Privacy Policy
At QuikyPay, we are committed to protecting your personal information and that of your customers. This policy explains what data we collect, how we use it, and how we protect it, in accordance with applicable U.S. federal and state privacy laws.
Version 1.0
Effective since: June 2025
Governing law: State of Delaware, USA
1. Data controller
The party responsible for processing personal data is:
- Legal name: QuikyPay
- Trade name: QuikyPay
- Country: United States (Delaware)
- Privacy email: privacidad@quikypay.com
- General email: info@quikypay.com
2. Data we collect
2.1 Business data (QuikyPay users)
- Identification: Tax ID/EIN, legal name, trade name, registration number
- Contact: representative's name, email address, phone number
- Financial data: billing information, payment history
- Access credentials: email and encrypted password
- Usage data: actions taken on the platform, access logs
2.2 End Customer data (the business's customers)
- Identification: full name, email address, phone number
- Payment data: last 4 digits of the card, payment token (NOT the full card number)
- Transaction and subscription history
2.3 Technical data
- IP address, browser type, operating system
- Activity logs for security and auditing
- Session and preference cookies
🔐 QuikyPay never stores full credit card numbers. Payment data is tokenized by Wompi under PCI DSS Level 1.
3. Purpose of processing
We process your personal data for the following purposes:
- Service delivery: operating the platform, processing payments, and managing subscriptions
- Billing: charging SaaS plans and generating invoices
- Communications: sending payment notifications, alerts, and support messages
- Security: detecting fraud, preventing unauthorized access, and auditing activity
- Legal compliance: responding to requests from competent authorities
- Service improvement: analyzing platform usage to improve features
4. Legal basis for processing
We process personal data under the following bases:
- Consent: obtained by accepting these terms during registration
- Contract performance: necessary to provide the contracted service
- Legal obligation: compliance with tax, AML, and regulatory legislation
- Legitimate interest: platform security and fraud prevention
5. Sharing data with third parties
We share data with the following trusted third parties:
- Payment processors (Wompi, Fiserv, NMI): to process card payments, depending on the Business's configuration. Each processor's own terms apply to the payment data they handle.
- Amazon Web Services (AWS): hosting and storage infrastructure
- Email providers: to send transactional notifications
- Competent authorities: when required by law or court order
We do not sell, rent, or share personal data for commercial purposes with unauthorized third parties.
6. Data security
We implement technical and organizational measures to protect your data:
- Encryption in transit: TLS 1.2/1.3 across all communications
- Encryption at rest: AES-256 for sensitive data (API keys, credentials)
- PCI DSS Level 1: compliance for handling card data
- Authentication: passwords encrypted with bcrypt, secure sessions
- Monitoring: real-time detection of suspicious activity
- Infrastructure: servers on AWS with geographic redundancy
- Restricted access: only authorized personnel can access sensitive data
7. Data retention
- Active account data: for the entire duration of the contractual relationship
- Transaction data: 7 years, due to tax and legal obligations
- Access logs: 1 year, for security reasons
- Cancelled account data: an additional 2 years after cancellation
After these periods, data is securely deleted or anonymized.
8. Your rights
Depending on your state of residence, you may have the following rights over your personal data, including rights available to California residents under the CCPA/CPRA:
✅ Access
Request a copy of the data we hold about you
✏️ Rectification
Correct inaccurate or incomplete data
🗑️ Erasure
Request deletion of your data when it is no longer necessary
⏸️ Restriction
Restrict processing in certain circumstances
📦 Portability
Receive your data in a structured, readable format
🚫 Objection
Object to processing based on legitimate interest
To exercise any of these rights, write to us at privacidad@quikypay.com. We will respond within a maximum of 30 business days.
9. Cookies
We use cookies that are strictly necessary for the platform to function:
- Session cookie: to keep you authenticated during your visit
- CSRF cookie: to protect against request forgery attacks
We do not use advertising tracking cookies or share browsing data with advertising networks.
10. Minors
QuikyPay is intended exclusively for people 18 years of age or older. In accordance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect data from children under 13. If we identify that a minor has provided data, we will delete it immediately.
11. Changes to this policy
We may update this policy periodically. Material changes will be notified by email at least 15 days in advance. The "last updated" date at the top of the document indicates when it was last revised.
Privacy Policy