Privacy Policy & Data Protection Pledge

The ApexPay No-Broker Guarantee

We pledge unequivocally that ApexPay Financial Technologies Inc. will NEVER sell, rent, monetize, trade, or distribute your email address, contact details, or financial transactional data to third-party data brokers, marketing syndicates, or advertising networks.

1 Data Minimization Principles

In adherence to the core tenets of the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), we collect only the minimum telemetry strictly required to deliver smart liquidity routing services:

Account Identity Information: Contact email address provided during private access activation or portal login.
Cryptographic Identifiers: Ephemeral OAuth tokens, public wallet or bank account routing references, and API tokens.
Device & Routing Telemetry: Anonymized IP addresses, browser fingerprinting attributes for automated fraud detection, and transaction timestamp logs.

2 Bank-Grade Cryptographic Architecture

Our cryptographic security model isolates all sensitive payload data from direct public network exposure:

In Transit: 256-Bit TLS 1.3

All client-to-server and API node communications are encrypted via modern TLS 1.3 ciphers with forward secrecy.

At Rest: AES-256-GCM Vaults

Datastores and routing ledger caches are encrypted with AES-256-GCM keys managed via FIPS 140-2 Level 3 hardware security modules.

3 Third-Party Subprocessors

To fulfill electronic transmissions and bank clearing, ApexPay utilizes SOC 2-audited cloud providers under formal Data Processing Addendums (DPAs):

Amazon Web Services (AWS SES / US-West): Authenticated mail delivery agents with dedicated IP addresses and strict DKIM enforcement.
Licensed Depository Institutions (Members FDIC): Payment card issuing, routing settlement, and fiat escrow transmission.
Plaid Inc.: Encrypted OAuth bank verification protocols.

4 Your Statutory Data Rights (GDPR & CCPA)

You possess full sovereignty over your personal data. You may at any time exercise:

Right to Access & Portability: Obtain a structured JSON/CSV export of all stored records associated with your account.
Right to Rectification: Request correction of inaccurate personal or banking routing data.
Right to Erasure ("Right to be Forgotten"): Request irreversible purging of all non-statutory records from our databases.
Right to Opt-Out: Immediate automated suppression from transactional announcements.

5 Contact Our Data Protection Officer (DPO)

For privacy inquiries, rights execution, or data deletion requests, contact our Compliance & Legal team directly at:

privacy@apexpay.io • dpo@apexpay.io

Written requests may also be dispatched to: ApexPay Financial Technologies Inc., Attn: Legal & Privacy Office, 500 Howard Street, Suite 400, San Francisco, CA 94105.