Privacy Policy

1. About This Policy

This Privacy Policy describes how VerifyLive LLC (“VerifyLive,” “we,” “us,” or “our”), a limited liability company organized under the laws of Illinois, United States, with offices at 119 S Western Ave Unit 1, Chicago, Illinois 60612, processes personal data in connection with the VerifyLive Transaction Trust Platform (the “Service”).

VerifyLive acts in two distinct capacities when processing personal data. When VerifyLive processes personal data on behalf of a merchant (for example, when we score a transaction or an order on the merchant’s request), we act as a processor (or service provider under U.S. state privacy law), and the merchant is the controller. Those activities are governed by the VerifyLive Data Processing Addendum at verifylive.net/legal/dpa (the “DPA”) and this Policy supplements the DPA.

When VerifyLive processes personal data for fraud-prevention, security, network-threat-intelligence, product-improvement (including model training), corporate operations, marketing, and legal-compliance purposes, we act as an independent controller. This Policy describes that processing and the rights available to the individuals whose data we process.

2. Who This Policy Covers

This Policy applies to individuals whose personal data we process, including:

• Visitors to verifylive.net and to our other websites and product surfaces.
• End consumers of merchants that use the Service (for example, a shopper checking out on a merchant’s online store that is protected by VerifyLive).
• Representatives of merchants and prospective merchants that interact with our sales, onboarding, and support teams.
• Job applicants, event attendees, and other business contacts.

3. Categories of Personal Data We Process

3.1 Information You Provide

• Identity information such as name, business name, email address, and phone number.
• Commercial information such as billing address, payment-method metadata (tokenized — we do not store full card numbers), subscription plan, and transaction history.
• Communications content such as support tickets, sales conversations, and responses to surveys.

3.2 Information We Collect Automatically

• Device and network data such as IP address, device fingerprint signals, operating system, browser type, and referring URL.
• Behavioral signals such as mouse-movement patterns, typing cadence, session timing, navigation paths, and touch gestures. These signals are used for bot detection and behavioral-biometrics fraud scoring. Under the California Consumer Privacy Act (CCPA/CPRA), these behavioral signals may constitute Sensitive Personal Information when used for fraud-scoring. California residents may exercise the right to limit use of Sensitive Personal Information as described in Section 7. Raw behavioral signals are de-identified within thirty (30) days of collection (see Section 8).
• Transaction signals such as order value, shipping-address/billing-address alignment, issuing-bank risk, geolocation risk, velocity across merchants, and card-brand metadata.
• Cookie and similar-technology data as described in Section 9 below.

3.3 Information We Receive from Third Parties

• Data from commerce platforms (for example, Shopify and Square) when a merchant installs the Service.
• Data from fraud-intelligence partners (for example, IP-geolocation providers) that contribute risk signals to the Service.
• Data from payment-network partners regarding chargebacks, disputes, and settlement outcomes.
• Publicly available business data from enrichment providers used to research prospective merchants.

3.4 Categories We Do Not Process

VerifyLive does not receive, process, or store full primary account numbers, card verification values (CVV/CVC), card expiration dates, PINs, or Social Security Numbers through the Service. The Service operates on tokenized payment metadata only.

4. Purposes of Processing and Legal Bases

We process personal data for the purposes and legal bases below. Where we rely on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

4.1 Providing the Service

Purpose: operating and delivering the Service to merchants, including fraud-scoring, bot detection, behavioral-biometrics analysis, delivery-risk scoring, and age verification. Legal basis (GDPR): performance of the contract with the merchant (Art. 6(1)(b)); our legitimate interest and the merchant’s legitimate interest in fraud prevention (Art. 6(1)(f)).

4.2 Security and Fraud Prevention

Purpose: detecting, investigating, and preventing fraud, abuse, and security threats across the VerifyLive network. Legal basis (GDPR): legitimate interest in preventing fraud and protecting our merchants and the broader network (Art. 6(1)(f)).

4.3 Model Training and Product Improvement

Purpose: training, refining, and evaluating the proprietary fraud-detection models that power the Service, using transaction metadata, device signals, behavioral signals, and labeled fraud outcomes. Where feasible, we process aggregated and de-identified data for these purposes. Legal basis (GDPR): legitimate interest in improving the Service (Art. 6(1)(f)), subject to appropriate safeguards.

4.4 Billing and Account Administration

Purpose: invoicing, collecting payments, producing financial records, and administering subscriptions. Legal basis (GDPR): performance of the contract (Art. 6(1)(b)); compliance with tax and financial-reporting obligations (Art. 6(1)(c)).

4.5 Support and Communications

Purpose: responding to questions, providing technical support, and communicating service announcements. Legal basis (GDPR): performance of the contract (Art. 6(1)(b)); legitimate interest in supporting merchants (Art. 6(1)(f)).

4.6 Marketing

Purpose: sending newsletters, product updates, and event invitations to business contacts. Legal basis (GDPR): consent where required (Art. 6(1)(a)); legitimate interest in marketing our services to existing business contacts (Art. 6(1)(f)). You may unsubscribe at any time via the link in any marketing email or by contacting [email protected].

4.7 Legal Compliance and Protection of Rights

Purpose: complying with legal obligations, responding to valid law-enforcement requests, protecting rights and property, and defending legal claims. Legal basis (GDPR): compliance with legal obligation (Art. 6(1)(c)); legitimate interest in protecting rights (Art. 6(1)(f)).

5. How We Share Personal Data

We share personal data with the following categories of recipients:

• Merchants — when we act as processor, we return scoring results and related signals to the merchant who requested them.
• Sub-processors — infrastructure and service providers that process personal data on our behalf. The current list is published at verifylive.net/legal/subprocessors. Sub-processors are bound by contracts that impose data-protection obligations substantially similar to those in our DPA.
• Payment and platform partners — Stripe Connect (settlement), Shopify, Block/Square (platform integrations), and similar partners as required to deliver the Service.
• Professional advisors — lawyers, auditors, accountants, and insurance brokers under obligations of confidentiality.
• Law-enforcement and regulatory authorities — when required to comply with valid legal process or to protect rights, property, or safety.
• Successors — in the event of a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred to the successor entity subject to this Policy.

We do not sell personal data within the meaning of the CCPA/CPRA, and we do not share personal data for cross-context behavioral advertising.

6. International Data Transfers

VerifyLive is based in the United States. Personal data we process may be transferred to, stored in, and processed in the United States and other jurisdictions where we or our sub-processors operate. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a jurisdiction that has not received an adequacy decision, we rely on appropriate safeguards, including:

• EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
• The UK International Data Transfer Addendum issued by the Information Commissioner’s Office.
• Recognition of the Swiss FADP under the additional safeguards described in the DPA.

Copies of the applicable transfer mechanisms are available at verifylive.net/legal/dpa or on request to [email protected].

7. Your Rights

Depending on your location, you may have some or all of the following rights with respect to your personal data. We will respond to verified requests within the timeframes required by applicable law (typically thirty (30) days under GDPR, forty-five (45) days under CCPA/CPRA, subject to permitted extensions).

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete personal data, subject to exceptions for legal, accounting, security, fraud-prevention, and similar reasons.
• Portability — receive certain categories of data in a structured, commonly-used, machine-readable format.
• Restriction and Objection — restrict or object to certain processing based on our legitimate interests.
• Withdraw Consent — withdraw consent where we rely on consent as the legal basis for processing.
• Non-discrimination — exercise these rights without suffering discriminatory treatment under applicable law.
• Lodge a Complaint — contact the data-protection authority in your jurisdiction.

To exercise these rights, contact [email protected]. If you are a consumer of a merchant that uses the Service, the merchant is typically the controller of your data, and you should direct your request to them first; we will support the merchant in responding in accordance with our DPA.

Right to Limit Use of Sensitive Personal Information (CCPA/CPRA — security exemption). To the extent that behavioral signals or other categories of Sensitive Personal Information described in this Policy are processed solely to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activity, VerifyLive relies on the security and integrity exemption set forth in Cal. Civ. Code § 1798.140(e)(8) and § 1798.121(b). The right to limit the use of Sensitive Personal Information under § 1798.121(a) does not apply to processing necessary for these security and fraud-prevention purposes. California residents retain the right to limit any processing of Sensitive Personal Information that is NOT necessary for security and fraud prevention, and may submit such a request via [email protected].

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, to comply with legal, accounting, and reporting obligations, to resolve disputes, and to enforce agreements. Typical retention periods:

• Merchant account records — for the duration of the relationship and seven (7) years thereafter for tax and accounting purposes.
• Transaction scoring data — up to twenty-four (24) months, after which the data is aggregated and de-identified for continued model-training use.
• Raw behavioral signals (keystroke cadence statistics, mouse and touch path summaries) — de-identified within thirty (30) days of collection. After de-identification, only aggregated, non-identifying derivatives are retained for fraud-scoring model performance evaluation.
• Email, IP, and device-signal records used for fraud detection — up to thirteen (13) months, after which the data is aggregated.
• Support communications — up to thirty-six (36) months.
• Marketing-suppression records — retained indefinitely to honor unsubscribe preferences.
• Logs and security data (including audit-ledger entries maintained to support our PCI-DSS alignment and SOC 2 readiness program) — up to thirteen (13) months for general security logs; up to seven (7) years for audit-ledger entries required by PCI-DSS Requirement 10. Logs may be retained beyond these windows as required for active investigations.

Where feasible, we aggregate or de-identify data at the end of the applicable retention period rather than deleting it, as further described in the DPA.

9. Cookies and Similar Technologies

We and our service providers use cookies, pixels, device identifiers, and similar technologies on our websites and within the Service for the following purposes:

• Strictly necessary — authentication, session management, load balancing, and fraud-prevention. These cannot be disabled without affecting core site function.
• Analytics — understanding how visitors use our sites, measuring traffic, and improving performance.
• Preferences — remembering your language and display preferences.
• Behavioral-signal collection — collecting the behavioral-biometrics signals described in Section 3.2 when the Service is embedded in a merchant’s checkout or POS flow.

You can manage cookie preferences through the cookie banner on our websites and through your browser settings. We do not use cookies for cross-context behavioral advertising.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, use, alteration, and disclosure. Safeguards include encryption in transit and at rest, role-based access controls, multi-factor authentication, audit logging, secrets management, secure-development-lifecycle practices, and a written information-security program. A summary of our safeguards is published in Annex II of the DPA. Additional information is available in the Trust Center at verifylive.net/trust.

No security program is perfect. If you become aware of a suspected breach or vulnerability affecting VerifyLive, please report it to [email protected].

11. Children

The Service is not directed to children under the age of thirteen (13), or the minimum age of digital consent in the user’s jurisdiction, whichever is higher. We do not knowingly collect personal data from children. If we learn we have collected such data, we will delete it. Parents and guardians with concerns may contact [email protected].

12. California Privacy Notice

This section supplements this Policy for California residents under the CCPA/CPRA. The categories of personal information we collect, the sources, the purposes, and the categories of recipients are described in Sections 3, 4, and 5 above. We retain personal information as described in Section 8.

California residents may exercise rights to know, delete, correct, and limit use of sensitive personal information, as described in Section 7. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly collect personal information from California residents under the age of sixteen (16) for sale or sharing.

To submit a verifiable consumer request, contact [email protected]. You may designate an authorized agent to make a request on your behalf.

13. Changes to This Policy

We may update this Policy from time to time. The effective date of the current Policy appears at the top of this document and on the Privacy Policy page at verifylive.net/legal/privacy. Material changes will be communicated by email to registered merchants or by a prominent notice on our website at least thirty (30) days before the change takes effect, except where a shorter period is required by applicable law.

14. Contact Us

For questions, complaints, or to exercise your rights under this Policy, contact:

VerifyLive LLC — Attn: Privacy

119 S Western Ave Unit 1, Chicago, Illinois 60612, United States

Email: [email protected]

Data Protection Officer inquiries: [email protected]

If you reside in the European Economic Area or the United Kingdom, you may also lodge a complaint with your local data-protection authority.