Privacy Policy

This Privacy Policy describes how BridgePoint Pay, Inc. ("BridgePoint," "we," "us," or "our") collects, uses, and protects information in connection with the BridgePoint Pay platform and related services (the "Services"). BridgePoint's Services are provided to approved service businesses, including staffing agencies, commercial cleaning companies, freight brokers, home services franchises, and similar companies operating in the United States.

1. Information We Collect

We collect information you provide during onboarding and through your use of the Services:

• Business information: Business name, EIN, industry type, contact email, phone number, and address provided during registration
• Account credentials: Client ID and hashed Client Secret (we never store your plaintext secret)
• Transaction data: Account numbers, routing numbers, amounts, memos, payment rails used, and status for each payment processed through the platform
• Access logs: IP addresses, timestamps, endpoints accessed, and authentication events for security and audit purposes
• Billing data: Fee amounts, transaction counts, and ACH debit transaction references
• Communications: Emails and messages you send to us

2. How We Use Information

We use the information we collect to:

• Process payment transactions through FedNow and RTP on your behalf
• Authenticate API requests and maintain account security
• Generate invoices and process billing
• Maintain audit logs as required for compliance purposes
• Detect and prevent fraud, abuse, and security incidents
• Conduct OFAC sanctions screening and BSA/AML compliance checks
• Communicate with you about your account and the Services
• Comply with applicable laws and regulatory requirements
• Improve the Services

3. Information Sharing

We do not sell your data. We share information only in the following circumstances:

• Payment infrastructure: Transaction data is shared with our payment infrastructure partners and their financial institution partners, the Federal Reserve (FedNow), and The Clearing House (RTP), as necessary to process payments
• Billing: Platform fees are collected via ACH debit through our payment infrastructure partners in accordance with their applicable privacy policies
• Email delivery: Transactional emails are sent through Resend, Inc.
• Legal requirements: We may disclose information if required by law, subpoena, or regulatory request, including requests from FinCEN, the CFPB, or other regulators, or to protect the rights and safety of BridgePoint, our clients, or others
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

4. Data Security

We implement industry-standard security controls to protect your information:

• All data transmitted over HTTPS with TLS 1.2+ encryption
• Credentials stored using bcrypt hashing — plaintext secrets are never retained
• JWT authentication with short-lived tokens
• Rate limiting and brute-force protection on all authentication endpoints
• Full audit logging of all API calls and administrative actions
• Access to production systems restricted to authorized personnel only
• 256-bit AES encryption for sensitive data at rest

No security system is impenetrable. In the event of a data breach affecting your information, we will notify you as required by applicable law.

5. Cookies and Tracking

Our website uses cookies and similar technologies to operate core functionality, remember your preferences, and analyze how visitors use our site. We use the following types of cookies:

• Strictly necessary cookies: Required for authentication and core platform functionality. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our website. You may decline these using the cookie banner on our site.

You can control cookie preferences through your browser settings or through the consent banner displayed when you first visit our site. Declining non-essential cookies will not affect your ability to use the platform.

6. Data Retention

We retain your information for as long as your account is active and for a period of 90 days following account cancellation or termination. Transaction records may be retained longer where required by law or regulatory obligation. Audit logs are retained for a minimum of 7 years to satisfy BSA record-keeping requirements.

7. Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Access: Request a copy of the information we hold about you or your business
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and associated data, subject to our legal retention obligations
• Opt-out of sale: We do not sell personal information. No opt-out is required.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights

Residents of California, Virginia, Colorado, Connecticut, and Utah may have additional rights under their state privacy laws. To exercise any of these rights, contact us at hello@bridgepointpay.com. We will respond within 45 days.

8. California Privacy Rights (CCPA/CPRA)

California residents have the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. BridgePoint does not sell or share personal information as defined under the CCPA/CPRA. To submit a verifiable consumer request, contact us at hello@bridgepointpay.com.

9. GLBA Compliance

BridgePoint operates as a service provider to businesses and maintains information security controls consistent with the Gramm-Leach-Bliley Act Safeguards Rule. We maintain a written information security program and conduct periodic risk assessments of our systems.

10. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at hello@bridgepointpay.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy. The current version is always available at bridgepointpay.com/privacy.

12. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us at:

BridgePoint Pay, Inc.
hello@bridgepointpay.com
(208) 724-1889