Privacy Policy

1. Introduction

ZenythPay, Inc. ("ZenythPay," "we," "us," or "our") provides payment processing services, merchant onboarding, a merchant dashboard and mobile application, and related financial technology services to small and mid-market businesses.

This Privacy Policy, in addition to our Terms of Use and our Cookies Policy, explains what data we collect, how we use and share it, how we protect it, and the choices and rights available to individuals whose information we process, subject to exemptions and limitations under the CCPA, GLBA, FCRA, California Financial Information Privacy Act, and other applicable laws. This Privacy Policy applies to the data, including personal data and technical data, we obtain from you when you use the Site and when you use the products, services, tools, and functionality offered or made available by us, whether online (including www.zenythpay.com, the “Site”), in person, or when you otherwise interact with us (herein collectively referred to as the “Services”). The “Site” shall mean all websites, devices, and applications that we operate, the pages within each such websites, devices and applications, and equivalent, mirror, replacement, substitute or backup such websites, devices and applications, and pages that are associated with each such websites, devices, and applications. By signing up for, accessing, or using our Services or by accessing our Site, you acknowledge this Privacy Policy and, where consent is required by applicable law, consent to our collection, use, and disclosure of your Personal Data as described in this Privacy Policy. Some data that we collect in connections with merchant applications, underwriting, settlement, account servicing, and payment processing may be subject to financial privacy laws, including GLBA or another financial privacy law applies, those laws may limit or modify certain privacy rights described in this Privacy Policy. This Privacy Policy only covers our data collection, maintenance, and processing and does not create contractual rights or obligations beyond those required by applicable law.

This Privacy Policy does not govern the independent privacy practices of our payment processor, sponsor bank, card networks, or other third parties that determine their own purposes for processing information. It also does not govern the privacy practices of a merchant's own customers, except where ZenythPay processes limited transaction-related information as described in this Policy.

2. Who We Are and How to Contact Us

ZenythPay, Inc.
9405 Brighton Way, Suite 26
Beverly Hills, CA 90210

Privacy contact:
Support: | +1 (833) 993-6984
New accounts: +1 (424) 550-0101privacy@zenythpay.comsupport@zenythpay.com

3. Data We Collect

We collect data based on how a person interacts with ZenythPay and what is required to provide payment services, support merchant onboarding, comply with card network and legal requirements, and secure our systems. We collect data from you from several sources, including but not limited to:

• Browsing Our Site: When you visit the Site, our servers will collect information about your internet browsing activity on our Site.

• Opening an Account: When evaluating the Services and submitting an application for the Services, you will be required to provide us with information about your business and its owners and officers. In addition, we may use session replay and similar technology to collect and record data about your use of, and interaction with, the Services, including recording certain interactions such as your mouse movements, clicks, scrolls, keystrokes entered into non-sensitive fields, and other activity, but we use reasonable measures designed to avoid intentionally capturing full payment card numbers, passwords, or other sensitive authentication credentials through these tools. We use these technologies to better understand your interactions with the Services, in order to review and improve the customer experience, improve our marketing, and for troubleshooting purposes. All card data is tokenized and not stored. All KYC data is identifiable but encrypted, and such data is only used for verification, underwriting, and compliance. Further, website analytics are aggregated and de-identified.

• Your Inquiries: When you complete and submit a form or otherwise provide us or third parties acting on our behalf with personal information about you on our Site or contact us by e-mail and telephone, we store the inquiries and their contents for the purposes described in this Privacy Policy and as permitted by applicable law.

• Customers of our Partner Platforms: If you access the Services through a software platform, marketplace, payment facilitator, or other business that has an integration with us (“Partner Platform”), we may receive information about you from the Partner Platform, such as information about your business, its owners and officers, and transactions.

• Customers of our Merchants: If you are making a payment to a merchant that uses our Services to process your payment, we may, directly or through the merchant or Partner Platform providing services to the merchant, collect, process, store, transmit, and disclose financial and transaction-related personal information about you and your transaction as necessary to authorize, clear, settle, dispute, refund, monitor, and otherwise support the payment transaction and comply with card-network, bank, processor, and legal requirements.

• Service Providers: We may receive information about you from our service providers, such as companies that manage risk and fraud or market the Services, card networks, payment processors, referral partners, identity verification companies, and from third parties that you have permitted to release information to us. We also may receive information about you from publicly available sources, such as from social media platforms like LinkedIn.

The Privacy Policy does not address, and we are not responsible for, the privacy practices of any third parties. To the fullest extent permitted by applicable law, we disclaim responsibility for the collection, maintenance, and processing carried out by third parties, including where the Services include hyperlinks to third parties’ websites.

3.1 Merchant application and onboarding information

To evaluate, open, and service a merchant account, we may collect:

• Business information: legal business name, DBA, business address, business phone number, website or social profile, entity type, formation date, industry/category, ownership structure, expected processing activity, processing history, and merchant agreement information.

• Owner, principal, and control-person information: name, home address, email address, phone number, date of birth, title/role, ownership percentage, and Social Security Number or other government identifier where required for identity verification, underwriting, beneficial ownership review, or legal compliance.

• Tax and government identifiers: Employer Identification Number, IRS documentation such as Form SS-4, driver's license, passport, state ID, or equivalent government-issued identification.

• Bank and settlement information: bank name, routing number, account number, account type, deposit/settlement account information, and a voided check or equivalent verification document.

• Identity and business verification documents: uploaded government ID images, IRS documentation, business formation documents, voided checks, and similar documents required for underwriting or account servicing.

ZenythPay uses micro-deposit verification for settlement bank verification. We do not collect online banking usernames or passwords, and we do not use Plaid or similar credential-based bank-linking aggregators for this verification flow.

3.2 Account, transaction, and service information

When merchants and authorized users use the Services, we may collect:

• Account and profile data: name, email address, role, authentication settings, multi-factor authentication status, and account permissions.

• Transaction and settlement data: transaction amounts, transaction dates, authorization and processor response codes, batch and settlement records, fees, refunds, chargebacks, dispute records, and related reporting information.

• Payment method display metadata: for display, reconciliation, and recurring billing, ZenythPay may store card brand/type, the first six and last four digits of a card number, expiration month and year, NMI customer vault identifiers, NMI billing identifiers, and related tokenized gateway references. ZenythPay does not store full card numbers or CVV/CVC values.

• Support and communications data: emails, support tickets, chat messages, call notes, and related account-servicing correspondence.

3.3 Site information

When a person visits our Site, we and our service providers may collect:

• IP address, browser type, device type, operating system, app version, pages or features used, timestamps, referring and exit pages, and similar usage data;

• Cookie, pixel, SDK, and advertising identifier data as described in Section 12.

ZenythPay does not knowingly or intentionally collect precise GPS-level geolocation, biometric identifiers, health information, or information about children under the age of 18.

3.4 Information from third parties

We may receive information from payment processors, sponsor banks, card networks, identity-verification and fraud-prevention providers, underwriting data sources, public business records, service providers, and, where permitted and used, consumer reporting agencies or similar data providers. We use that information to support underwriting, sanctions screening, fraud prevention, compliance, account servicing, and transaction processing.

3.5 Sensitive personal information

Some information we collect may be considered sensitive personal information under applicable privacy law, including Social Security Number, driver's license or other government identification number, financial account information, and account login credentials. ZenythPay uses and discloses sensitive personal information only for permitted and expected business purposes, such as identity verification, account opening, underwriting, fraud prevention, security, transaction processing, settlement, legal compliance, account servicing, and other purposes permitted by applicable law, and does not use sensitive personal information for purposes that would require a right to limit unless ZenythPay provides that right. We do not use sensitive personal information to infer characteristics unrelated to the services we provide.

4. How We Use Information

There are several purposes for our collection, maintenance, and processing of personal information. We collect, maintain and process Personal Data to perform our contractual obligations to you, provide and improve the Services, manage risk, prevent fraud, comply with card-network, bank, processor, and legal obligations, and exercise or defend our legal rights. Furthermore, we collect, maintain, and process Personal Data to run, maintain, and develop our business. We also use or process Personal Data and Technical Data for some or all of the following purposes:

• Evaluate, approve, open, and maintain merchant accounts;

• Verify identity, beneficial ownership, authority to act for a business, and settlement account information;

• Meet Know Your Customer, anti-money-laundering, OFAC/sanctions, card network, sponsor-bank, and processor requirements;

• Provision merchants with our gateway, processor, sponsor bank, and related payment-service providers;

• Process, authorize, settle, reconcile, and report transactions;

• Fund merchant settlement to approved bank accounts;

• Provide dashboards, mobile applications, APIs, reporting, receipts, invoices, payment links, and support;

• Configure and support cash discount or dual pricing programs where offered;

• Detect, investigate, and prevent fraud, unauthorized access, abuse, chargeback risk, data compromise, and other security incidents;

• Operate, secure, maintain, debug, test, and improve our services;

• Communicate about accounts, service updates, legal notices, security alerts, support matters, and marketing where permitted;

• Obtain consent for communications where required, including SMS or text messaging consent for marketing messages and any legally required consent for transactional or security messages;

• Comply with law, card network rules, sponsor-bank requirements, processor requirements, contracts, subpoenas, lawful requests, and legal obligations;

• Establish, exercise, or defend legal claims.

Automated decision-making. ZenythPay does not use its AI-powered merchant statement audit tool, or any automated profiling system, to make final underwriting, risk-scoring, fraud-scoring, or adverse-action decisions. The statement audit tool is intended for statement parsing, fee/rate analysis, and merchant education. Underwriting and account decisions involve human review and payment-industry compliance review.

Consumer reports and adverse action. If ZenythPay obtains consumer reports, credit reports, background reports, or similar reports about an owner, principal, control person, or applicant for underwriting or account-review purposes, ZenythPay will use those reports only for legally permitted purposes and will provide notices, authorizations, and adverse-action disclosures where required by the Fair Credit Reporting Act or similar law. ZenythPay will maintain procedures to determine when this process applies before obtaining or using any consumer report or similar regulated report.

5. Anti-Discrimination

ZenythPay applies explicit anti-discrimination principles in merchant onboarding and account servicing. ZenythPay does not make account decisions based on protected characteristics. Merchant onboarding, underwriting, and risk review are based on payment-industry, sponsor-bank, card network, legal, and operational criteria.

6. Cardholder Data and PCI DSS

ZenythPay is designed to keep full payment card data out of ZenythPay's backend systems.

6.1 Card-not-present transactions

For online, in-app, invoicing, payment-link, virtual terminal, and similar card-not-present flows, card data is captured and tokenized by Network Merchants, LLC ("NMI") through NMI Collect.js, NMI mobile SDKs, or equivalent NMI-hosted tokenization technology. NMI returns tokenized references used to process payments and support saved payment methods. ZenythPay stores NMI-issued customer vault identifiers, NMI billing identifiers, tokenized gateway references, and limited card display metadata. ZenythPay does not store full PAN or CVV/CVC.

6.2 Card-present transactions

For card-present transactions, payments are processed through approved payment terminals or device flows. Card data is encrypted and transmitted through payment-industry providers and processors. ZenythPay does not store raw cardholder data from these devices.

6.3 PCI scope

ZenythPay minimizes PCI DSS scope by using PCI-validated providers and tokenization. NMI is a PCI DSS Level 1 Service Provider. Terminal hardware used by merchants is expected to be PCI PTS approved or otherwise approved by the relevant payment provider and processor. ZenythPay maintains policies and technical controls intended to prevent full PAN and CVV/CVC from entering ZenythPay-controlled systems.

7. Financial Privacy and GLBA

ZenythPay provides payment and financial technology services to U.S. based merchants.

In connection with merchant applications, underwriting, identity verification, beneficial ownership review, settlement, account servicing, transaction processing, fraud prevention, and legal compliance, we may collect nonpublic data about business owners, principals, control persons, guarantors, authorized representatives, and other individuals associated with a merchant.

To the extent the Gramm-Leach-Bliley Act (“GLBA”) or its implementing regulations apply to ZenythPay or to particular information we process, ZenythPay will handle that information in accordance with GLBA, including by providing any required privacy notice, limiting disclosures of nonpublic personal information as required by law, and maintaining an information security program consistent with applicable GLBA Safeguards Rule requirements.

We may disclose GLBA-covered information to nonaffiliated third parties as permitted by law, including to process transactions, maintain or service accounts, verify identity, underwrite or review merchant accounts, prevent fraud or unauthorized transactions, comply with sponsor-bank, processor, card-network, and legal requirements, respond to regulators and law enforcement, and work with service providers that support our business.

If ZenythPay shares GLBA-covered information in a manner that requires an opt-out right, ZenythPay will provide the required notice and opt-out mechanism. Certain GLBA-covered information may be exempt from rights or requirements under state privacy laws, including portions of the CCPA/CPRA, but ZenythPay will continue to protect that information under applicable financial privacy, payment-industry, contractual, and security obligations.

8. How We Share Information

ZenythPay does not sell data. We share data only as necessary to provide the Services, meet legal and payment-industry obligations, operate our business, and protect our systems and users.

8.1 Payment ecosystem participants

We share application, merchant, transaction, settlement, chargeback, and compliance information with payment ecosystem participants, including payments processors, sponsor banks, card networks, issuing banks, acquiring banks, and related payment-service providers. These third parties use information for processing, settlement, funding, fraud prevention, risk review, sanctions screening, compliance, chargeback handling, and related regulated payment functions. Where information is subject to GLBA, these disclosures are made as permitted by GLBA and other applicable financial privacy laws, including for transaction processing, account servicing, fraud prevention, risk review, compliance, and legal purposes.

8.2 Service providers and subprocessors

We use service providers and subprocessors to host, secure, operate, support, analyze, and improve our services. These providers may include:

Where required, ZenythPay enters into Data Processing Agreements or equivalent contractual protections with service providers, contractors, and third parties that process personal information on our behalf, including restrictions on selling or sharing personal information, retaining, using, or disclosing it outside the permitted business purpose, and combining it except as permitted by applicable law. Some vendors may act as independent controllers or regulated payment participants for certain processing activities.

8.3 Legal, safety, and business transactions

We may disclose information to comply with law, respond to lawful requests, enforce agreements, comply with card brand regulations, protect ZenythPay, merchants, customers, and others, investigate fraud or security incidents, and support mergers, acquisitions, financing, corporate transactions, or asset sales, subject to appropriate confidentiality and legal protections. Where required by applicable law and not prohibited by the requesting authority or applicable legal process, we will notify you about such transfer and processing.

8.4 Advertising and analytics

We may use analytics and advertising technologies, including Google Analytics, Google Ads, Meta, cookies, pixels, and similar technologies. Depending on applicable law, use of those technologies may be considered "sharing" personal information for cross-context behavioral advertising or a "sale" of personal information. Where required, ZenythPay will provide a "Do Not Sell or Share My Personal Information" link, cookie preferences tool, or equivalent opt-out mechanism, and will honor legally required opt-out preference signals such as Global Privacy Control. ZenythPay will confirm which advertising and analytics technologies are live before publication and will disable or gate non-essential advertising and analytics technologies until required notices, contracts, opt-out mechanisms, and preference-signal handling are in place.

8.5 Consent

We may share data with third parties when we have your explicit consent to do so. You have the right to withdraw this consent at all times.

8.6 Any Other Legitimate Reason

If we are involved in a merger, acquisition or asset sale, we may transfer data to the third party involved; however, we will continue to ensure the confidentiality of all data. We will provide notice when your data becomes subject to a materially different privacy policy to the extent required by applicable law.

9. Privacy Rights and Choices

We will handle your requests and rights in accordance with applicable law. This means there may be legal reasons why we cannot fulfill all requests. We may need to request specific information from you to help confirm your identity, authority to act on behalf of a business or individual, and right to access your data (or to exercise any of your other rights). This is a security measure to ensure that your data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response time.

9.1. Withdraw Consent

In case the collection, maintenance, or processing of data is based on your consent, you may withdraw your consent at any time. Withdrawing your consent may lead to fewer possibilities to use the Services or the complete termination of our Services.

9.2. Correction

You have the right to request that incorrect, imprecise, incomplete, outdated, or unnecessary data we have stored about you be corrected or completed, subject to verification and applicable legal exceptions.

9.3. Objection

You may object to certain use of data if such information is collected, maintained, or processed for purposes other than those necessary for the performance of our Services to you, compliance with a legal obligation, prevention of fraud or illegal activity, risk management, security, or the establishment, exercise, or defense of legal claims. You may also object to any further collection, maintenance, or processing of data after previously giving consent. If you object to the further collection, maintenance, or processing of data, this may lead to fewer possibilities to use the Services or the complete termination of the Services.

9.4. Access

We offer you access to your data that we maintained or processed. This means that you may contact us, and we will inform you what data we maintain and the purposes such data is used for.

9.5. Portability

To the extent required by applicable law, you have the right to receive data that you provided to us in a structured and commonly used format and to independently transmit that information to a third party, subject to verification, technical feasibility, and applicable legal exceptions.

9.6. Deletion

You may also ask us to delete your data from our systems. We will comply with such request as required by applicable law, unless we have a legitimate ground to not delete the information, including compliance with legal, tax, accounting, audit, card-network, bank, processor, fraud-prevention, dispute-resolution, chargeback, security, or contractual obligations. We may not immediately be able to delete all residual copies from our servers and backup systems after the active data has been deleted. Such copies shall be deleted as soon as reasonably possible.

9.7. Restriction

You may request us to restrict certain maintenance or processing of data, but this may however lead to fewer possibilities to use the Services or the complete termination of the Services.

The above-mentioned rights may be used by sending a letter or an e-mail to us at the addresses set out in this Privacy Policy, including the following information: the full name, company name (if applicable), address, e-mail address, and a phone number. We may request the provision of additional information necessary to confirm your identity. We may reject or charge a reasonable fee for requests that are unreasonably repetitive, excessive, technically infeasible, abusive, or manifestly unfounded, to the extent permitted by applicable law. If you consider our collection, maintenance, or processing of data to be inconsistent with the applicable data protection laws, you may lodge a complaint with the local supervisory authority for data protection.

Notice to California Residents

This California notice does not apply to personal information that is exempt from the CCPA/CPRA, including personal information collected, processed, sold, or disclosed pursuant to GLBA, the California Financial Information Privacy Act, FCRA, or other applicable exemptions. For example, personal information collected in connection with merchant application, underwriting, settlement account verification, account servicing, fraud prevention, transaction processing, or related financial services may be subject to these exemptions.

We provide this notice under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act and its implementing regulations (“CCPA”), to California residents to explain how we collect, use, disclose, share, and retain their Personal Data, and the rights and choices we offer California residents regarding our handling of their Personal Data. This CCPA Notice applies only to California residents whose interactions with us are limited to:

• Visiting our Site;

• Signing up for email alerts;

• Commenting on or contributing to our blogs;

• Establishing an account that does not include financial products or services; or

• Applying for our job openings on our websites (however, note that the CCPA limits some of the privacy rights for job applicants).

This CCPA Notice does not apply to the Personal Data we collect, use, or disclose about consumers who initiate or complete the process of applying for financial products or services. This is because this information is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), its implementing regulations, the California Financial Information Privacy Act (“FIPA”), or other exemptions under the CCPA applicable to representatives of businesses that seek to obtain our products or services or to provide products or services to us. We do not sell personal information . As explained in this Privacy Policy, we use cookies and other tracking technologies to analyze website traffic and facilitate advertising.

The below provides California residents the right to know the categories of Personal Data collected and whether we disclosed data for business purposes in the preceding twelve (12) months, subject to GLBA, FIPA, and other applicable exemptions:

Privacy Practices: We do not sell Personal Data . As explained in our Privacy Policy, we use cookies and other tracking technologies to analyze website traffic and facilitate advertising. Please note that we may also disclose data as described in this Privacy Policy.

Privacy Rights: The CCPA grants individuals the following rights:

• Information and Access. You can request information about how we have collected, used, and shared your data during the past 12 months. You can also request a copy of the data that we maintain about you.

• Deletion. You can ask us to delete the data that we collected or maintained about you. Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request. We will respond to requests for information and access only to the extent we are able to associate with a reasonable effort the information we maintain with the identifying details you provide in your request. If we deny your request, we will communicate our decision to you. You are entitled to exercise the rights described above free from discrimination. To request access to or deletion of data please contact us at privacy@zenythpay.com.

• Opt-Out. You may request us to stop sharing your data (“op-out”, including via a user-enabled global privacy control). We cannot share your Personal Data after we receive your opt-out request unless you later authorize us to do so again.

• Non-discrimination. We cannot deny you the Services, charge you a different price, or provide a different level or quality of the Services just because you exercised your rights under the CCPA. However, if you refuse to provide your data to us or ask us to delete or stop sharing your data, and that data or the sharing of the data is necessary for us to provide you with the Services, we may not be able to complete that portion of the Services or the Services in its entirety.

• Correction. You have the right to ask us to correct any inaccurate information that we may have about you.

• Limit. To the extent required by applicable law, you can direct us to limit the use and disclosure of your sensitive data (i.e. your social security number, financial account information, your precise geolocation data, or your genetic data) to purposes permitted by applicable law, such as providing, securing, and improving the Services, verifying identity, preventing fraud, and complying with legal, bank, processor, and card-network obligations.

• Identity verification. The CCPA requires us to verify the identity of the individual submitting a request to access or delete data before providing a substantive response to the request. We will ask you to verify your identity when you submit a request.

• Authorized Agents. California residents can empower an “authorized agent” to submit a request on their behalf. We will require the authorized agent to have a written authorization confirming that authority.

Virginia, Colorado, Connecticut, Utah, Texas, and Other Applicable U.S. State Privacy Laws

In addition to your rights set forth in this Privacy Policy, residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with applicable privacy laws may have the right to opt out of certain processing of Personal Data, including targeted advertising, sale of Personal Data, or certain profiling, subject to applicable exemptions such as GLBA-regulated data and data processed in a commercial or employment context. Residents of states whose privacy laws provide an appeal right, including Virginia, Colorado, Connecticut, and Texas, also have the right to appeal certain decisions made by us concerning privacy requests as required by applicable law.

ZenythPay will acknowledge receipt of a privacy request within 10 business days and respond within 45 calendar days of receipt, unless an extension is permitted and notice is provided. Certain information may be retained where required or permitted by law, card network rules, processor or sponsor-bank obligations, fraud prevention, security, accounting, tax, dispute resolution, chargeback handling, or legal claims.

If ZenythPay denies a privacy request in whole or in part, the requester may appeal by contacting with "Privacy Appeal" in the subject line, and ZenythPay will respond to appeals within the timeframe required by the applicable state privacy law. privacy@zenythpay.com

10. Data Retention

ZenythPay retains personal information only for as long as reasonably necessary and proportionate to fulfill the purposes described in this Privacy Policy, including providing payment processing services, maintaining merchant accounts, satisfying legal and regulatory obligations, preventing fraud, resolving disputes, enforcing contractual rights, responding to regulatory or law enforcement requests, and maintaining appropriate business records.

Retention periods vary depending on the category of information, applicable legal requirements, sponsor-bank and payment network obligations, contractual commitments, and legitimate business needs. For example, merchant application, underwriting, transaction, settlement, tax, identity verification, and account servicing records are generally retained for up to seven years following account closure unless a longer retention period is required or permitted by law or is necessary to respond to litigation, investigations, audits, or regulatory inquiries.

Sensitive personal information, including Social Security numbers and government-issued identification, is retained only for as long as reasonably necessary to support identity verification, underwriting, fraud prevention, legal compliance, and related business purposes. ZenythPay periodically reviews retention needs and securely deletes, de-identifies, or otherwise restricts access to information that is no longer required, subject to applicable legal, contractual, and regulatory obligations.

Secure backups may be retained on a rolling schedule and may not be selectively alterable. If information is deleted from active systems, backup copies are removed as backups expire under the applicable retention cycle. If a backup is restored, ZenythPay will re-apply pending deletion or restriction requirements where legally required.

11. Cookies and Tracking Technologies

ZenythPay and its service providers may use cookies, pixels, SDKs, local storage, tags, and similar technologies to operate the website and applications, remember preferences, analyze usage, detect fraud, secure services, improve performance, and support advertising. For more information regarding our use of cookies, please review our Cookies Policy.

12. How We Protect Information

ZenythPay maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction and to comply, where applicable, with California's reasonable security requirement, GLBA Safeguards Rule requirements, PCI DSS obligations, and sponsor-bank and processor security requirements. Safeguards are risk-based and are designed for the sensitivity of the information and the payment-industry environment in which ZenythPay operates.

Production safeguards include or are intended to include:

• Encryption in transit: TLS 1.2 minimum, with TLS 1.3 preferred, for public website and API connections. TLS 1.0 and TLS 1.1 are disabled where ZenythPay controls the endpoint. Outbound processor and subprocessor connections are made over HTTPS/TLS.

• Encryption at rest: database, storage, and backup encryption using cloud-provider encryption, with customer-managed encryption keys for production systems where appropriate and supported.

• Application-layer encryption: high-sensitivity fields such as SSN, EIN, date of birth, bank account information, government ID data, and document metadata are encrypted at the application layer using strong encryption, with keys managed through a controlled key-management process.

• Key and secret management: production secrets are stored in a dedicated secret-management system or equivalent controlled deployment system, with access restricted to authorized service accounts and personnel. Key access follows least-privilege principles.

• Tokenization and card-data minimization: NMI tokenization and customer vault references are used so ZenythPay does not store full PAN or CVV/CVC.

• Access controls: role-based access controls, least-privilege permissions, authentication controls, and account access review for personnel and service accounts.

• Authentication security: strong password requirements, short-lived access tokens, rotating refresh tokens, refresh-token reuse detection, rate limiting, login-abuse throttling, and time-based one-time-password multi-factor authentication.

• Document storage: sensitive documents are stored in restricted-access cloud storage or equivalent secure storage, with public access blocked and access limited to authorized systems and personnel.

• Logging and monitoring: production logging is configured to avoid intentional capture of sensitive identifiers such as SSN, full bank account numbers, full PAN, CVV/CVC, or full government ID numbers. Sensitive-field redaction and exception scrubbing are implemented for production collection points.

• Vulnerability management: dependency scanning, secrets scanning, static analysis, container or infrastructure scanning where applicable, security review, patch management, and annual third-party penetration testing.

• Cloud posture: separation of development, staging, and production environments; restricted production access; audit logging; and alerting for security-relevant events such as IAM and key-management changes.

• Incident response: incident response procedures for investigating, containing, remediating, and notifying affected parties, sponsor bank, processor, or regulators where required.

If GLBA applies, ZenythPay will maintain a written information security program consistent with applicable GLBA Safeguards Rule requirements, including designation of a qualified individual, risk assessment, access controls, encryption where appropriate, secure development and change management practices, monitoring and testing, employee training, vendor oversight, incident response, periodic review, and reporting to the board of directors or equivalent governing body where required.

No method of transmission or storage is perfectly secure. ZenythPay cannot guarantee absolute security, but it maintains controls designed to reduce risk and protect sensitive merchant information.

13. International Processing

ZenythPay is based in the United States and is focused on U.S. merchants. Personal information is processed and stored in the United States. If a person accesses our services from outside the United States, their information may be transferred to and processed in the United States. We make no representation that our Services are governed by, or operated in accordance with, the laws of any other nation.

14. Children's Privacy

ZenythPay services are intended for businesses and for individuals who are at least 18 years old and authorized to act on behalf of a business. ZenythPay does not knowingly collect personal information from anyone under 18. If we learn that we collected information from a person under 18 in violation of this Policy, we will delete it where required. To notify us that we might have any information from or about a person under the age of 18, please contact us.

15. Changes to This Policy

We reserve the right to modify or amend this Privacy Policy at any time and for any reason. If we make any changes, we will notify you by posting it on our Site. We encourage you to frequently check this page for any changes to stay informed about how we are helping to protect the information we collect. By using our Services, you acknowledge and agree that it is your responsibility to review this Privacy Policy periodically and become aware of any modifications. If required by applicable law, we will provide additional notice of material changes to this Privacy Policy, which may include email or a notice on the Site before or when the change becomes effective. We encourage you to review our Privacy Policy periodically to stay informed about our information practices and the ways you can help protect your privacy. Your continued access or use of our website and Services following a change means you acknowledge the updated Privacy Policy, and, where consent is required by applicable law, consent to the collection, maintenance, use and disclosure of your data as set out in the updated Privacy Policy.

16. Contact Us

Questions, requests, complaints, GLBA privacy inquiries, California privacy requests, Shine the Light inquiries, or data-security incident inquiries about this Privacy Policy or ZenythPay's privacy practices may be directed to:

ZenythPay, Inc.
Attn: Privacy
9405 Brighton Way, Suite 26
Beverly Hills, CA 90210
privacy@zenythpay.com
+1 (833) 993-6984