Privacy Policy

1. Who We Are

PAYSERV LLC ("PayServ", "we", "us", or "our") is an Independent Software Vendor (ISV) and neutral payment orchestration middleware provider registered and operating as a software aggregator.

We do not hold merchant funds, act as a money transmitter, process raw cardholder data, or underwrite merchant risk. Our services are limited to software integration, routing configuration, test automation, and data normalisation.

2. Information We Collect

Account Registration Data: When you create a PayServ account, we collect your name, email address, company name, job title, and billing information.

Technical Usage Data: We collect API request metadata (endpoint, timestamp, response status, latency) for platform monitoring, debugging, and abuse prevention. We do not log raw cardholder data (PAN, CVV, expiry) at any point.

Payment Credentials (Encrypted): Merchant PSP API credentials submitted to PayServ are encrypted at rest using AES-256-GCM and transmitted to downstream PSPs over TLS 1.3 only. These credentials are never logged in plaintext.

Identity Verification & KYB Data: For sub-merchants undergoing Know Your Business (KYB) or Know Your Customer (KYC) verification through our payment processing partner, Moov Financial, Inc., we may facilitate collection of the following data categories: business legal name and EIN (Employer Identification Number), representative name, date of birth, and the last four digits of Social Security Number (SSN), beneficial ownership information, bank account routing and account numbers (used to establish a settlement destination). This sensitive information is collected exclusively through Moov.js secure hosted components — secure iFrame-isolated fields served directly from Moov Financial's infrastructure. This data is transmitted over TLS 1.3 directly to Moov Financial, Inc. and is NEVER stored in raw form on PayServ's servers. PayServ retains only tokenized references and processing status indicators returned by Moov Financial.

Communication Data: If you contact us via email, support tickets, or live chat, we retain those communications to assist in resolving your queries.

Cookies & Analytics: We use first-party cookies for session management and analytics tools to understand platform usage patterns. We do not sell behavioural data to third parties.

3. How We Use Your Information

To provide, maintain, and improve the PayServ platform and its associated services.

To authenticate users and manage access controls across your organisation's PayServ account.

To route payment transactions through your configured PSP connectors using your credentials.

To send service notifications, security alerts, and product update communications.

To meet our legal obligations, including fraud prevention, anti-money-laundering (AML) checks, and regulatory compliance requirements.

4. Data Sharing & Third Parties

PSP Credential Passthrough: Your PSP API credentials are transmitted to your authorised downstream Payment Service Providers solely for the purpose of executing your payment transactions. We do not share credentials with any other party.

Infrastructure Providers: We use cloud infrastructure providers (such as AWS) to host and operate the PayServ platform. These providers are bound by data processing agreements and do not have access to unencrypted merchant data.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

5. Data Retention & Deletion Requests

Account data is retained for the duration of your active PayServ subscription plus 7 years to comply with financial record-keeping regulations.

API request logs are retained for 90 days for debugging and audit purposes, after which they are deleted or anonymised.

KYB/KYC verification data facilitated through Moov Financial, Inc. is subject to Moov's data retention policies. PayServ retains only tokenized status references for your records. Contact privacy@payserv.com for assistance with data deletion requests related to your Moov-facilitated onboarding.

Data Deletion / Privacy Request: To request deletion of your personal data held by PayServ, or to exercise any data subject right (access, correction, portability, objection), submit a written request to privacy@payserv.com with the subject line "Privacy Request — [Your Name / Company]". Requests will be actioned within 30 calendar days, subject to legal and financial record-keeping retention obligations. California residents may also exercise rights under the CCPA by contacting the same address.

6. Your Rights

Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict processing; and request data portability.

To exercise any of these rights, contact privacy@payserv.com. We will respond within 30 days.

7. Security

PayServ implements industry-standard security controls including: TLS 1.3 for all data in transit; AES-256-GCM encryption for credentials at rest; role-based access controls; and regular penetration testing.

Despite these measures, no system is completely immune to risk. We recommend using strong API key management practices and rotating credentials regularly.

8. Contact

For privacy-related enquiries, contact our Data Protection team at privacy@payserv.com or write to: PAYSERV LLC, Attn: Privacy Team.