Privacy Policy

1. Who we are

NorthScout Payments (“NorthScout,” “we,” “us”) is a US-based company that provides a hosted, merchant-branded card checkout, a merchant portal, a WooCommerce gateway, and a merchant API. We serve two groups of people:

• Merchants — businesses that sign up for NorthScout to accept card payments, and the people who manage those accounts.
• Shoppers — customers of our merchants who pay through a NorthScout checkout page.

When you pay a merchant through NorthScout, that merchant also collects and uses your information under its own privacy policy. For checkout data, we generally act as a service provider to the merchant. Our payment processor and identity verification provider also process your information under their own privacy notices.

2. Information we collect

From merchants

• Account and sign-in information, such as name, email address, and authentication details. Portal sign-in is handled by an identity provider on our behalf.
• Business information, such as legal business name, display name, website, support email and phone number, product category, approved store domains, logo, and brand colors.
• Payout and integration information, such as the payout wallet address you designate, payout-address change requests and confirmations, API credentials (which we store only in encrypted form), webhook endpoints, and integration settings.
• Records of activity, such as payments, settlements, portal actions, API requests, and support communications.

From shoppers

• Order details from the merchant, such as the order amount, the merchant's order reference, and the contact details the merchant passes to checkout: your email address, and where provided, your phone number, name, and billing address.
• Payment and verification status, such as whether identity verification and the card payment succeeded, along with reference identifiers from our payment processor. We receive the outcome of these checks, not your card number or identity documents.
• Technical information, such as IP address, browser and device details, and security logs. Your IP address is shared with our payment processor for fraud prevention and compliance.
• Communications, such as the receipts we send you and any messages you send us.

What we do not collect or store

Card numbers and security codes are entered directly into our payment processor's secure payment form. Social Security numbers, dates of birth, and identity documents requested for identity verification are sent directly from your browser to our payment processor. NorthScout does not receive or store any of this information.

3. How we use information

We use the information we collect to:

• Provide the service: present checkout, process and settle payments, send receipts, and notify merchants of payment status.
• Review and onboard merchants, and operate the merchant portal and API.
• Verify, reconcile, and audit payments and settlements, including confirming that funds were received before anything settles.
• Detect and prevent fraud, abuse, and security incidents, and enforce payment limits and our Terms of Use.
• Monitor reliability, diagnose errors, and improve the service.
• Provide support and respond to requests.
• Comply with legal, regulatory, card-network, and payment processor obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use shopper information to market to shoppers on our own behalf.

4. How we share information

We share information only as needed to run the service:

• With the merchant you are paying — payment status, order details, and receipt information for that merchant's orders.
• With service providers that act on our behalf, such as our payment processor, identity verification provider, sign-in provider, email delivery provider, blockchain infrastructure providers, and hosting and error-monitoring providers. They may use the information only to provide services to us, subject to appropriate confidentiality and security obligations.
• For legal and safety reasons — to comply with law, legal process, or regulatory and card-network requirements; to protect the rights, safety, and property of NorthScout, merchants, shoppers, or others; and to investigate fraud.
• In a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction or consent.

5. Payment processing and identity verification

Card payments are processed by a PCI DSS-compliant, regulated third-party payment processor. Identity verification (sometimes called KYC, or “know your customer”) is performed by that processor, and may be required before your first purchase. The processor may ask for your legal name, address, date of birth, Social Security number, a photo ID, or other information, and collects it directly through its own secure components.

The processor uses this information under its own terms and privacy notice, including to verify your identity, prevent fraud, and meet its legal obligations. It may also offer to recognize you on future purchases so you don't need to repeat verification. NorthScout receives only the result of these checks and the identifiers needed to match them to your order.

6. Blockchain settlement transparency

Merchants are settled in USDC, a US-dollar stablecoin, on the Base public blockchain. Each order uses a dedicated settlement address, and an on-chain smart contract splits the funds between the merchant and NorthScout.

Public blockchains are, by design, visible to anyone. Settlement addresses, merchant payout wallet addresses, amounts, and transaction timestamps are permanently public and cannot be altered or deleted by NorthScout or anyone else. We do not write shopper names, email addresses, or other contact details to the blockchain. Merchants should be aware that anyone who links a payout wallet address to their business may be able to see its on-chain activity.

7. Data retention

We keep information for as long as needed to provide the service and to meet our security, accounting, dispute, tax, and legal obligations. In particular:

• Short-lived checkout sessions and sign-in handles expire automatically and are removed on a schedule.
• Raw event payloads received from our payment and blockchain providers are retained as evidence for up to seven years and then purged automatically, while a minimal record that the event occurred is kept.
• Payment and settlement records are kept for as long as required for financial reconciliation, audits, and legal compliance.
• When we honor a deletion request, we erase the shopper's contact details and provider identifiers from our records and cancel any pending receipts. We keep the minimal, de-identified payment and settlement records we are legally required to retain.

Information already recorded on a public blockchain cannot be deleted.

8. Security

We use administrative, technical, and physical safeguards designed to protect information, including:

• Encryption in transit, and encryption at rest for stored data. Shopper contact details are additionally encrypted at the field level using envelope encryption.
• Card and sensitive identity data handled only by our PCI DSS-compliant payment processor, never by NorthScout or the merchant's servers.
• Signed API requests and webhooks, encrypted API credentials, and restricted, audited administrator access.
• Payout destinations fixed before checkout, with email confirmation and a cooling-off period for payout-address changes.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or information has been compromised, contact us at support@northscout.io.

9. Your rights and choices

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information; to receive a copy of it; and to opt out of its sale or sharing for targeted advertising. NorthScout does not sell or share personal information for those purposes.

California and other US state residents. Residents of California and other states with comprehensive privacy laws may exercise the rights those laws provide, including the right to know the categories of personal information we collect and how we use and disclose it, as described in this policy. We will not discriminate against you for exercising your rights. Where required, you may appeal a decision on your request by replying to our response.

To make a request, email support@northscout.io. We may need to verify your identity before acting on a request, and an authorized agent may submit a request on your behalf with proof of authorization. If you are a shopper, we may also refer your request to, or coordinate it with, the merchant you paid, and we may retain information we are legally required to keep. Merchants can update most account information directly in the portal.

10. Cookies and similar technologies

NorthScout uses only cookies that are strictly necessary to run the service. Checkout uses a secure, HTTP-only session cookie that keeps your payment session intact and expires automatically, and the merchant portal uses cookies to keep you signed in.

We do not use advertising or analytics cookies, and we do not use cookies to track you across other websites. Our payment processor may set its own cookies within its secure payment components for security and fraud prevention, under its own policies. Because our cookies are essential, blocking them may prevent checkout or the portal from working.

11. Children's privacy

NorthScout is not directed to children, and you must be at least 18 years old to use it. We do not knowingly collect personal information from children under 13 (or under 18 for checkout). If you believe a child has provided us with personal information, contact us and we will delete it.

12. International users

NorthScout is operated in, and intended for use in, the United States. Information we collect is processed and stored in the United States. If you access the service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and if the changes are material we will provide additional notice, such as by email to merchants or a notice in the portal. Your continued use of the service after an update means the updated policy applies.

14. Contact us

Questions or requests about this policy or your information can be sent to support@northscout.io. Please do not email card numbers, Social Security numbers, identity documents, or wallet recovery phrases — we will never ask for them.