Privacy Policy

Effective date: 15 August 2026

This Privacy Policy explains how Orchestrapay, LLC ("Orchestrapay", "we", "us") collects, uses, shares and protects personal data. Orchestrapay operates a payment orchestration platform that lets merchants connect to multiple payment gateways and methods through a single integration. Our mailing address is 28 Geary St, Suite 650 #352, San Francisco, CA 94108, United States.

1. Our role: controller and processor

For the personal data of our own business users (the merchant representatives who create and administer Orchestrapay accounts) and visitors to our website, Orchestrapay acts as a data controller. When we process payment and cardholder data to deliver payment services on behalf of a merchant, Orchestrapay acts as a data processor (or service provider), and the merchant is the controller responsible for the end-customer relationship. This policy describes both roles; where we act as a processor, our handling is also governed by our Data Processing Addendum and our agreement with the merchant.

2. Data we collect

Business account data (we are controller)

  • Names, work email addresses, phone numbers, and business details of the merchant representatives who use the Orchestrapay dashboard;
  • Login credentials (stored only as a salted hash), multi-factor authentication secrets (stored encrypted), session identifiers and API keys;
  • Onboarding information a merchant provides about its business (for example company website, country, expected volume and current processors), together with the IP address and approximate location captured at sign-up.

Payment, cardholder and end-customer data (we are processor)

When a merchant routes a transaction through us, we process the data needed to complete and secure that payment, which can include:

  • the payment card primary account number (PAN), card brand, expiry, a token, and the last four digits (the PAN is stored encrypted; the card verification value / CVV is used transiently and is not retained after authorization);
  • the cardholder or payer's name, email, phone number and billing address (including address-verification data);
  • bank account and mobile-money details, and, for certain buy-now-pay-later or local payment methods, additional identifiers a method requires (which may include a national identification number);
  • transaction amounts, currencies, line items, timestamps, gateway references and status; and
  • the payer's IP address and the approximate location (including latitude/longitude) derived from it, used for routing, fraud prevention and network compliance.

The scope of end-customer data we receive is determined by the merchant and the payment method used. We handle it on the merchant's instructions and as a payment service provider under the PCI DSS (see section 6).

Technical, usage and security data

  • IP address, device and browser information, and log/telemetry data generated when you use our website, dashboard, hosted checkout or APIs;
  • security and audit records (including IP address and user-agent) that we keep for account-security events such as logins, MFA changes and administrative actions; and
  • limited, masked session-replay recordings of our own web pages, sampled for diagnosing errors (see section 11).

3. How we use personal data

We use personal data to:

  • provide, operate and secure the payment orchestration platform and route transactions to the appropriate gateways;
  • authenticate users, manage accounts and provide support;
  • detect, prevent and investigate fraud, abuse and security incidents;
  • comply with legal, regulatory and payment-network obligations (including anti-money-laundering and PCI DSS requirements); and
  • maintain, improve and develop our services.

Where the EU/UK GDPR applies, our legal bases are performance of a contract, compliance with a legal obligation, and our legitimate interests in operating and securing the service (balanced against your rights), and consent where required (for example, certain cookies).

4. Sharing and sub-processors

We share personal data only as needed to deliver the service, and we do not sell it. Recipients fall into these categories:

  • Payment gateways, acquirers and payment-method providers that a merchant routes to (for example Stripe, Adyen, Checkout.com, PayPal, Paymob, Fawry and other licensed processors), to execute the transaction;
  • Cloud, hosting and infrastructure providers that run the platform;
  • Operational service providers for email, error tracking, and fraud/BIN and IP lookups;
  • Authorities, auditors and professional advisors where required by law or regulation, for PCI DSS assessment, or to establish, exercise or defend legal claims.

Our sub-processors are bound by contractual data-protection and security obligations. Because this list changes from time to time as our service evolves, we maintain it separately, with its own effective date, on our Sub-processors page. That page is the current, authoritative list of the sub-processors we use to provide the platform.

5. Data residency and international transfers

Orchestrapay operates in multiple regions and pins data to the region in which it is created. Depending on the merchant and payment method, personal data may be stored and processed in the United States, the European Union, or Egypt, and may be transmitted to payment providers located elsewhere. Where personal data is transferred across borders, including to countries that may not provide the same level of protection as your own, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) together with technical measures such as encryption.

6. Cardholder data and PCI DSS

Orchestrapay is assessed against the Payment Card Industry Data Security Standard (PCI DSS). Cardholder data is encrypted in transit (TLS 1.2 or higher) and at rest, access is restricted on a least-privilege basis with multi-factor authentication, and access is logged. Sensitive authentication data (such as the card verification value) is not retained after authorization. We process cardholder data solely to provide payment services and in line with the applicable payment-brand rules.

7. Data retention

We retain personal data only as long as necessary for the purposes described here and to meet legal, tax, accounting and payment-network record-keeping obligations, after which it is deleted or irreversibly anonymized. Transaction and audit records are retained for the periods required by applicable law and PCI DSS. Where we act as a processor, retention is also governed by our agreement with the merchant.

8. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption, network segmentation, access controls, continuous monitoring, vulnerability management and an incident-response program. No method of transmission or storage is completely secure, but we work to protect personal data and to notify affected parties and regulators of incidents as required by law.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Where we process data on a merchant's behalf (processor role), please direct requests to that merchant; we will assist them as required. To exercise rights for data we control, contact us using section 12. You also have the right to complain to your local data-protection authority.

United States (California and other states)

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use and disclose it, to request access to and deletion of it, to correct it, and to be free from discrimination for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising. You may use an authorized agent to submit a request. Residents of other US states with comprehensive privacy laws have comparable rights. To make a request, contact us using section 12.

EU / UK / other regions

Residents of the EU/UK (GDPR), the UAE (PDPL) and other jurisdictions have the rights described above under their applicable laws.

10. Children

Our services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children.

11. Cookies and similar technologies

Our website and dashboard use a small number of strictly necessary cookies to operate and secure the service, including an authentication cookie that keeps you signed in across Orchestrapay pages. On some web pages we also use error-tracking and masked session-replay technology (provided by Sentry), sampled at a low rate, to diagnose problems; text and media are masked in these recordings. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser settings and any cookie controls we provide, though disabling strictly necessary cookies may prevent the service from working.

12. Contact us

For questions about this policy or to exercise your rights, contact our privacy team at privacy@orchestrapay.com, or write to Orchestrapay, LLC, 28 Geary St, Suite 650 #352, San Francisco, CA 94108, United States.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the effective date above; material changes will be communicated as required by law.