YapPay

Privacy Policy

YapPay

Privacy Policy

Effective Date: October 16, 2026

Dubau Ventures, LLC, doing business as YapPay® (“YapPay,” “we,” “our,” or “us”), respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with our Services.

1. Scope of This Policy

This Policy applies to information processed through YapPay websites, merchant applications, portals, checkout interfaces, developer documentation, APIs, customer support, and related products and services.

These Services include payment processing, YapPay Gateway, YapPay Crypto, payment integrations, and access to eligible business banking services.

This Policy covers information about website visitors, merchant applicants, business owners, authorized representatives, account users, developers, and customers whose information we receive when facilitating a merchant’s payments.

Some services are provided through independent processing, banking, digital-asset, verification, or technology providers. Their privacy notices apply to information they process for their own purposes.

2. Information We Collect

The information collected depends on how you interact with YapPay, the services requested, and applicable verification requirements. Information may be collected by YapPay, submitted by a merchant, or collected directly by an applicable provider.

2.1 Contact and Business Information

We may collect:

Names, business names, and job titles.
Email addresses and telephone numbers.
Business and mailing addresses.
Business websites, industry information, and descriptions of products or services.
Information submitted through applications, forms, consultations, or support requests.
Communications sent through email, telephone, SMS, chat, or other support channels.

2.2 Application and Verification Information

Merchant processing, crypto, and banking applications may require:

Business registration and tax identification information.
Ownership, beneficial ownership, and authorized representative details.
Dates of birth and government-issued identification.
Bank account and settlement information.
Financial statements, processing statements, and supporting business records.
Information needed to evaluate eligibility, verify identity, or investigate discrepancies.
Verification results, application status, and compliance-review records.

Some documents may be submitted directly to a provider. YapPay may receive the resulting status or verification outcome without receiving the underlying documents.

If required verification information is not provided, the requested service may be unavailable, restricted, or delayed.

2.3 Payment and Transaction Information

Depending on the payment method and integration, we may process:

Transaction amounts, currencies, dates, and status.
Merchant, order, invoice, and payment reference identifiers.
Customer contact, billing, or shipping information submitted for a transaction.
Payment tokens, masked account details, and transaction authorization results.
Refund, dispute, chargeback, reconciliation, and settlement records.
Information needed to investigate a payment or provide support.

The card or bank information available to YapPay depends on the integration. Authorized payment providers may receive sensitive payment details directly.

2.4 Cryptocurrency and Blockchain Information

For YapPay Crypto, information may include:

Sending, receiving, refund, and settlement wallet addresses.
Blockchain transaction identifiers and related public transaction records.
Cryptocurrency assets, networks, amounts, and transaction timestamps.
Quotes, exchange rates, conversion records, fees, and payment status.
Confirmation, refund, withdrawal, and settlement information.
Wallet-address risk indicators, sanctions-screening results, and transaction-review outcomes.

A wallet address or transaction identifier may constitute personal information when it can be associated with an identifiable individual.

2.5 Account, Developer, and Technical Information

We may process:

Account identifiers, user roles, permissions, and authentication records.
API credential identifiers, access activity, and security events.
Request timestamps, response codes, integration errors, and webhook delivery records.
IP addresses, browser and device information, and operating systems.
Referring pages, pages viewed, interactions, and approximate location derived from an IP address.
Service performance, diagnostic, and fraud-prevention information.

Depending on the integration, technical records may contain merchant-submitted transaction references or other personal information. Developers should submit only information necessary for the integration.

2.6 Information From Other Sources

We may receive information from:

Merchants and their authorized representatives.
Payment processors, gateways, and financial institutions.
Digital-asset processing, conversion, custody, and settlement providers.
Identity-verification, business-information, fraud-prevention, and blockchain analytics providers.
Public business registries, sanctions lists, and public blockchains.
Technology, analytics, customer support, and customer relationship management providers.

3. How We Use Information

We use personal information as appropriate to:

Process applications and establish or administer accounts.
Facilitate payment acceptance, cryptocurrency transactions, conversion, refunds, and settlement.
Provide access to eligible banking services.
Verify identity, business details, and account authority.
Conduct or support underwriting, eligibility, and compliance reviews.
Screen transactions and wallet addresses for fraud, sanctions, and other risks.
Authenticate users, secure integrations, and investigate unauthorized activity.
Provide transaction reporting, reconciliation, and support.
Operate, troubleshoot, and improve our Services.
Send application, account, transaction, security, and service communications.
Send marketing communications where permitted.
Meet applicable legal obligations and provider requirements.
Resolve disputes and establish, exercise, or defend legal rights.

Legal Bases Where Applicable

Where applicable data-protection law requires a legal basis, we process information as necessary to perform a contract or take requested steps before entering one; comply with legal obligations; pursue legitimate interests such as security, fraud prevention, service administration, and improvement; or act with consent where required.

Where we rely on consent, you may withdraw it without affecting processing that occurred before withdrawal.

4. How We Disclose Information

We disclose information when reasonably necessary for the purposes described in this Policy.

Recipients may include:

Payment processors, gateways, acquiring banks, and sponsoring financial institutions.
Netevia and applicable banking-service providers.
Digital-asset processing, conversion, custody, wallet, and settlement providers.
Identity-verification, sanctions-screening, fraud-prevention, and blockchain analytics providers.
Hosting, infrastructure, authentication, communications, analytics, and support providers.
Merchants involved in the relevant transaction.
Professional advisers, auditors, and insurers.
Regulators, courts, government agencies, or law-enforcement authorities where required or permitted by law.
Parties involved in a proposed or completed financing, merger, acquisition, restructuring, or sale of business assets, subject to applicable protections.

We may also disclose information at your direction or with your consent.

YapPay does not sell personal information for monetary consideration. Certain advertising or tracking disclosures may fall within broader legal definitions of “sale” or “sharing.” Any applicable choices must reflect the technologies used on the relevant website or service.

5. Payment Processing and YapPay Gateway

YapPay provides payment processing and gateway services through its technology, white-label programs, and authorized payment partners.

Information may be exchanged with the applicable processor, gateway, financial institution, verification provider, and merchant as necessary to establish accounts, authorize payments, manage disputes, and provide settlement and reporting.

Sensitive payment information may be collected directly by an authorized payment provider. Access to a YapPay-branded interface does not necessarily mean YapPay receives every payment credential or document submitted through that interface.

Merchants remain responsible for their own privacy notices, customer disclosures, and applicable payment-security obligations.

6. YapPay Crypto

YapPay Crypto uses applicable digital-asset and technology providers to facilitate supported cryptocurrency payments and related services.

Relevant information may be shared to verify merchants, create payment instructions, monitor transactions, perform screening, confirm payments, facilitate conversion and settlement, and process eligible refunds.

Public Blockchain Records

Transactions recorded on public blockchains may be visible to anyone. Public records can include wallet addresses, transaction identifiers, amounts, timestamps, and other network data.

These records may be traceable and may allow third parties to associate transactions with other information. Cryptocurrency payments should not be assumed to be anonymous.

YapPay generally cannot change or delete records on public blockchains. Closing an account or requesting deletion of information held by YapPay does not remove the underlying blockchain records.

Provider Verification and Privacy Notices

Digital-asset providers may collect information directly and maintain their own verification, compliance, and transaction records. Their privacy notices and applicable legal obligations govern that processing.

Additional notices may be presented during verification or when specific features are enabled.

7. Access to Netevia Banking Services

YapPay provides access to Netevia Banking Services as an Authorized Certified Banking Agent of Netevia.

Application, identity, business, and account information may be shared with Netevia and applicable banking or financial-services providers to evaluate eligibility and establish, service, or support requested products.

Those providers may collect information directly and process it under their own privacy notices and account agreements.

YapPay is not a bank and does not itself accept deposits or provide deposit accounts or banking services.

8. Merchant and Customer Information

A merchant may determine why customer information is collected and how it is used within its business. In those circumstances, YapPay may process information on the merchant’s behalf under the applicable agreement.

YapPay may separately process information for its own account administration, security, fraud-prevention, compliance, and legal purposes. Independent providers may also have their own responsibilities.

If your request concerns information controlled by a merchant, contact that merchant. We will assist with requests involving information processed on a merchant’s behalf as required by law and our agreements.

Merchants must have the necessary authority to submit personal information through YapPay and provide applicable notices to their customers.

9. Cookies and Similar Technologies

Our Services may use cookies, pixels, local storage, and similar technologies for functionality, authentication, preferences, security, analytics, and permitted marketing.

Where required, non-essential technologies are subject to consent or other applicable privacy choices.

You can manage available preferences through the relevant website controls and your browser settings. Blocking certain technologies may affect functionality.

Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, that signal must be honored for the processing to which it applies. Traditional “Do Not Track” signals are different and may not receive the same response.

10. Communications

We may send application updates, payment notices, account messages, support responses, security alerts, and other operational communications.

Marketing communications are subject to applicable consent and opt-out requirements. You can unsubscribe from promotional emails using the mechanism provided or contact us for assistance.

Opting out of marketing does not stop necessary transactional, security, account-related, or legally required messages. Providing contact details does not by itself constitute consent to every form of marketing.

11. Artificial Intelligence and Automated Tools

We may use AI-assisted support, virtual assistants, and automation to answer questions, route inquiries, schedule appointments, and support service operations. Information submitted through these tools may be processed by technology providers supporting them.

Automated security and risk tools may evaluate account activity, transaction patterns, verification results, or wallet-risk indicators. Results may lead to additional verification, review, restrictions, or a declined transaction.

Where applicable law provides rights concerning decisions based solely on automated processing, you may contact us to exercise those rights. Relevant provider notices may explain decisions made independently by those providers.

Do not submit wallet recovery phrases, private keys, passwords, or unrestricted API secrets through general chat or support channels.

12. Data Retention

We retain information for as long as reasonably necessary to provide services, administer accounts, maintain required records, investigate fraud, resolve disputes, and meet legal and contractual obligations.

Retention periods depend on the information’s sensitivity, purpose, applicable requirements, and whether continued retention is necessary. Closing an account does not necessarily require immediate deletion of all records.

Independent providers may retain their own records under separate requirements. Public blockchain records are outside YapPay’s deletion controls.

13. International Processing

YapPay is a United States business. Information may be processed in the United States and other countries where YapPay or its providers operate.

Those countries may have different data-protection laws. Where applicable law requires a transfer mechanism or additional safeguards, transfers must be supported by an appropriate legal arrangement.

Contact us for information about the arrangements applicable to your information and how to obtain details of relevant safeguards.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

Access personal information and obtain a copy.
Correct inaccurate information.
Request deletion, subject to exceptions.
Obtain information about collection, use, and disclosure.
Restrict processing or receive information in a portable format.
Withdraw consent where processing relies on consent.
Opt out of certain sales, sharing, targeted advertising, or profiling.
Appeal a privacy-request decision where available.
Lodge a complaint with the appropriate data-protection authority.

You may also have the right to object to processing based on legitimate interests and to the use of your information for direct marketing.

Submit requests using the contact details below. We may verify your identity and authority before responding. Authorized agents may submit requests where permitted, subject to verification requirements.

Rights are subject to applicable exceptions, including financial-record retention, fraud prevention, legal obligations, and information controlled by another organization. We will explain applicable limitations when responding.

We will not unlawfully discriminate against you for exercising privacy rights.

15. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information. Measures may include access controls, authentication, encryption, monitoring, and secure infrastructure, depending on the system and information involved.

No transmission, storage system, or security measure can guarantee absolute protection.

Users must protect their credentials, limit access to authorized individuals, and promptly report suspected unauthorized activity.

16. Third-Party Services

Our Services may link to or integrate with independently operated websites, verification tools, payment interfaces, banking applications, and other services.

Their privacy practices are governed by their own notices. Review applicable notices before submitting information directly to those providers.

17. Children’s Privacy

Our Services are intended for businesses and adults and are not directed to children under 13.

We do not knowingly collect personal information from children under 13. If you believe a child has provided information through our Services, contact us so we can investigate and take appropriate action.

18. Changes to This Policy

We may update this Policy to reflect changes in our Services, practices, technology, or legal requirements.

We will publish the revised Policy and update its effective date. Where required, we will provide additional notice or obtain consent before implementing material changes.