1. Scope and company identity
This Privacy Policy applies to OpenPath, Inc., a Maryland corporation operating as OpenPath Payments in California (“OpenPath,” “we,” “us,” or “our”). It applies when OpenPath determines why and how personal information is processed, including on this website, in our business relationships, and through account and support interactions.
When OpenPath processes personal information on behalf of a merchant, platform, partner, or other business customer, that customer generally determines the purposes and means of processing. Its privacy notice and our contract with it govern that processing. This policy does not control independent third-party websites or services.
2. Information we handle
Depending on how you interact with OpenPath, we may collect or process the following categories:
- Business and contact information: name, company, role, business address, email address, telephone number, and communication preferences.
- Account and authentication information: username, encrypted credentials, user role, permissions, security settings, and account activity.
- Merchant and commercial information: business profile, service configuration, contracts, billing records, integration choices, and support history.
- Transaction and payment information: transaction amount, currency, timestamps, merchant and order references, payment method metadata, tokenized payment references, authorization results, routing events, decline information, chargeback signals, and processor responses.
- Fraud, compliance, and device signals: IP address, approximate location derived from IP, device and browser attributes, velocity and behavioral signals, risk indicators, and information needed for legal or network compliance.
- Website and technical information: pages viewed, referring page, timestamps, browser type, operating system, diagnostics, cookies or similar identifiers, and security logs.
- Communications: inquiries, meeting requests, emails, calls, support tickets, and feedback.
Do not send full payment card numbers, security codes, passwords, or other sensitive credentials by email or in unsupported support fields. Use the secure channels designated for the applicable Service.
3. Sources of information
We obtain information directly from you; from your employer or organization; from merchants, platforms, partners, and authorized users; through your use of our websites and Services; from configured processors, gateways, fraud providers, ecommerce platforms, and other integrations; and from service providers or lawful public and commercial sources used for security, compliance, and business operations.
4. How we use information
We use personal information to:
- provide, route, secure, support, maintain, and improve the Services;
- authenticate users, manage accounts, and enforce permissions;
- execute customer instructions and connect configured payment and ecommerce providers;
- detect and address fraud, abuse, service interruption, unauthorized access, and security threats;
- provide customer support, implementation help, billing, product communications, and requested marketing information;
- analyze performance, reliability, and product usage, including through aggregated or de-identified information;
- meet legal, regulatory, contractual, card-network, audit, and compliance obligations;
- establish, exercise, or defend legal claims; and
- conduct corporate transactions such as financing, reorganization, merger, or sale.
Where the GDPR applies, our legal bases may include performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing a business-to-business payment platform, consent where required, and protection of legal rights.
5. Controller and processor roles
OpenPath acts as a controller for information used to manage our websites, customer and partner relationships, accounts, billing, security, compliance, and our own business operations. OpenPath may act as a processor or service provider when it handles transaction or end-customer information under a business customer’s instructions.
If your request concerns information submitted by a merchant or platform, we may direct you to that business or assist it in responding. Contracted customers may request a data processing addendum addressing processing instructions, confidentiality, security, subprocessors, international transfers, and assistance with individual rights.
6. How we disclose information
We may disclose personal information as needed to the following categories of recipients:
- processors, gateways, financial institutions, card networks, payment methods, ecommerce platforms, fraud providers, and other integrations selected or authorized for the transaction flow;
- hosting, infrastructure, communications, support, identity, security, analytics, professional, and other vendors that help operate our business;
- your organization and its authorized users, merchants, platforms, or partners involved in the Services;
- auditors, insurers, lawyers, accountants, regulators, law enforcement, courts, and other parties where required or appropriate to protect rights, safety, and legal interests; and
- participants in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate protections.
OpenPath does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising as those terms are defined by the CCPA. We do not use payment card account data for advertising.
7. Website technologies and third-party links
Our websites may use necessary cookies, local storage, logs, and similar technologies for security, navigation, support, preferences, and performance. Our pages also load services such as web fonts and customer support chat, which may receive technical information needed to deliver their functionality.
Links to appointment scheduling, portals, app stores, documentation, status pages, or third-party platforms take you to services controlled by others. Review their privacy notices before providing information. Where legally required, we honor applicable browser-based opt-out preference signals for activities covered by those signals.
8. Security and PCI DSS
OpenPath uses administrative, technical, and physical safeguards designed to protect personal information based on its sensitivity and the risks involved. Measures may include access controls, encryption, segmentation, monitoring, logging, vulnerability management, incident response, and vendor review.
OpenPath operates as a PCI DSS Level 1 service provider for its in-scope cardholder data environment. PCI DSS provides technical and operational requirements for protecting payment account data. It does not cover every type of personal information and does not guarantee that a security event can never occur. Merchants and other participants remain responsible for their own environments and compliance obligations.
9. Retention
We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, maintain transaction and audit records, meet contractual and legal requirements, resolve disputes, prevent fraud, and enforce agreements. Retention periods vary by data type, customer instructions, legal requirements, security needs, and the applicable payment ecosystem. We delete or de-identify information when it is no longer needed, unless retention is required or permitted by law.
10. International transfers
OpenPath and its providers may process information in the United States and other countries where we or our service providers operate. Those countries may have different data-protection laws. When required, we use recognized safeguards for international transfers, which may include adequacy decisions, contractual protections such as Standard Contractual Clauses, and supplementary safeguards appropriate to the transfer.
11. Your privacy rights
Depending on where you live and how OpenPath processes your information, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to appeal or complain to a regulator. These rights are subject to legal exceptions and verification.
Submit a request by emailing support@openpath.io with the subject “Privacy Request” or calling 844-728-4247. Describe the right you want to exercise and the OpenPath relationship involved. We may verify your identity and authority, and we will use verification information only for the request and related security or recordkeeping.
You may use an authorized agent where permitted. We may request proof of the agent’s authority and direct confirmation from you. We will not discriminate against you for exercising a privacy right.
12. California notice at collection
During the preceding twelve months, OpenPath may have collected the categories described in Section 2: identifiers and business contact information; customer records; commercial and transaction information; internet or electronic activity; approximate geolocation; professional information; authentication and financial-account-related information; and inferences or risk signals derived from those categories.
We collect and use these categories for the purposes in Section 4 and may disclose them for business purposes to the recipient categories in Section 6. We do not sell them or share them for cross-context behavioral advertising. We retain each category according to the criteria in Section 9.
California residents may request to know, access, delete, or correct personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service and pricing when exercising their rights, subject to applicable exceptions. Because OpenPath does not sell or share personal information as defined by the CCPA, an opt-out does not change our current practices. If those practices change, we will provide the required method before beginning the covered activity.
13. Children
The Services are designed for businesses and are not directed to children under 18. We do not knowingly collect personal information directly from children through the Services. If you believe a child has provided personal information directly to us, contact us so we can assess and address the information.
14. Changes to this policy
We may update this policy as our Services, practices, or legal obligations change. The effective date at the top shows when it was last revised. We will provide additional notice of material changes when required by law.
15. Contact us
Privacy questions and requests may be sent to support@openpath.io or made by phone at 844-728-4247. OpenPath, Inc. is a Maryland corporation operating as OpenPath Payments in California.
For a focused explanation of GDPR and CCPA rights, see our GDPR and CCPA Privacy page.