Privacy Policy

Opttium ("we", "us") runs the merchant processing client portal (the "Service"). Merchants use it to send invoices and payment links, collect card, ACH, and cash payments, and store payment authorizations. Customers use it to pay invoices, save payment methods, and manage the authorizations they have signed.

This policy applies to:

• Merchants and their team members who hold a merchant desk.
• Customers who open a payment link, pay an invoice, sign an authorization, or create a customer account.
• Platform administrators and staff who operate the Service.

Each merchant is an independent business. When you pay a merchant through the Service, that merchant decides what to bill you and how to use your information for its own business. We process that information on the merchant's behalf, and the merchant's own privacy notice also applies.

Account information

Sign-in is handled by Clerk. You can sign up with an email address or with your Google account. When you create an account we receive your name, email address, email verification status, and profile image, and we record your portal role (merchant, customer, staff, or administrator). If you use Google sign-in, see Google user data below for exactly what we receive from Google and how we use it.

Merchant business information

Business name, logo, contact email, phone number, and address, plus the North payment gateway identifiers and API keys you enter. Gateway API keys are encrypted before they are stored.

Invoice information

Invoice number, the billed customer's name and email, amount, notes, status, and any invoice PDF the merchant uploads.

Payment information

Card and bank account numbers are typed into North's secure hosted fields and go directly to North. We do not receive or store full card numbers, security codes, or full bank account numbers. We keep what North returns so the payment can be shown and reconciled: a payment method token, card brand or bank name, last four digits, expiry date, account holder name, amount, processing fee, status, and North transaction references.

Authorization and consent records

When you sign a payment authorization we store the full agreement text you agreed to, your typed name and signature, email, the payment method summary, your IP address, browser user agent, and the time of signing (UTC). These records prove the authorization and are kept unchanged.

Communications

We send invoices, receipts, authorization requests, and account notices by email. We keep a log of each email sent, including the recipient, subject, content, and delivery status.

Activity and technical information

We record an audit trail of actions taken in the Service (for example, creating an invoice, recording a payment, or charging an authorization), including who performed the action and when. Our servers and providers also receive standard request data such as IP address, browser type, and timestamps.

If you choose "Continue with Google", Google shares a limited set of information from your Google account with us, only after you approve it on Google's consent screen.

What we access

We request only the basic sign-in permissions (openid, email, and profile). Through them we receive:

• Your name
• Your email address and whether Google has verified it
• Your profile picture
• A unique Google account identifier, used to recognize you when you sign in again

We do not access your Gmail, Google Drive, Calendar, Contacts, or any other Google service, and we never receive your Google password.

How we use it

• To create your account and sign you in.
• To show your name and profile picture in the portal.
• To match your email address to invoices, authorizations, or a merchant desk that was set up for that address, so you see the records that belong to you.
• To send you the account, invoice, and receipt emails described in this policy.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train artificial intelligence or machine learning models.

How we store and protect it

Your Google account identifier, name, email address, and profile picture are stored by Clerk, our sign-in provider. Your name and email address are also stored in our database with your account. Both are protected with the safeguards described in How we protect information, including encryption in transit.

How we share it

We do not share Google user data with third parties, except with the service providers that run the Service for us (Clerk for sign-in, and our hosting and database providers), or when required by law. Merchants you pay can see the name and email address on your account, as described in How we share information.

Keeping and deleting it

We keep this information while your account is open. You can ask us to delete your account and its Google user data at any time by emailing support@opttium.com; we delete it except for any payment or consent records we are legally required to keep. You can also remove Opttium's access to your Google account at any time at myaccount.google.com/connections.

Limited Use

Opttium's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Provide the Service: create accounts, send invoices and payment links, and show balances and history.
• Process payments and stored authorization charges through North, and calculate the fees shown at checkout.
• Send receipts, payment notifications, authorization requests, and account emails.
• Keep evidence of consent, resolve disputes and chargebacks, and reconcile payments.
• Secure the Service, prevent fraud and misuse, and investigate problems.
• Meet legal, tax, accounting, and payment network obligations.
• Improve and support the Service, and respond to your requests.

We do not sell personal information, and we do not share it for targeted advertising. We share it only as follows:

• Between merchants and their customers. A merchant sees the payments, authorizations, and saved payment method summaries (brand and last four digits) of its own customers. Customers see the merchant's business name, logo, and contact details.
• Platform administrators and assigned staff, who support merchants and operate the Service.
• Service providers that run parts of the Service for us under contract: North (payment processing and tokenization), Clerk (sign-in and account management), Amazon Web Services (file storage for logos and invoice PDFs), our email delivery provider, and our hosting and database providers.
• Legal and safety reasons, when required by law, legal process, or payment network rules, or to protect the rights, property, or safety of our users, the public, or us.
• Business transfers, if we are involved in a merger, acquisition, or sale of assets, subject to this policy.

We use cookies and local storage that are needed to keep you signed in and to secure your session. North's secure payment fields may set their own cookies to process payments. We do not use advertising cookies. You can block cookies in your browser, but sign-in and checkout will not work without them.

We keep information for as long as your account is active and as long as needed for the purposes in this policy. Payment, invoice, authorization, consent, and audit records are kept after an account closes for as long as payment network rules (including card network and Nacha rules for ACH authorizations), dispute windows, and tax and accounting laws require.

When information is no longer needed, we delete it or de-identify it. Removing a saved payment method or cancelling an authorization stops future use of it, but the history of past payments remains.

We use administrative, technical, and physical safeguards, including:

• Encrypted connections (HTTPS) for all traffic.
• Card and bank numbers entered only in North's secure hosted fields.
• Encryption of merchant gateway API keys at rest.
• Invoice PDFs that only the merchant, the billed customer, and authorized platform staff can open.
• Role-based access and an audit trail of sensitive actions.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us right away at support@opttium.com.

• Profile and business details: update them in your account or merchant settings.
• Saved payment methods and authorizations: customers can remove saved methods and cancel authorizations from their account. You can also ask the merchant to cancel an authorization.
• Access, correction, and deletion: depending on where you live, you may have the right to request a copy of your personal information, ask us to correct or delete it, or object to or limit certain uses. Email support@opttium.com. We will verify your identity before acting, and we may keep records we are legally required to retain.

If your information came to us from a merchant (for example, an invoice billed to you), we may refer your request to that merchant, since it controls that information. We will not discriminate against you for exercising your rights.

The Service is meant for adults and businesses. It is not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

The Service is operated in the United States, and our providers may process information in the United States and other countries. By using the Service you understand that your information may be processed outside the country where you live.

We may update this policy from time to time. We will change the effective date at the top of this page, and for material changes we will give notice in the Service or by email. Continuing to use the Service after a change takes effect means you accept the updated policy.

Questions or requests about this policy: support@opttium.com. For questions about an invoice or charge from a specific business, contact that merchant directly.