XLY Privacy Policy
Important: Please read this Policy carefully. By using XLY services, you acknowledge that you understand how we handle your personal information. This Policy does not constitute legal advice; please consult your legal counsel if you have questions.
1. Scope and Operator
This XLY Privacy Policy ("Policy") describes how XLY Technology LLC (a Colorado Limited Liability Company, Entity ID #20261453307, registered with the Colorado Secretary of State, hereinafter "XLY," "we," or "us") collects, uses, retains, shares, and protects personal information obtained through XLY websites, merchant dashboards, payment links, APIs, customer service channels, and related services. This Policy applies to merchants, merchant representatives, payers, website visitors, and other service users.
This Policy does not replace privacy policies published by merchants for their own goods or services. If you pay a Merchant or transact with one, that Merchant is responsible for information it independently collects and uses; please review and contact the Merchant directly to understand its fulfillment, marketing, delivery, or customer data practices.
2. Data Processing Roles
In managing XLY's own accounts, website security, compliance, product operations, and support, XLY may act as a controller of personal information or the equivalent role under Applicable Law. Where we process Payer order and transaction data on behalf of Merchants, the Merchant typically determines the purposes and means of processing, while XLY provides technology services based on the Merchant's lawful instructions and Applicable Law. Specific roles may vary by service, location, and transaction circumstances.
3. Information We May Collect
3.1 Information You Provide Directly
Includes name, email address, phone number, merchant entity details, authorized representative details, account and login information, customer service communications, and information you submit in connection with orders, refunds, or disputes.
3.2 Transaction and Order Information
Includes payment link IDs, order numbers, goods or service descriptions, amounts, currencies, payment status, refunds, disputes, settlement, timestamps, merchant identifiers, and transaction-related risk signals. Sensitive payment credentials such as payment card numbers and verification codes should be processed by authorized payment components or Payment Service Providers under their security standards; XLY will not ask you to provide full card numbers or verification codes via ordinary text, email, or customer service chat.
3.3 Automatically Collected Technical Information
Includes IP address, browser and device information, operating system, language, access times, page interactions, session identifiers, logs, error messages, cookie or local storage information, and device or network signals needed to prevent fraud and ensure security. When you pay, we may also generate a one-way hashed device identifier (SHA-256) in your browser for fraud prevention and payment-network chargeback evidence (e.g., Visa Compelling Evidence 3.0); only the hash is stored — raw device attributes never leave your browser.
4. Sources of Information and Legal Bases
In addition to collecting directly from you, we may obtain service-, risk-, and compliance-related information from Merchants, Payment Service Providers, banks or payment networks, identity verification or anti-fraud providers, public sources, affiliates, and other lawfully available third parties. We process information only on bases permitted by Applicable Law, such as performing contracts or transactions, complying with legal obligations, legitimate interests including maintaining security and preventing fraud, or obtaining your consent where required.
5. How We Use Personal Information
We may use personal information to: (a) provide, maintain, and improve the Services; (b) create, display, process, confirm, and record orders, payments, refunds, and disputes; (c) verify identity, manage accounts, respond to support requests, and send service notices; (d) prevent fraud, abuse, security incidents, money laundering, and other risks; (e) conduct audits, reconciliation, analytics, troubleshooting, and quality improvement; (f) comply with legal, regulatory, tax, accounting, payment network, or court requirements; and (g) perform other described processing with necessary consent.
6. Sharing and Disclosure
We share information to the extent necessary with: relevant Merchants and their authorized personnel to process orders, fulfillment, customer service, refunds, or disputes; bound service providers that provide payment, cloud hosting, communications, customer support, logging, risk control, audit, or professional services; Payment Service Providers, financial institutions, payment networks, and anti-fraud partners; regulators, law enforcement, courts, or other parties legally entitled to request information; and relevant parties bound by confidentiality and Applicable Law in connection with mergers, financing, reorganizations, or asset transfers.
We do not sell personal information as a standalone commodity. If Applicable Law characterizes certain advertising, analytics, or data disclosures as "sales," "sharing," or "targeted advertising," we will provide required notices, opt-outs, or consent mechanisms to the extent required by law.
7. Cookies, Analytics, and Similar Technologies
We may use essential cookies, local storage, pixels, or similar technologies for security, session management, troubleshooting, remembering preferences, and understanding service usage. Non-essential analytics or marketing technologies will be used with appropriate notice and choice mechanisms where required by Applicable Law. You may limit some technologies through browser settings, but this may affect login, payment, or other features. You can manage cookies through your browser settings, typically found under "Settings > Privacy."
8. Security and Data Retention
We take administrative, technical, and organizational measures proportionate to risk, including access controls, transmission protection, key management, log auditing, least privilege, and incident response procedures, to protect personal information against unauthorized access, use, disclosure, modification, or loss. Nevertheless, no system can guarantee absolute security.
We retain personal information only for as long as necessary to provide the Services, fulfill transaction and dispute obligations, meet security and audit needs, comply with laws, or resolve disputes. Specifically: transaction records are retained for at least 7 years to meet tax, accounting, and anti-money-laundering compliance; account information is retained for 3 years after account closure; logs and security event records for 2 years; and marketing consent records for 3 years after withdrawal. Upon expiry, we will delete, anonymize, or securely isolate information in accordance with Applicable Law.
9. International Data Transfers
Because we, Merchants, Payment Service Providers, or service providers may operate in different countries or regions, your information may be transferred to, stored in, or processed in jurisdictions outside your location. Where cross-border transfers occur, we will adopt reasonable safeguards in accordance with Applicable Law, such as contractual commitments, data transfer mechanisms, access controls, or other legally permitted mechanisms.
10. Your Rights and Choices
To the extent provided by Applicable Law, you may have the right to request access to, correction, deletion, restriction of, or objection to the processing of your personal information; to request a portable copy of your data; to withdraw consent; or to exercise choices regarding certain sharing, targeted advertising, or automated decisions. You may also have the right to complain to your local privacy regulator. We may need to verify your identity and request authority, and will respond within the timeframes and scope permitted by law.
Payers seeking to correct product, delivery, or Merchant marketing information should contact the relevant Merchant first. For data we process on behalf of Merchants, we may forward requests to the Merchant or process them per its lawful instructions. To submit a request: email [email protected] (please specify "Privacy Request") or call +1 4064405240. Where applicable, US consumers may designate an authorized agent, subject to our lawful verification.
11. Children
The Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children below that age; if you believe a child has submitted information without proper authorization, please contact us as described below.
12. Third-Party Links and Services
The Services may contain links to Merchant websites, payment methods, or other third-party services. Third parties have their own terms and privacy practices; XLY does not control their content or data processing. We recommend reading the applicable third party's policies before submitting information.
13. Policy Updates and Contact Us
We may update this Policy to reflect changes in our services, laws, or data practices, and will update the effective date on this page. For material changes requiring notice by law, we will provide notice through reasonable means. Privacy contact: [email protected]; Phone: +1 4064405240; Registered in: Colorado, USA (Colorado Limited Liability Company, Entity ID #20261453307).
Close this page