Privacy Policy
Last updated: August 17, 2026
Effective: September 17, 2026
This Privacy Policy explains how PayWhirl, Inc. (“PayWhirl,” “we,” “us,” or “our”) processes Personal Data for our own business purposes and how we handle information for merchants using our subscription-management and billing software.
PayWhirl, Inc.
9452 Telephone Road #140
Ventura, California 93004, USA
team@paywhirl.com
1. Scope and our roles
This Policy applies to paywhirl.com, PayWhirl accounts and services, sales, marketing, support, recruiting, and other interactions that link to it. The services include PayWhirl's Multi-Platform application for BigCommerce and custom websites and its separate Shopify application.
PayWhirl provides software. Merchants connect and control their own Payment Provider accounts, remain the sellers and merchants of record for their Subscriber transactions, and decide why Subscriber information is processed.
PayWhirl generally acts in two different roles:
- For Merchant and website information: PayWhirl acts as a controller or business and decides how the information is used for account administration, support, security, billing, analytics, marketing, and company operations.
- For Merchant Subscriber information: The Merchant generally decides why and how its Subscriber data is processed. The Merchant is the controller or business and PayWhirl is its processor or service provider. Our Data Protection Addendum (“DPA”) governs this processing.
Subscribers should normally send privacy requests to the Merchant from whom they purchased or subscribed. We will assist Merchants as required by the DPA.
This Policy does not govern independent commerce platforms, Payment Providers, applications, AI providers, or websites selected by a Merchant or other user.
2. Information we process
Depending on the interaction and Service features used, we process:
- contact and account information, such as name, business, title, email, phone, address, username, role, permissions, and authentication events;
- Merchant and commercial information, such as plan, store URL, platform, products used, account status, invoices, lifetime revenue, communications, and support history;
- Subscriber, subscription, and order information, such as name, contact and address information, product, pricing, quantity, status, consent, cancellation, fulfillment, and communications;
- payment and transaction information, such as Payment Provider and token identifiers, payment type, last four digits, expiration information, billing address, amount, currency, status, timestamps, declines, refunds, disputes, and chargebacks;
- device, cookie, log, and usage information, such as IP address, browser, device, pages and features used, referring URL, identifiers, security events, diagnostics, and performance data;
- support and communication information, such as emails, chats, tickets, attachments, call or meeting content, recordings or transcripts where enabled, feedback, and surveys;
- marketing and preference information, such as communication choices, campaign interactions, events, advertising identifiers, and inferred interests;
- security and compliance information, such as access and risk signals, blocked activity, incidents, complaints, legal correspondence, and rights requests;
- applicant and workforce information, if collected during recruiting or employment; and
- AI-related information, such as prompts, files, retrieved context, generated output, feedback, logs, or other information submitted to an approved AI-enabled tool.
We collect this information from you; Merchants and Subscribers; PayWhirl websites and services; devices, cookies, and logs; commerce platforms; Payment Providers; integrations; support, analytics, marketing, and security providers; public sources; and other parties where permitted by law.
3. Payment information
For PayWhirl's Shopify application, Shopify controls checkout and full payment-credential handling. For Multi-Platform, PayWhirl widgets use Payment Provider-hosted fields or components, including services such as Stripe Elements and Spreedly. Full card numbers and card verification codes are intended to pass directly from the Subscriber's browser to the applicable PCI DSS-validated Payment Provider and not through PayWhirl servers.
PayWhirl does not receive full bank-account or routing numbers. PayWhirl receives tokens or provider identifiers and limited payment and transaction information needed to provide the Service. Do not submit full card numbers, card verification codes, bank-account or routing numbers, gateway credentials, passwords, or secrets through free-text, support, files, APIs, MCP connections, or AI tools. PayWhirl maintains PCI-related controls appropriate to its role and system scope.
4. How we use information
We process Personal Data to:
- provide, configure, secure, support, bill, and maintain our websites, accounts, and services;
- carry out Merchant instructions for subscriptions, orders, payments, communications, support, exports, and deletion;
- authenticate users, manage permissions, prevent fraud and misuse, and troubleshoot performance;
- communicate about accounts, support, security, products, changes, and our business relationship;
- process billing, accounting, tax, collections, reconciliation, and business records;
- analyze and improve our products, services, websites, support, and operations;
- market our services and measure campaigns, subject to consent and opt-out rights;
- manage sales, partners, events, recruiting, personnel, and corporate transactions;
- comply with law, lawful requests, sanctions, and contractual obligations; and
- investigate disputes, enforce agreements, and protect rights, safety, and security.
Where a legal basis is required, we rely on contract, legitimate interests, legal obligations, consent, and, in limited cases, vital or public interests. You may withdraw consent at any time without affecting earlier lawful processing.
5. Artificial intelligence and Merchant-authorized agents
PayWhirl may use AI-enabled service providers to assist with software development, support, analysis, security, and business operations. When an AI provider processes Personal Data for PayWhirl, it is treated like other service providers and is subject to applicable contractual and legal safeguards. AI providers that process Customer Personal Data on PayWhirl's behalf are identified as Subprocessors in the DPA.
PayWhirl may also offer Model Context Protocol (“MCP”) connections that let a Merchant authorize its own LLM, AI agent, or compatible client to access permitted account data and Service functions through PayWhirl APIs. The Merchant selects and controls that service. When a Merchant authorizes it, the Merchant instructs PayWhirl to disclose Customer Personal Data and process authenticated requests within the permissions granted. The Merchant is responsible for the provider, its notices and lawful basis, permissions, data use, retention, model practices, actions, and revocation.
PayWhirl may process MCP account, authorization, request, action, device, IP, security, and audit information to provide and protect the connection.
6. Cookies and advertising choices
We and our providers use cookies, pixels, local storage, and similar technologies for necessary functions, preferences, security, analytics, performance, support, advertising, campaign measurement, and remarketing. PayWhirl currently presents cookie choices on its marketing sites.
Current website technologies include Google Analytics on the Shopify marketing and documentation sites, Meta Pixel on the primary marketing site, Intercom support and help-center services, and Cloudflare security and traffic analytics. PayWhirl may use Google Ads and Meta services for advertising, campaign measurement, and remarketing. PayWhirl and Google may use first- and third-party cookies or similar identifiers together for these purposes. Learn how Google uses information from sites and apps that use its services and manage your Google advertising choices through Google Ads Settings. The services and identifiers used may differ by domain and can change.
PayWhirl may also use interaction analytics or session-replay services, including Hotjar or Microsoft Clarity, to understand how people use our interfaces and improve usability. When enabled, these services may collect page paths, clicks, scrolling, device/browser information, and recordings or reconstructions of interface activity. We use available masking or suppression controls designed to prevent collection of payment credentials, passwords, and sensitive field content.
Where required, nonessential technologies will not operate until consent is obtained. You can update available choices through the cookie-preference controls on the applicable website. Where applicable law requires PayWhirl to treat a recognized universal opt-out signal, such as Global Privacy Control, as a request, PayWhirl will do so.
We do not sell Personal Data for money. Our use of advertising, remarketing, or analytics services may be considered “sale,” “sharing,” or targeted advertising under some U.S. state privacy laws even without monetary payment.
Where applicable, you may opt out through available cookie-preference controls, a recognized preference signal, or by emailing team@paywhirl.com.
7. How we disclose information
We disclose Personal Data as reasonably necessary to:
- providers supporting hosting, infrastructure, communications, customer support, analytics, error/log monitoring, billing, security, professional services, and approved AI functions;
- Merchants for whom we process Subscriber, subscription, order, communication, and transaction data;
- commerce platforms, Payment Providers, and integrations used to provide or connect the Service;
- a Merchant-authorized AI agent or MCP client when the Merchant enables the connection;
- advertising and analytics partners, subject to applicable consent and opt-out rights;
- legal, accounting, audit, insurance, and other advisers;
- authorities or other parties where needed to comply with law, prevent harm, investigate fraud, or protect rights; and
- participants in a proposed or completed merger, financing, acquisition, reorganization, or sale, subject to appropriate safeguards.
The DPA identifies providers that process Customer Personal Data on PayWhirl's behalf. PayWhirl also uses providers for hosting, security, support, reporting, monitoring, communications, marketing, collaboration, payment connectivity, and AI-assisted operations. These include AWS, Cloudflare, Intercom, Metabase, Rollbar, Papertrail, Memetria, Mailgun, Mailchimp, Fireflies.ai, Slack, Notion, Trello, OpenAI, Anthropic, Cursor, and Spreedly. Payment Providers, commerce platforms, Merchant-selected applications, and Merchant-selected AI services may act independently and are not necessarily PayWhirl Subprocessors.
8. Retention and deletion
We retain Personal Data only as long as reasonably necessary for the purposes described above and for security, fraud, transaction, accounting, tax, support, legal, and dispute records. Retention depends on the data, relationship, instructions, system, legal requirements, sensitivity, and risk.
Merchants should export Customer Data during the post-termination period described in the Terms. After termination, deletion requests, or prolonged account inactivity, PayWhirl may delete or deidentify applicable data through its standard processes. We also respond to Shopify privacy-compliance requests as required by Shopify. Records held by a Merchant's connected Payment Provider remain with that provider.
Some information may remain for a limited time in backups, security records, legal holds, or systems governed by separate retention requirements. We retain such information only as permitted by law and protect it from unrelated use. The DPA provides additional terms for Customer Personal Data.
9. Security and access
We use administrative, technical, and organizational measures designed to protect Personal Data. Customer Personal Data is encrypted in transit, and production databases and backups containing Customer Personal Data are encrypted at rest. PayWhirl requires multi-factor authentication for company personnel, offers multi-factor authentication to users, limits access according to role and business need, removes access during offboarding, logs and monitors important security events, and maintains a security-incident response plan.
No system is completely secure, and these safeguards are not a warranty that an incident cannot occur. Contact team@paywhirl.com if you believe an account or information may be at risk.
10. Privacy rights
Depending on your location and applicable law, you may have rights to:
- access, correct, or delete Personal Data;
- receive a portable copy;
- obtain information about categories, sources, purposes, and recipients;
- restrict or object to processing or withdraw consent;
- opt out of sale, sharing, targeted advertising, or certain profiling;
- limit certain sensitive-data uses;
- request information or review concerning certain automated decisions;
- appeal a request decision; and
- receive nondiscriminatory treatment.
Submit a request by emailing team@paywhirl.com. We may verify identity and authority and apply lawful exceptions. An authorized agent may submit a request where permitted.
If we hold your information only for a Merchant, contact that Merchant first. We may route your request to the Merchant.
To appeal a decision, email team@paywhirl.com with “Privacy Appeal” in the subject. UK residents may use the same channel for a complaint; we will acknowledge a covered complaint within 30 days, investigate without undue delay, provide appropriate updates, and communicate the outcome. You may also complain to the UK Information Commissioner's Office or another applicable regulator.
11. U.S. state disclosures
Where a U.S. state privacy law applies, the categories collected and disclosed during the prior 12 months correspond to Section 2, the sources and uses to Sections 2 and 4, and recipient categories to Section 7.
California residents may have rights to know/access, correct, delete, opt out of sale/sharing, limit certain sensitive-information uses, receive information about applicable automated decisionmaking, and receive nondiscriminatory treatment. The former general employee and business-to-business exemptions expired and are not relied upon here.
Residents of other covered states may have similar rights, including appeals and opt-outs for targeted advertising, sale, profiling, and sensitive-data processing.
12. International transfers
PayWhirl is based in the United States and makes the Service available online without specifically marketing it in every country from which it may be accessed. Merchants and other users may nevertheless be located in the EEA, UK, Switzerland, Canada, Québec, and elsewhere. Personal Data may be processed in the United States and other countries where PayWhirl and approved providers operate. Where required, we use safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures.
13. Children
Our websites and services are intended for businesses and adults and are not directed to children under 13. Merchants must not use the Service to process children's Personal Data in violation of law or without special terms and controls approved by PayWhirl.
14. Changes and contact
We may update this Policy to reflect changes in our services, practices, or law. We will post the revised version with a new effective date and provide reasonable notice of material changes where required.
Questions, requests, and complaints may be submitted to:
PayWhirl, Inc.
Attn: Privacy
9452 Telephone Road #140
Ventura, California 93004, USA
team@paywhirl.com
Email is PayWhirl's current privacy-request and complaint channel.