds a bank account through our payment provider's embedded form, the account details go to that provider directly; we receive the bank name, the last four digits of the account number and its verification status.

Funding. Before we debit a linked account to fund your payments, an owner or admin accepts an ACH debit authorization. We store the authorization text and its version, the time, the user who accepted it, and the IP address and browser it was accepted from, and the same for a revocation. For each deposit we keep the source account, amount, status, who started it (or that auto top-up did) and our provider's reference. Your auto top-up settings (floor, target, source account, daily limit) are stored with who set them.

Payments. For each payment: the sender and recipient, the bank accounts involved, the amount and fee, the payment network used and whether a fallback network was used, the memo, invoice numbers and structured remittance details (invoice numbers, dates, amounts, discounts, notes and the end-to-end reference) you send with it, who initiated and approved it, and its status and timestamps. If you ask for a payment to be returned, we keep the reason, your note to our team (stored encrypted), who asked and approved, and the outcome.

Invoices and pay links. If you issue invoices, we store the invoice number, your customer's name and email address, line items, amounts, due date and memo, when it was sent, first opened and paid, and the credits matched to it. If you ask us to provision a receiving account, we store its routing and account number. When someone pays an invoice through a pay link using a Request for Payment, the routing and account number they enter are validated and forwarded to our payment provider; we do not store them.

Accounting data. If you connect an accounting system, we receive the bills, vendors and related records we need to show open bills, pay them and mark them paid, through our integration provider Merge.

API keys and webhooks. For each API key: its label, scopes, expiry, allowed network ranges and when it was last used; the secret itself is stored only as a hash. Creating, rotating and revoking keys are recorded as security events. For webhooks: the endpoint URLs you register and a log of each delivery and its result.

Single sign-on. If your owner connects an identity provider, we store its issuer URL, client ID, client secret (encrypted), the allowed email domain and the default role. At each sign-in we receive the identity token your provider issues and keep the verified email address, whether the provider asserted multi-factor authentication, and the resulting sign-in event; the token itself is not retained.

Notifications. We send email notifications about your account, payments, approvals, low balances, invoices and security. We keep a record of each notification's kind, recipient count, status and timestamps, and each user's preferences for the optional kinds.

Technical information. Our servers record the IP address, browser type and request details of visits for security and troubleshooting. The portal uses a single strictly necessary cookie to keep you signed in. Payee onboarding pages and the application checklist keep their link token in your browser tab's session storage until you close the tab (the applicant token for up to 14 days). We do not use advertising or analytics cookies.

2. How we use information

• To provide the Service: open and manage accounts, send and track payments, deliver remittance information, collect fees and keep your accounting system in sync.
• To verify businesses and the people who own and control them, and to confirm that bank accounts belong to the businesses that use them.
• To comply with law, including anti-money-laundering and sanctions requirements, recordkeeping obligations and tax information reporting, and to respond to lawful requests from regulators and law enforcement.
• To detect and prevent fraud, unauthorized access and misuse, including by screening payments against sanctions lists and assessing fraud risk before they are sent.
• To secure the Service, investigate incidents and keep a tamper-evident record of payments.
• To communicate with you about your account, payments, security and changes to the Service.
• To operate, maintain and improve the Service.

3. How we share information

With the other party to a payment. A recipient sees who paid it, the amount it received, the memo, the invoice numbers and remittance details sent with the payment, and the remittance advice we email it on settlement when we have its email address. It does not see the sender's fee, bank balance or users. A payee invited to be paid sees the legal name of the business that invited it. The people you send an invoice or pay link to see your business name, the invoice, your payment options and, where provisioned, your receiving account's routing and account number, for as long as the link is valid.

With service providers that process information for us under contract, only for the purposes above:

• Our payment and bank-account verification providers and the regulated banks they work with, which process and settle payments, debit your linked account for deposits, hold funding and receiving accounts, collect and verify payee bank accounts and, where offered, present Requests for Payment.
• Your identity provider, if your owner enables single sign-on, which authenticates your users and tells us their verified email address.
• Middesk, which verifies businesses against Secretary of State records and IRS TIN matching.
• Plaid, which links bank accounts and verifies identities.
• Fraud-prevention and sanctions-screening providers.
• Merge, when you connect an accounting system.
• Amazon Web Services, which hosts the Service and its data in the United States, including machine-learning services our compliance staff use to review payments.

For legal reasons: to comply with law, regulation, legal process or government requests; to report suspicious activity as the law requires (which we may be prohibited from disclosing to you); and to protect the rights, property and safety of our customers, the public or Clear Transfer.

In a business transfer, such as a merger or acquisition, subject to this policy.

At your direction, for example to the webhook endpoints and accounting systems you connect.

4. Plaid

We use Plaid Inc. ("Plaid") to link bank accounts and to verify identities. By using those features you authorize Plaid to collect and process your information in accordance with the Plaid End User Privacy Policy.

5. How long we keep information

We keep information for as long as an account is open and afterwards for as long as we need it to meet legal, regulatory, tax, audit and fraud-prevention requirements. Records of payments and customer verification are generally kept for at least five years after a payment or after an account closes, and our payment ledger is kept in write-once storage for seven years so that it cannot be altered. Debit authorizations and their revocations are kept for as long as payment records are. Verification documents are kept under the same retention policy as the verification they support. Test-mode data you create with a test API key can be deleted by you at any time from the portal. When information is no longer needed, we delete or de-identify it.

6. How we protect information

The Service runs on AWS in the United States. Data is encrypted in transit and at rest, passwords are stored as Argon2 hashes, two-factor secrets and taxpayer identification numbers are encrypted, every user signs in with two-factor authentication, and access is limited by role. No system is perfectly secure; if we learn of a security incident affecting your information we will notify you as the law requires. See our Security page for more.

7. Your choices and rights

Account owners and admins can view and update business and user information in the portal. Any individual whose information we hold can ask us to access, correct or delete it by contacting us as described below. We will verify the request and respond within the time the law requires. We may keep information we are legally required to retain, such as payment and verification records.

Depending on where you live, you may have additional rights under state privacy laws. We will not discriminate against anyone for exercising them. Information we handle under the federal Gramm-Leach-Bliley Act may be exempt from some state laws.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

9. Changes to this policy

We may update this policy. We will post the new version here with a new "last updated" date and, for material changes, notify account owners by email before the change takes effect.

10. Contact us

Questions or requests about this policy or your information: