Privacy Policy

1Definitions

For purposes of this Privacy Policy, the following capitalized terms have the meanings set forth below. Additional defined terms may appear elsewhere in this Privacy Policy or in the Terms.

(a) “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under Applicable Law. Personal Information does not include publicly available information, de-identified or aggregated information, or information exempt from applicable privacy laws.

(b) “Processing” (and “Process”) means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

(c) “Service Provider” means a natural or legal person, agency, or body that Processes Personal Information on behalf of Brightform for a business purpose under a written contract that satisfies Applicable Law.

(d) “Sensitive Personal Information” means Personal Information that reveals or concerns categories identified as sensitive, special, or restricted under Applicable Law, including government-issued identifiers, precise geolocation, account log-in credentials paired with any required access code, and financial account information.

(e) “Third Party” means any person that is not you, Brightform, or a Service Provider, including independent wallet infrastructure providers, verification providers, payment-rail providers, banking and card-network partners, merchants, operators, customers, and counterparties.

2Scope of this Privacy Policy

This Privacy Policy applies solely to Personal Information that Brightform collects or Processes in connection with the Services. This Privacy Policy does not apply to: (a) information collected, used, or disclosed by any Third Party, including any independent wallet provider, verification provider, payment processor, banking or card-network partner, merchant, operator, or other counterparty, each of which Processes information under its own policies and practices; (b) information that you choose to publish or transmit to, through, or in connection with public blockchain networks, smart contracts, or other publicly accessible distributed ledgers; or (c) information that you provide to any other website, application, or service that is not operated by Brightform, even if it is accessible through or linked to the Services.

You are encouraged to review the privacy policies and practices of each Third Party whose products or services you use in connection with the Services. Brightform is not responsible for, and makes no representations regarding, the privacy practices of any Third Party.

3Information We Collect

We collect the following categories of information in connection with the Services. The specific information collected in any given interaction depends on the features you use and the workflows you initiate.

3.1 Information You Provide Directly. When you create a profile, register a merchant account or point-of-sale device, connect a wallet, complete a form, request support, onboard your business, or otherwise interact with us, you may provide Personal Information such as: (a) identifiers, including your name, business name, username, email address, and telephone number; (b) profile and business information, including your display name, logo, store details, and communications preferences; (c) commercial information, including records of Services you have accessed, payments you have processed, and preferences you have expressed; (d) communications content, including the contents of messages, support tickets, survey responses, and feedback you submit to us; and (e) any other information that you choose to provide.

3.2 Wallet and Transaction Information. When you connect a non-custodial wallet (whether embedded through a Third Party wallet infrastructure provider or self-custodied by you) and use the Services to accept, send, or coordinate payments, we collect information associated with that wallet, including public wallet addresses, transaction hashes, token balances or holdings observable from the relevant blockchain or reported by Third Party providers, payment amounts and metadata, counterparty and customer wallet addresses, timestamps, and other on-chain and off-chain signals necessary to render the Services and monitor for fraud, sanctions, and other compliance matters. Brightform does not collect, store, or have access to your private keys, seed phrases, or recovery credentials.

3.3 Device, Technical, and Usage Information. When you access the Services, we and our Service Providers may collect certain technical and usage information, including: internet protocol (IP) address; device identifiers; browser type, version, and settings; operating system; language preferences; referring and exit URLs; pages viewed; links and features clicked; session duration, timing, and navigation patterns; approximate geographic location derived from IP address; and, where you have enabled it, precise geolocation. We and our Service Providers may also use device fingerprinting, log files, web beacons, pixels, tags, and similar technologies to collect this information.

3.4 Compliance and Verification Information. To comply with Applicable Law and to operate the Services safely, we and our Service Providers may collect or receive information relating to merchant onboarding, sanctions screening, wallet risk screening, fraud screening, geoblocking checks, and other verification or compliance signals. This information may be derived from, or checked against, government, intergovernmental, and commercial sources, including the U.S. Department of the Treasury Office of Foreign Assets Control (“OFAC”) Specially Designated Nationals and Blocked Persons List, other U.S. federal sanctions and export-control screening lists, the United Nations Security Council Consolidated Sanctions List, and sanctions, politically-exposed-person, adverse-media, and wallet-risk databases maintained by governmental or commercial providers. This information is typically generated or supplied by Third Party verification, attestation, or screening providers, and may include risk scores, allowlist or blocklist status, jurisdiction determinations, and attestations concerning your eligibility to use specific features.

3.5 Information From Third Parties. We may receive Personal Information about you from Third Parties, including: (a) wallet infrastructure providers (such as Turnkey or other providers designated in the Services); (b) authentication and identity providers; (c) verification, attestation, and compliance providers; (d) payment-rail, card-network, banking, and merchant-portal providers; (e) analytics, fraud-prevention, and security providers; (f) publicly available sources and public blockchain networks; and (g) customers, merchants, operators, and counterparties that interact with you through the Services. The information we receive depends on the Third Party and your relationship with it.

3.6 Cookies and Similar Technologies. We and our Service Providers may use cookies, local storage, session storage, software development kits, pixels, tags, and similar technologies to operate the Services, authenticate sessions, remember preferences, measure usage, understand performance, prevent fraud, and improve features. You can control cookies through your browser settings and through available opt-out mechanisms described in Section 11 below, but disabling certain cookies may impair the functionality of the Services.

3.7 Information We Do Not Intentionally Collect. Except as may be indirectly received through a Third Party verification provider in the form of a risk score, match result, attestation, or similar derived output, Brightform does not intentionally collect from you any of the following: protected health information as defined under the Health Insurance Portability and Accountability Act; genetic information; biometric identifiers or templates; or information concerning your religious or philosophical beliefs, sexual orientation or sex life, trade-union membership, or racial or ethnic origin. If you inadvertently submit any such information to us, and notify Brightform’s registered agent by other means specifically identified as valid notice under the Terms and Conditions, we will take reasonable steps to delete such information. To the extent that a Third Party integrated with the Services (including an identity verification provider that processes a photograph, video, or government-issued identification) does collect or Process such information in connection with its own services, that Third Party is responsible for its practices under its own policies.

4How We Use Information

We may use the information described above to: (a) provide, operate, maintain, and improve the Services; (b) establish, administer, and support your profile, merchant account, and your use of the Services; (c) authenticate sessions and prevent unauthorized access; (d) process, route, settle, and reconcile payments and facilitate communication and coordination between you and your customers or counterparties; (e) display wallet addresses, profile information, transaction metadata, payment status, and Third Party verification or status outputs as contemplated by the Terms; (f) detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful or prohibited activity; (g) conduct merchant onboarding, sanctions screening, wallet risk screening, geoblocking, and other compliance activities; (h) comply with Applicable Law and respond to lawful requests from Governmental Authorities; (i) enforce the Terms and any other applicable agreements; (j) communicate with you about the Services, including transactional notices, security alerts, product updates, and, where permitted, marketing communications; (k) conduct research, analytics, testing, and product development, including through the use of de-identified or aggregated information; and (l) carry out any other purpose for which the information was collected and to which you have consented.

We may also combine information collected through different features of the Services, and combine it with information received from Third Parties, for the purposes described above. We may create and use de-identified, anonymized, or aggregated information for any lawful purpose, without restriction under this Privacy Policy.

Automated Tools and Decision-Making. We and our Service Providers may use automated tools and techniques, including rules-based filters, device fingerprinting, behavioral analytics, and pattern recognition, to support the uses described in this Section 4, particularly those relating to security, fraud prevention, sanctions screening, wallet risk screening, geoblocking, and other compliance activities. Some of these tools may result in automated decisions that restrict, delay, or prevent your access to all or part of the Services (for example, by blocking a wallet address flagged against a sanctions or risk database). Where an automated decision has a legal or similarly significant effect on you, you may request human review of that decision by contacting us using the information in Section 16, and we will respond in accordance with Applicable Law. Brightform may decline to disclose the specific basis for any such decision where doing so could impair security, violate law, or compromise our compliance processes.

5How We Disclose Information

We disclose Personal Information in the following circumstances:

5.1 Service Providers. We disclose Personal Information to Service Providers that perform functions on our behalf, including hosting, storage, analytics, customer support, email and messaging delivery, fraud prevention, security monitoring, sanctions screening, identity and wallet verification, software development, quality assurance, and professional services. Examples of the categories of Service Providers we may engage include: cloud hosting and data storage providers; customer support and help desk providers; email, SMS, and push notification delivery providers; web, mobile, and product analytics providers; fraud prevention, security, and abuse detection providers; sanctions and wallet risk screening providers; identity, credential, and merchant verification providers; wallet infrastructure and authentication providers; marketing, advertising measurement, and attribution providers; and outside legal, accounting, tax, auditing, insurance, and other professional advisors. Service Providers are permitted to use Personal Information only as necessary to perform services for us and in accordance with contractual obligations that, where required by Applicable Law, prohibit them from retaining, using, or disclosing Personal Information for any other purpose.

5.2 Third Parties Integrated With the Services. When you use a feature that requires interaction with a Third Party (such as a wallet infrastructure provider, authentication provider, verification provider, payment rail, banking or card-network partner, or merchant portal), we may share Personal Information with that Third Party to the extent necessary to enable the feature or workflow you have requested. Each such Third Party Processes your Personal Information under its own policies and practices. Brightform is not responsible for the acts, omissions, or privacy practices of any Third Party.

5.3 Customers, Counterparties, and Other Users. In the ordinary course of using the Services, certain information you provide or generate (including business names, display names, wallet addresses, payment requests, messages, and transaction activity) may be visible to, or shared with, your customers, counterparties, and other users with whom you choose to interact. You should have no expectation of privacy with respect to information that you publish, transmit, or otherwise make available through public facing features of the Services or on public blockchain networks.

5.4 Legal, Compliance, and Safety. We may disclose Personal Information when we believe in good faith that disclosure is necessary or appropriate to: (a) comply with Applicable Law, legal process, subpoenas, court orders, or governmental or regulatory requests or requirements; (b) respond to claims or allegations against Brightform; (c) enforce the Terms or any other agreement we have with you; (d) detect, investigate, prevent, or address fraud, security incidents, sanctions violations, or other unlawful or prohibited activity; or (e) protect the rights, property, safety, or security of Brightform, our users, our Service Providers, or the public.

5.5 Corporate Transactions. If Brightform is involved in a merger, acquisition, financing, reorganization, sale of all or a portion of its assets, bankruptcy, or similar corporate transaction, Personal Information may be transferred or disclosed to the counterparty, its advisors, and other participants in the transaction, subject to customary confidentiality protections and to the extent permitted by Applicable Law.

5.6 With Your Direction or Consent. We may disclose Personal Information to other parties at your direction or with your consent.

5.7 De-Identified and Aggregated Information. We may disclose de-identified, anonymized, or aggregated information for any lawful purpose without restriction.

Brightform does not sell Personal Information in exchange for monetary consideration. To the extent that any of our information sharing practices described above could be deemed a “sale” or “sharing” of Personal Information under Applicable Law, we describe your related rights and choices in Section 12 below.

6Blockchain Data

Information relating to payments and transactions coordinated through the Services and settled on a public blockchain is recorded on that blockchain by the applicable network participants and not by Brightform. Once information is recorded on a public blockchain, it is generally public, pseudonymous, permanent, and beyond Brightform’s control. Brightform cannot modify, delete, or anonymize blockchain data, cannot prevent its replication, and cannot prevent third parties (including blockchain analytics firms, law enforcement, and researchers) from observing, analyzing, or correlating that data with other information, including information that may identify you. You should carefully consider these characteristics before initiating any transaction in connection with the Services.

7Data Retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to: (a) provide the Services; (b) maintain business records; (c) comply with Applicable Law, including tax, recordkeeping, sanctions, AML, and audit obligations; (d) resolve disputes; (e) enforce our agreements; and (f) protect against legal claims and other risks. When Personal Information is no longer needed for these purposes, we will delete, de-identify, or securely archive it in accordance with our data retention practices and Applicable Law. Following deletion or de-identification, residual copies of Personal Information may persist for a reasonable period in backup, archival, and disaster recovery systems and in security, audit, or incident response logs, in each case consistent with our retention schedules and Applicable Law. Notwithstanding the foregoing, we cannot delete, modify, or anonymize information that has been recorded on a public blockchain.

8Security

We implement and maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, loss, misuse, alteration, or destruction. No method of transmission or electronic storage, however, is completely secure, and we cannot guarantee the absolute security of Personal Information. You are responsible for safeguarding your devices, credentials, and the security of your wallet and any private keys, seed phrases, or recovery credentials associated with your wallet, which Brightform does not have access to and cannot recover.

9International Data Transfers

Brightform is based in the United States and may Process Personal Information in the United States and in other jurisdictions in which Brightform, its affiliates, and its Service Providers maintain facilities. If you access the Services from outside the United States, you understand that Personal Information may be transferred to, stored in, and Processed in jurisdictions whose data-protection laws may differ from those of your jurisdiction of residence. Where required by Applicable Law, we will implement appropriate safeguards in connection with cross-border transfers of Personal Information.

10Children's Privacy

The Services are not directed to, and we do not knowingly collect Personal Information from, individuals under the age of eighteen (18) or the applicable legal age in their jurisdiction, whichever is greater. If we learn that we have collected Personal Information from an individual who is not old enough to use the Services, we will take reasonable steps to delete that information. If you are a parent or guardian and believe that a minor has provided Personal Information to us, please contact us using the information in Section 16 below.

11Your Choices

11.1 Account and Profile Settings. You may review, update, or correct certain Personal Information associated with your profile or merchant account through in-product settings, where available.

11.2 Marketing Communications. You may opt out of marketing emails by following the unsubscribe instructions contained in the email. You may opt out of marketing text messages by replying STOP to the applicable message, as further described in the Terms. Even if you opt out of marketing communications, we may continue to send you transactional, security, or service-related messages that are necessary to provide the Services.

11.3 Cookies and Tracking Technologies. Most web browsers allow you to block or delete cookies through their settings. You may also be able to opt out of certain analytics, advertising, and measurement cookies through industry self-regulatory tools, such as the Digital Advertising Alliance’s opt-out page and the Network Advertising Initiative’s opt-out page. Disabling cookies may impair the functionality of the Services.

11.4 Do Not Track; Global Privacy Control. The Services do not respond to Do Not Track (DNT) browser signals, because no common industry or legal standard for recognizing or honoring DNT signals has been adopted. We do, however, recognize opt-out preference signals such as the Global Privacy Control (GPC) where required by Applicable Law, as further described in Section 12.

11.5 Your Responsibility for Accuracy. You are responsible for the accuracy, completeness, and currency of the Personal Information you provide to Brightform and to Third Parties integrated with the Services. If any Personal Information you have provided becomes inaccurate or out of date, you are encouraged to update it promptly through available in-product mechanisms or by contacting us using the information in Section 16.

12U.S. State Privacy Rights

This Section 12 describes additional rights and disclosures that may apply to residents of certain U.S. states. These rights are subject to the exceptions, verification requirements, and other limitations set forth in Applicable Law. Rights described in this Section do not apply to Personal Information that is exempt from the applicable state privacy law (for example, certain information governed by the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, or similar laws).

12.1 Categories of Personal Information Collected and Disclosed. In the preceding twelve (12) months, we have collected the categories of Personal Information described in Section 3 from the sources identified in Section 3, for the purposes identified in Section 4, and have disclosed those categories for the business purposes and to the categories of recipients identified in Section 5.

12.2 “Sale” and “Sharing” of Personal Information. Brightform does not sell Personal Information in exchange for monetary consideration. Certain information-sharing practices, including the use of analytics and measurement technologies on the Services, may be deemed a “sale” or “sharing” of Personal Information, or targeted advertising, under some state privacy laws. Residents of applicable states may exercise the rights described in Section 12.4 to opt out of such activity.

12.3 Sensitive Personal Information. We use and disclose Sensitive Personal Information only for the purposes permitted under Applicable Law without the requirement to offer a right to limit, including to provide the Services, prevent fraud, ensure security and integrity, comply with Applicable Law, and perform functions reasonably expected by you.

12.4 State Rights. Subject to Applicable Law and the exceptions and verification requirements described in this Section 12, residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states that have enacted comprehensive consumer privacy laws may have the right to: (a) confirm whether we are Processing Personal Information about them and access such Personal Information; (b) correct inaccurate Personal Information; (c) delete Personal Information; (d) obtain a portable copy of Personal Information; (e) opt out of the sale or sharing of Personal Information and of targeted advertising; (f) opt out of certain profiling that produces legal or similarly significant effects; (g) limit the use or disclosure of Sensitive Personal Information; and (h) not be subject to unlawful discrimination for exercising any of the foregoing rights. The specific rights available to you depend on the law of your state of residence.

12.5 How to Exercise Your Rights. To exercise any right described in this Section 12, submit a request using the contact information in Section 16, or through any designated request mechanism made available through the Services. We will verify your request in accordance with Applicable Law before fulfilling it. We may deny a request, in whole or in part, where permitted or required by Applicable Law. You may designate an authorized agent to submit a request on your behalf, subject to verification of the agent’s authority and, where required, of your identity.

12.6 Appeals. In states that provide a right to appeal a denial of a privacy request (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia), you may appeal our decision by following the instructions provided in our response to your request or by contacting us using the information in Section 16.

12.7 California “Shine the Light.” California residents may request, once per calendar year, information regarding our disclosure (if any) of Personal Information to third parties for those third parties’ direct-marketing purposes during the preceding calendar year, as contemplated by California Civil Code Section 1798.83. To submit such a request, contact us using the information in Section 16.

12.8 Nevada Residents. Nevada law permits certain Nevada residents to opt out of the future sale of certain covered information (as defined under Nevada law) for monetary consideration to a person who will license or sell that information to others. Brightform does not engage in such activity, but Nevada residents may nonetheless submit an opt-out request by contacting us using the information in Section 16.

13Third-Party Services; Linked Sites

The Services may link to, integrate with, or rely upon Third Party services, including wallet infrastructure, authentication services, blockchain networks, smart contracts, node providers, verification providers, attestation providers, payment rails, banking and card-network partners, communication services, and analytics providers. This Privacy Policy does not apply to the practices of any Third Party. We encourage you to review the privacy policies of each Third Party whose products or services you use in connection with the Services.

14Notice of Financial Incentives

From time to time, Brightform may offer promotions, loyalty or rewards programs, referral programs, or other features that constitute a “financial incentive” under Applicable Law. Any such program will be offered only on terms disclosed at or before the time you opt in, and participation is entirely voluntary. You may withdraw from any such program at any time by following the instructions provided at the time of opt-in or by contacting us using the information in Section 16.

15Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this Privacy Policy and, where appropriate, provide additional notice (such as by posting a notice on the Services or sending an in-product communication). Your continued access to or use of the Services after the revised Privacy Policy becomes effective constitutes your acknowledgement of the revised Privacy Policy. Where Applicable Law requires us to obtain your consent to any material change, we will do so before the change takes effect.

16Contact Us