Privacy Policy

This Privacy Policy describes how BridgePoint Pay, Inc. ("BridgePoint," "we," "us," or "our") collects, uses, and protects information in connection with the BridgePoint Pay API and related services (the "Services"). BridgePoint's Services are provided exclusively to approved financial institutions, not to individual consumers.

1. Information We Collect

We collect information you provide during the onboarding process and through your use of the Services:

• Institution information: Bank name, routing number, contact email, and asset size provided during registration
• API credential data: Client ID and hashed Client Secret (we never store your plaintext secret)
• Transaction data: Account numbers, routing numbers, amounts, memos, and status for each payment processed through the API
• Access logs: IP addresses, timestamps, endpoints accessed, and authentication events for security and audit purposes
• Billing data: Fee amounts, transaction counts, and Stripe payment references

2. How We Use Information

We use the information we collect to:

• Process payment transactions through FedNow and RTP on your behalf
• Authenticate API requests and maintain account security
• Generate invoices and process billing
• Maintain audit logs as required for compliance purposes
• Detect and prevent fraud, abuse, and security incidents
• Communicate with you about your account and the Services
• Comply with applicable laws and regulatory requirements

3. Information Sharing

We do not sell your data. We share information only in the following circumstances:

• Payment processors: Transaction data is shared with Unit (our banking infrastructure provider) and the Federal Reserve (FedNow) or The Clearing House (RTP) as necessary to process payments
• Billing: Billing information is processed through Stripe, Inc. in accordance with Stripe's privacy policy
• Email delivery: Transactional emails are sent through Resend, Inc.
• Legal requirements: We may disclose information if required by law, subpoena, or regulatory request, or to protect the rights and safety of BridgePoint, our clients, or others

4. Data Security

We implement industry-standard security controls to protect your information:

• All data transmitted over HTTPS with TLS encryption
• Credentials stored using bcrypt hashing — plaintext secrets are never retained
• Rate limiting and brute-force protection on all authentication endpoints
• Full audit logging of all API calls and administrative actions
• Access to production systems restricted to authorized personnel

No security system is impenetrable. In the event of a data breach affecting your information, we will notify you as required by applicable law.

5. Data Retention

We retain your information for as long as your account is active and for a period of 90 days following account cancellation or termination. Transaction records may be retained longer where required by law or regulatory obligation. Audit logs are retained for a minimum of 7 years to satisfy BSA record-keeping requirements.

6. Your Rights

As a business customer, you may:

• Request a copy of the information we hold about your institution
• Request correction of inaccurate information
• Request deletion of your account and associated data, subject to our retention obligations
• Cancel your subscription at any time through the bank portal

To exercise these rights, contact us at hello@bridgepointpay.com.

7. GLBA Compliance

BridgePoint operates as a service provider to financial institutions and maintains information security controls consistent with the Gramm-Leach-Bliley Act Safeguards Rule. We maintain a written information security program and conduct periodic risk assessments of our systems.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

9. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us at hello@bridgepointpay.com.