VIZYPAY PRIVACY POLICY
Last updated: v.2026.11.06

1.  Who We Are and What This Policy Covers
VizyPay, LLC ("VizyPay", "we", "us") is an Iowa limited liability company headquartered at 2565 SE Encompass Drive, Suite 210, Waukee, Iowa 50263. VizyPay, LLC is a registered Independent Sales Organization (“ISO”) of Citizens Bank, N.A., Providence, RI and Pathward, N.A., Sioux Falls, SD.

This Privacy Policy (the “Policy”) describes how we collect, use, disclose and protect personal information when you: (a) visit our websites, including vizypay.com and its subdomains (the "Site"); (b) apply for or use VizyPay’s payment processing and related merchant services; (c) communicate with us or receive our communications; or (d) otherwise interact with our business (other than through the VEXIS platform). It does not replace the agreements that govern specific relationships: merchant processing services are governed by the VizyPay Agreement and related program documents, and sales-partner relationships by their respective Sales Referral Agreements. If this Policy conflicts with one of those agreements, the applicable agreement controls for its subject matter.

The Site covers www.vizypay.com, info.vizypay.com, 4653380.hs-sites.com and vizypay-4653380.hs-sites.com.

The VEXIS platform (including its use by VizyPay employees, contractors and Agents) is addressed separately in the VEXIS Privacy Policy. Employment matters are addressed in the VizyPay Employee and Contractor Privacy Notice. This Policy focuses on VizyPay’s general business, the Site and merchant and prospect relationships; where this Policy also describes business-facing analytics or AI use (Sections 3 and 5), those provisions concern VizyPay’s merchant and prospect data, not the VEXIS platform’s internal workforce or Agent-facing features.

2.  Notice at Collection
At or before the point where we collect personal information, we collect the categories described in Section 3, for the purposes described in Section 4. We do not sell personal information for money. We do share limited personal information (identifiers and internet activity) with advertising partners for cross-context behavioral advertising, as described in Section 7, and you can opt out as described in Section 9, including through the "Do Not Sell or Share My Personal Information" link on the Site. We do not use or disclose sensitive personal information for purposes requiring a right to limit under state privacy laws. We retain personal information as described in Section 8. Your rights are described in Sections 9 and 10.

3.  Personal Information We Collect
Identifiers and contact information: name, business and personal email address, phone number, postal address, business name and title, account credentials, signatures.

Commercial and financial information: information about the products and services you inquire about or use; for merchants and business owners, business financial information such as processing volumes, statement data, transaction summaries, banking details needed to provide services, and tax identification information. We do not store cardholder account numbers or card verification data on the Site by design.

Business documents you provide: documents you upload or send to us, such as processing statements, which may include business terms and the names and contact details of business contacts.

Internet and device activity: IP address, browser and device type, pages viewed, links clicked and similar usage data collected through cookies and similar technologies on the Site. You can control cookies through your browser settings.

Professional and public-record information: for business prospecting, we and our service providers may collect information from public and commercially available sources, such as business registrations and filings, public court and lien records, business websites, review platforms, and licensed business-data providers. This may include business owner names, business contact details and business attributes.

Communications: records of your communications with us, including support interactions.

Inferences and analytics: business-level analytics, scores and predictions our systems generate about merchant accounts and business relationships, such as retention risk and service-quality indicators.

4.  How We Use Personal Information
We use personal information to: provide, operate, secure and improve the Site and our services; establish and service merchant, partner and vendor relationships, including underwriting, onboarding and support; communicate with you, including service communications and, where permitted, marketing communications you can opt out of; identify and contact businesses that may benefit from our services; generate business analytics and predictions that help us serve merchant accounts, including AI-assisted analytics; comply with legal, card-network, sponsor-bank and processor obligations; detect, investigate, and prevent fraud and security incidents; and enforce our agreements and protect our legal rights.

5.  Artificial Intelligence and Automated Processing
Our systems use automated processing and artificial intelligence to generate business analytics, draft content, extract information from documents, answer questions, and produce business-level scores and predictions about merchant accounts and prospects. These outputs are used by people at VizyPay to run the business; we do not use automated processing to make a decision that produces legal or similarly significant effects concerning a consumer without human involvement. If we begin using automated decision-making in a way that applicable law treats as a significant decision, we will provide the notices and opt-out rights that law requires before doing so.

6.  Sensitive Personal Information
Some information we collect to provide services is treated as sensitive under state law, such as account log-in credentials and financial account information needed to provide services. We collect and use sensitive personal information only to provide the services requested, to maintain security, and for other purposes permitted by law that do not require a right to limit. We do not use sensitive personal information to infer characteristics about individuals.

7.  How We Disclose Personal Information
We disclose personal information to: service providers and contractors who process it for us under contracts that restrict their use of it (including cloud hosting, document processing, AI infrastructure, email and messaging delivery, business-data, analytics and customer-relationship providers); our sponsor banks, payment processors and card networks as required to provide payment services and comply with their rules; professional advisors such as lawyers, accountants and insurers; government authorities and other parties where required by law, to protect rights and safety, or to enforce agreements; and a successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell personal information in exchange for money. We do share identifiers and internet or other electronic network activity with the advertising and analytics vendors below for cross-context behavioral advertising (or "targeted advertising"), through cookies, pixels and similar technologies on the Site: HubSpot (site platform, forms, and first-party analytics); Google Tag Manager and Google Analytics 4 (tag management and site analytics); Google Ads/DoubleClick (advertising); Meta (Facebook) Pixel (advertising); LinkedIn Insight (advertising); Microsoft Advertising/Bing UET (advertising); StackAdapt (advertising); Impact.com (affiliate tracking); Hotjar (session analytics); and Lead Forensics (business-visitor identification). You can opt out at any time using the "Do Not Sell or Share My Personal Information" link on the Site, by declining in the cookie banner, by enabling the Global Privacy Control in your browser, or by contacting us as described in Section 9; each of these vendors stops receiving data when you opt out. HubSpot’s own first-party site-measurement analytics continues after you opt out but operates cookielessly at that point (it sets no cookies, assigns a visitor identifier that lasts only the single visit and is never linked to your contact record). We do not knowingly share the personal information of anyone under 16.

8.  Retention and Deletion
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, to comply with legal, card-network, sponsor-bank and audit obligations, to resolve disputes, and to enforce agreements. Retention periods vary by information type and legal requirement. Some of our systems maintain event histories for integrity and audit purposes; when you make a valid deletion request, we delete or de-identify your personal information, which may include rendering identifying data permanently unreadable rather than physically erasing every historical record, and we will not maintain it in a form that can be used to identify you except where the law permits retention.

9.  Your Privacy Rights
Depending on your state of residence, you may have the right to: know and access the personal information we hold about you, including the categories collected, sources, purposes and disclosures; obtain a portable copy; correct inaccurate personal information; delete personal information, subject to legal exceptions; opt out of the sale or sharing of personal information and of targeted advertising, which you can exercise through the "Do Not Sell or Share My Personal Information" link on the Site, the Global Privacy Control or the contacts below; opt out of certain profiling (we do not use automated processing to make significant decisions about consumers without human involvement); limit the use of sensitive personal information (we do not use it beyond permitted purposes); and not receive discriminatory treatment for exercising your rights. Where state law provides an appeal right, you may appeal a decision we make on your request, and we will explain the outcome.

To exercise your rights, contact us at privacy@vizypay.com or 1-855-999-4142, or write to the address in Section 15. We will verify your identity using information we already hold and respond within the time your state’s law requires. You may use an authorized agent where the law allows; we may require proof of the agent’s authority.

We honor opt-out preference signals, such as the Global Privacy Control. A valid signal is treated as a request to opt out of the sale or sharing of personal information for that browser or device.

10.  State-Specific Disclosures
California: In the preceding twelve months we collected the categories of personal information described in Section 3 from the sources described there, used them for the purposes in Section 4, and disclosed them for business purposes to the recipient categories in Section 7. In the preceding twelve months we shared identifiers and internet or other electronic network activity with advertising and analytics partners for cross-context behavioral advertising; we did not sell personal information for money, and we do not knowingly sell or share the personal information of consumers under 16. California residents may exercise the rights in Section 9, including the opt-out mechanisms described there.

Other states: Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Texas, Oregon, Virginia, Utah, Iowa and others, have the rights described in Section 9 to the extent provided by their state’s law, exercisable through the same contact methods, with appeals handled as their law requires.

11.  Security
We maintain a written information security program with administrative, technical and physical safeguards appropriate to the sensitivity of the information we handle, including encryption, access controls, multi-factor authentication, vendor security review and monitoring. No system is perfectly secure; if a breach affecting your personal information requires notice under applicable law, we will provide it.

12.  Children
The Site is a business service, is not directed to children, and we do not knowingly collect personal information from anyone under 18.

13.  Users Outside the United States
Our services are operated from and directed to the United States. If you access them from outside the United States, you understand your information will be processed in the United States under this Policy and United States law.

14.  Changes to This Policy
We may update this Policy from time to time. The effective date above reflects the current version, and material changes will be posted on the Site. Your continued use of the Site after an update means the updated Policy applies.

15.  Contact Us
VizyPay, LLC, Attn: Privacy, 2565 SE Encompass Drive, Suite 210, Waukee, Iowa 50263 | privacy@vizypay.com | 1-855-999-4142.