Privacy Policy

Effective date: November 8, 2026

PaperPay Inc. ("PaperPay", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our services, website, API, and related products (the "Services").

1. Information We Collect

Information you provide

• Account information: Name, email address, phone number, and business details when you create an account.
• Payment information: Credit/debit card numbers, bank account details, and billing addresses. Payment card data is processed directly by Stripe and never stored on our servers.
• Identity verification data: Government-issued ID documents (front and back images), selfie photographs, and biometric data derived from facial comparison during identity verification.
• Transaction data: Records of payments, refunds, container activity, and merchant interactions.
• Communications: Messages you send to us, support inquiries, and feedback.

Information collected automatically

• Device information: IP address, browser type, operating system, device identifiers.
• Usage data: Pages visited, features used, timestamps, and interaction patterns.
• Cookies: We use essential cookies for session management and security. We do not use third-party advertising cookies.

2. How We Use Your Information

• Process payments and transactions
• Verify your identity as required by law (KYC/AML compliance)
• Provide, maintain, and improve the Services
• Detect and prevent fraud, unauthorized transactions, and abuse
• Communicate with you about your account, transactions, and service updates
• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service

3. How We Share Your Information

We do not sell your personal information. We share information only in these circumstances:

• Payment processors: Stripe processes payment card data on our behalf under their own privacy policy.
• Merchants: When you make a payment, the merchant receives transaction details necessary to fulfil your order.
• Identity verification providers: To complete identity checks as required by law.
• Legal compliance: When required by law, subpoena, court order, or government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.
• With your consent: When you explicitly authorize sharing.

4. Biometric Data

Our identity verification service collects facial geometry data from selfie images for the purpose of comparing against your identity document. This biometric data is:

• Used solely for identity verification
• Not shared with third parties except verification service providers
• Deleted within 90 days of verification completion
• Collected only with your explicit consent during the verification flow

5. Data Retention

• Account data: Retained while your account is active and for 7 years after closure for regulatory compliance.
• Transaction records: Retained for 7 years as required by Canadian financial regulations.
• Identity documents: Retained for the duration required by applicable KYC/AML laws, then securely deleted.
• Biometric data: Deleted within 90 days of verification completion.
• Usage logs: Retained for 12 months, then aggregated or deleted.

6. Data Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• Encryption at rest for sensitive data
• PCI DSS compliance through our payment processor (Stripe)
• Access controls and audit logging
• Regular security assessments

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but take commercially reasonable measures to protect your data.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention requirements)
• Withdraw consent for data processing where consent is the legal basis
• Data portability — receive your data in a structured, machine-readable format
• Object to certain types of processing

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

8. Canadian Privacy Law (PIPEDA)

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access your personal information and challenge its accuracy. Our Privacy Officer can be reached at [email protected].

9. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete it.

10. International Transfers

Your information may be processed in Canada and the United States, where our service providers operate. We ensure appropriate safeguards are in place for any cross-border data transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on the Services. The "Effective date" at the top indicates when the policy was last revised.

12. Contact

PaperPay Inc.
Privacy Officer
Email: [email protected]