1. Who This Policy Covers
This policy applies to individuals (“you” or “cardholder”) who provide payment card details through a checkout form or payment widget powered by FloPay. These forms are embedded in websites and applications operated by merchants (“our clients”) who use FloPay’s payment infrastructure.
FloPay LLC (“FloPay”, “we”, or “us”) operates payment infrastructure on behalf of merchants. This policy explains how FloPay handles the card data you enter.
2. What Card Data We Store
Card data is collected through a secure hosted card form and handled by a PCI DSS-compliant third-party vault. The vault may securely store the following to enable future payments:
- Card number, which is replaced with a secure token before FloPay processes or stores it
- Card expiration date
- Card type and last four digits for display purposes
FloPay’s application database stores only tokens and limited display information, such as card type, expiration date, and the last four digits. The raw card number is not stored in FloPay’s database or in plain text.
We do not store your CVV/CVC security code. It is collected only for transaction authorization. It is not stored in FloPay’s database and is not retained by the vault after authorization. Retaining this code after authorization is prohibited under the Payment Card Industry Data Security Standard (PCI DSS).
3. Why Your Card Data Is Stored
FloPay handles stored card data as part of delivering our payment infrastructure services, which include:
- Completing your current transaction
- Enabling future purchases without re-entering your card details
- Facilitating subscriptions, installment plans, or recurring billing
We do not use your card data for our own marketing or share it with third parties for their own commercial purposes.
4. How We Protect Your Card Data
Card data collected through the secure hosted card form is handled by a PCI DSS-compliant third-party vault. FloPay stores only the resulting tokens and limited display information in its application database. The controls used to protect this data include:
- Card data is protected through encryption in transit and at rest
- Tokenization, which replaces your card number with a secure token before FloPay processes or stores it
- Access controls that limit who can query or use stored payment data
5. Legal Bases for Processing
| Jurisdiction | Legal Basis |
|---|---|
| EEA / UK / Switzerland | Contract performance (to fulfill your transaction); legitimate interests (fraud prevention and security) |
| California (CCPA/CPRA) | Disclosed in the merchant’s privacy notice; FloPay acts as a service provider and does not sell your data |
| Other US states | As required by applicable law |
6. How Long Your Card Is Stored
Your card data is retained for as long as necessary to deliver the service, or until:
- You request deletion (see Your Rights below)
- The merchant closes their account with FloPay
- The card expires and is removed from records
- Retention is no longer required under applicable law
7. Your Rights
Depending on where you are located, you may have rights over your card data. Requests should be directed to the merchant (the business you purchased from), who will coordinate with FloPay to fulfill them.
Rights may include:
- Access: request a copy of the card data held about you
- Deletion: request that your stored card be removed from the vault
- Correction: request correction of inaccurate data
- Portability (EEA/UK): receive your data in a structured, machine-readable format
- Objection (EEA/UK): object to processing based on legitimate interests
8. International Transfers
FloPay is based in the United States. If you are located in the EEA, UK, or Switzerland, your card data is transferred to the US under EU Standard Contractual Clauses (with the UK Addendum where applicable), supplemented by the security controls described in this policy.
9. Contact
For questions about this policy: hello@flopay.com.
To exercise your data rights, contact the merchant you purchased from.