Privacy Policy
1. Scope & Who We Are
This Privacy Policy describes how Card Vault Inc. ("Card Vault", "we", "us") collects, uses, discloses, and protects personal information in connection with our tokenization vault, APIs/SDKs, and dashboard (the "Service").
This Policy covers:
- Business customers who use the Service (and their authorized users).
- Individuals whose personal information is processed through the Service on behalf of a business customer (e.g., payors or cardholders).
- Visitors to our public websites and communications channels.
2. Our Role
For personal information we handle on behalf of a business customer, the business customer acts as the organization (controller) and Card Vault acts as the service provider (processor). We process such information solely to provide, maintain, secure, and bill for the Service, to meet legal obligations, and to create Aggregated or De-identified Data as described below. We do not sell personal information or use it to profile individuals for marketing.
For our public websites and direct interactions with prospective or current customers (e.g., sales inquiries, account management), Card Vault acts as the organization responsible for personal information collected directly by us about those visitors and contacts.
3. Personal Information We Process
The categories of personal information we process depend on how you use the Service and may include:
- Account and contact information (e.g., name, business email, role, authentication data, security logs).
- Payment-token lifecycle metadata (e.g., token identifiers, last-4, card brand, expiration month/year). We do not store CVV/CVC post-authorization.
- Transaction metadata (e.g., amounts, currency, gateway routing selections, authorization/settlement responses).
- Technical and usage data (e.g., API call volumes, latency, error rates, device/browser, IP address, cookies).
- Support correspondence, audit logs, and security events.
4. How We Use Personal Information (Purposes)
We use personal information to:
- Provide, operate, maintain, and secure the Service (including authentication, fraud prevention, and abuse detection).
- Route transactions to payment gateways/processors linked by the customer and return processing results.
- Provide support, account communications, and service announcements.
- Bill for paid services and enforce terms and limits.
- Comply with law, card-network rules, and enforce legal rights.
- Create Aggregated or De-identified Data for the purposes below (Section 6).
5. Gateway Authorization (Customer Direction)
When a customer links or connects a payment gateway or processor account to the Service, the customer instructs and authorizes Card Vault to store, transmit, and otherwise process Customer Data as necessary to tokenize payment information and to submit, route, and manage transactions to such gateway or processor on the customer's behalf.
6. Service Analytics; Aggregated & De-identified Data
Service Analytics. We may generate and retain operational metrics about use of the Service (for example, API call volumes, token counts, transaction counts and aggregate values, latency, and error rates) to operate, maintain, secure, support, and bill for the Service, enforce limits, and provide account-level reporting.
Aggregated/De-identified Data. We may create and use Aggregated or De-identified Data derived from Customer Data and Service usage for capacity planning, security analytics, improving and benchmarking the Service, and publishing high-level trends, provided such data does not identify you or any individual. We do not sell personal information and do not use Customer Data to profile individuals for marketing.
Definitions. "De-identified Data" means information created by processing personal information to remove, obfuscate, or randomize personal identifiers such that it cannot reasonably be used to identify an individual. "Aggregated" means information about groups or categories with results combined across multiple customers or over time.
7. Disclosures and Subprocessors
We may disclose personal information to:
- Payment gateways/processors you link to the Service, per your configuration and instructions.
- Our service providers and subprocessors who help us provide, secure, and support the Service (e.g., hosting, security, analytics).
- Professional advisors, auditors, and regulators where required by law or to protect our rights.
- A successor entity in connection with a corporate transaction (subject to confidentiality).
Subprocessors. We engage carefully vetted third-party service providers to help deliver, secure, and support the Service. We provide notice of any material additions via the dashboard or email, describing the service category (e.g., hosting, email delivery, observability) and the primary processing region. Where appropriate, we may provide subprocessor identity under confidentiality upon a customer's written request. If a customer reasonably objects on data-protection grounds, the resolution path is described in the Terms of Use.
8. Cross-Border Processing
Personal information may be processed outside Canada by Card Vault or its subprocessors. We take reasonable measures to ensure a comparable level of protection. Card Vault does not provide data-residency commitments unless expressly agreed in writing.
9. Security
We implement administrative, technical, and physical safeguards designed to protect personal information in our possession and to operate a PCI DSS-compliant vault. Security responsibilities and shared controls are described in the Terms of Use and documentation.
Security Incidents. We will notify affected business customers without undue delay after confirming a Security Incident affecting data in our possession and provide information reasonably sufficient for breach-assessment and notification duties, subject to law-enforcement or security constraints.
10. Retention & Deletion
We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Upon termination of a customer's account, we will disable access and commence secure deletion of personal information in our possession on standard cycles, except where retention is required by law, card-network rules, or pursuant to a written legal hold from the customer.
11. Cookies & Similar Technologies
We use cookies and similar technologies to operate and secure the Service, remember preferences, and understand usage. You may adjust browser settings to block or delete cookies; however, key features of the Service may not function without required cookies.
12. CASL and Communications
If you initiate emails or SMS via the Service, you must comply with Canada's Anti-Spam Legislation (CASL), including obtaining consent, proper identification, and providing unsubscribe mechanisms. Business customers are responsible for maintaining verifiable proof of consent and honoring unsubscribe requests. Card Vault may send administrative and transactional messages related to your account.
13. Your Choices & Rights
For personal information we process on behalf of a business customer, requests to access, correct, or delete personal information should be directed to that business. We will assist our customers in responding to requests as required by applicable law and our agreements.
For personal information we collect directly (e.g., website visitors, sales contacts), you may contact us to request access, correction, or deletion subject to applicable law. We may need to verify your identity before responding.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice via the dashboard, our website, or email. The effective date at the top indicates when the latest changes took effect.
15. Contact Us
Card Vault Inc.
Privacy Inquiries: privacy@cardvault.com
Mailing Address: Suite 3019, 103 9899-112 Avenue, Grande Prairie, Alberta, Canada
16. Governing Law
This Privacy Policy and any disputes arising from it are governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein.