Travede Privacy Policy

1Scope and our role

This Policy covers website visitors, prospective and current merchant representatives, account users, and individuals whose information is processed through our Services. Personal information means information that identifies, relates to, or can reasonably be linked to an individual, as defined by applicable law. Information about a business may be personal information when it identifies a person associated with that business.

When we manage our own merchant relationships, account administration, website operations, security, or legal compliance, we determine the purposes and means of the relevant processing and may act as a controller or business. When a merchant uses Travede to manage its customers, subscriptions, or payments, we generally process customer information on that merchant’s instructions as its processor or service provider. Our role depends on the particular activity and applicable law.

The merchant remains responsible for its customer-facing privacy notices and the lawful basis for its instructions. If you are a merchant’s customer, review that merchant’s privacy policy as well as this Policy. A bank, processor, card network, or vault provider may independently determine how it uses information for its own payment, fraud-prevention, or legal obligations; its own privacy notice may apply.

This Policy is separate from our Merchant Terms and Conditions. It is not a payment authorization, consent to recurring charges, or a substitute for any required merchant data-processing agreement. It does not change customer cancellation or payment-dispute rights. Separate notices may apply to employment information or a particular product or collection activity.

2Sources of personal information

We receive information directly from you when you request information, create or use an account, submit forms, communicate with us, or provide transaction instructions. Merchants provide information about their authorized users and customers, including imported subscription and payment records. We also receive relevant information from authorized integrations, payment providers, financial institutions, and verification or fraud-prevention providers used for the applicable service.

Our systems may generate information from platform activity, transactions, support interactions, and security events. Website and application technologies may automatically collect device and connection information as described below. The information received depends on the service, integration, permissions, and configuration in use.

3Information we collect and process

Business and account information. This may include names, business names, roles, business contact details, account identifiers, user permissions, login information, billing contacts, and account preferences. Onboarding or risk review may also involve ownership details, business verification records, authorized representative information, and information about expected volume, products, and fulfillment practices. Identity documents or government identifiers should be provided only through a designated secure process when specifically requested.

Customer and subscription information. Depending on merchant instructions, this may include a customer’s name, email address, telephone number, billing or service address, customer identifier, subscription plan, billing schedule, account status, purchase or service history, and information about cancellations or consent. Merchants should submit only information needed for the Services.

Payment and transaction information. This may include transaction amounts and dates, currency, payment method type, payment tokens, masked account or card details, expiration information where supported, billing information, authorization and response codes, payment status, refunds, chargebacks, ACH returns, and payment-recovery history. Merchant billing and settlement arrangements may require bank-account information through an approved collection process.

Device and usage information. This may include IP address, browser and operating-system information, device identifiers, session and authentication records, pages or features accessed, timestamps, referring pages, errors, and security logs. Collection varies by the website, application, and technologies actually deployed. An IP address may indicate an approximate location; this is different from precise device geolocation.

Communications and supporting records. This may include support tickets, email correspondence, feedback, attached documents, transaction evidence, authorization records, and information supplied to investigate disputes or security concerns. Do not include full payment credentials, passwords, or unrelated sensitive information in ordinary support messages.

Statement review requests. If you ask for a free statement review on travede.com, we collect the details you enter in that form (name, work email, phone, company and any answers or notes you add), the processing statement you upload as a PDF, and the request’s IP address, browser information and referring page, which we use to prevent abuse of the form. We use this information only to prepare the review, to contact you about it and, if you choose to proceed, to set up your account. A statement normally contains your processor’s name, merchant identifiers, volumes and fee schedule and should never include full card numbers; please do not add any. The form is hosted by Travede at forms.travede.com and embedded on travede.com.

4Payment credentials and tokenization

Travede supports integrations with payment vaults, processors, and gateways. Tokenization replaces payment credentials with a reference used for supported payment activity. Depending on the integration, credentials may be collected directly by a payment provider or transmitted through an approved payment flow, while Travede uses tokens and associated transaction information. A token and its related records may still be personal information.

We do not request card verification codes in support tickets or other free-text communications. Merchants must use approved payment interfaces and follow the security requirements applicable to their role. Tokenization does not remove all privacy or payment-security obligations.

5How we use personal information

We use relevant information to establish and administer merchant accounts; provide requested payment, subscription, routing, reporting, and recovery functions; authenticate users and apply permissions; process our own service fees; and provide support. Merchant customer information is used to perform the services the merchant has authorized, subject to applicable law and contractual restrictions.

We also use relevant information to reconcile activity; investigate errors, disputes, refunds, and returns; assess and manage merchant and transaction risk; prevent fraud and unauthorized access; monitor service performance; troubleshoot and maintain systems; comply with legal obligations; and establish, exercise, or defend legal claims. Information used for underwriting may include payment volume, transaction mix, chargeback and return history, and related business risk indicators.

We use contact information to send account, security, billing, and service notices. When a merchant enables customer receipts or payment reminders, we send them on its behalf under the applicable instructions. We may communicate with merchant representatives or prospects about Travede services where permitted by law; marketing choices are described below. Merchant customer data is not made available for unrelated uses merely because a merchant has uploaded it.

We may use aggregated or de-identified information to understand service performance and improve the Services where permitted by law and our agreements. When we treat information as de-identified under applicable law, we maintain it in that form and do not attempt to re-identify it except as legally permitted. Identifiable customer information remains subject to the protections and limitations applicable to its original collection.

6When we disclose personal information

Merchants and authorized users. We disclose a merchant’s customer, subscription, transaction, and account information to that merchant and users or integrations it authorizes, subject to applicable permissions. Account administrators may access user activity and records associated with their organization.

Payment ecosystem providers. We disclose relevant identity, billing, payment, transaction, risk, and dispute information to vault providers, gateways, processors, acquiring and other banks, card networks, and ACH participants as needed for requested payments, tokenization, settlement, fraud review, reconciliation, or dispute handling. The providers involved depend on the merchant’s configuration and agreements.

Operational service providers. Providers of hosting, infrastructure, security, communications, support, professional advice, and other contracted services may receive the categories of information necessary to perform their functions. We require appropriate contractual restrictions and safeguards where applicable, including limits on processing merchant customer information on our behalf.

Google LLC acts as our service provider for Google Analytics on travede.com and processes the analytics data described in Section 7 on our behalf.

Statement review requests are stored in Microsoft Azure in the United States and seen by Travede’s sales and operations staff. Cloudflare, Inc. screens submissions of that form for automated abuse (Cloudflare Turnstile) and receives the request’s IP address and browser information for that purpose.

Legal and corporate disclosures. We may disclose relevant information when required by law or legal process, to respond to lawful authority requests, to protect rights or safety, or to investigate suspected unlawful activity. Information may also be disclosed to professional advisors or actual or prospective participants in a merger, financing, acquisition, or sale of business assets, subject to appropriate confidentiality protections and applicable law. We may disclose information at your direction or with legally valid consent.

7Cookies and analytics

Cookies and similar technologies can support authentication, security, session continuity, and preferences. travede.com uses Google Analytics 4 (Google LLC) to see aggregate usage of the website: pages visited, approximate country or region, and device and browser type. Google Analytics sets cookies in your browser, assigns a random visitor identifier, and receives your IP address to work out an approximate location; it does not store the IP address. We use this data only to improve the site. We do not enable Google Signals, Google Ads integration, or remarketing audiences. You can opt out by turning on Global Privacy Control or Do Not Track in your browser (travede.com then does not load Google Analytics at all), by installing the Google Analytics Opt-out Browser Add-on, or by using a content blocker. The cookies involved are listed in our Cookie Policy. Browser settings may allow you to block or delete cookies, although disabling essential technologies can affect account access or service functionality.

Travede does not sell personal information, does not share it for cross-context behavioral advertising, and does not use it for targeted advertising.

8Retention and deletion

We retain personal information for the period reasonably necessary for the purposes described in this Policy, subject to applicable law, merchant instructions, and contractual requirements. We consider the nature and sensitivity of the information, whether an account remains active, the requested service, payment and accounting requirements, security needs, and any pending dispute, investigation, or legal hold.

Account and relationship records may be needed during the merchant relationship and afterward for accounting, compliance, or claims. Customer, payment, and subscription records may be retained to provide billing services, reconcile transactions, document authorizations, and handle disputes or returns. Security and usage records are retained according to operational and security needs. Support records are retained as needed to address the issue and related obligations. Data retained in backups may remain until the applicable backup cycle expires and is subject to restricted use.

Cancelling service does not necessarily require immediate deletion of all information. The six-month reserve period and 12-month chargeback responsibility period in the Merchant Terms are financial provisions, not universal data-retention or deletion deadlines. Records may need to remain available longer to resolve timely claims or meet independent legal obligations. When retention is no longer necessary, we delete or de-identify information in accordance with applicable requirements.

Statement review files and the request details are deleted 90 days after we close the review, unless you become a customer, in which case they are kept with your account records. You can ask us to delete them sooner by writing to legal@travede.com.

9Security

We use reasonable administrative, technical, and physical safeguards appropriate to the personal information and processing involved. Access should be limited to authorized persons with a business need. No system, network transmission, or storage method can be guaranteed completely secure. If a security incident requires notification, we provide notice in accordance with applicable law and contractual obligations.

Merchants and users should protect credentials, use available authentication controls, limit permissions, and promptly report suspicious access. Do not send passwords, full card numbers, card verification codes, or full bank-account details through ordinary email. The security obligations of banks and payment providers are also governed by their own requirements and agreements.

10Privacy rights and requests

Depending on where you live, the information involved, our role, and whether a law applies, you may have rights to confirm processing; access or obtain a portable copy of information; correct inaccuracies; request deletion; or opt out of a sale, targeted advertising, or certain profiling. Some laws also provide rights concerning sensitive information, withdrawal of consent, or an appeal of a denied request. These rights have legal exceptions and do not apply identically in every jurisdiction.

Submit a request using the privacy contact in Section 14. Describe the right you wish to exercise and your relationship to Travede. We may request information reasonably necessary to verify your identity and locate relevant records, but do not send sensitive identity documents until we provide a secure method. Authorized agents may act where permitted by law, subject to verification of their authority. We respond within applicable legal deadlines and explain any permitted extension or denial. We do not unlawfully discriminate against you for exercising privacy rights.

If we process your information for a merchant, direct your request to that merchant first. If you contact us, identify the merchant so we can route the request or assist it as appropriate. We act on merchant instructions unless applicable law requires otherwise. A merchant’s instruction cannot waive rights that applicable law makes nonwaivable.

If you have a legally available appeal right, submit the appeal through the same privacy contact and identify the decision you are appealing. We will review it within the period required by applicable law and provide information about further complaint options when required. You may also contact the competent privacy regulator or consumer-protection authority. This Policy does not limit those rights.

California residents may have rights to know, delete, correct, opt out of sale or sharing, and limit certain uses or disclosures of sensitive personal information where the CCPA applies. Business-contact information is not automatically excluded. Payment-related information is not automatically exempt simply because it concerns a financial transaction. Applicability and exemptions depend on the facts. If required, our California notice at collection and supplemental disclosures will identify actual collection and disclosure practices for the applicable reporting period.

11Communication choices

You may opt out of Travede marketing email using the unsubscribe instructions in the message or by contacting us. We may continue to send necessary account, security, billing, or legal notices. For messages sent on a merchant’s behalf, follow the merchant’s instructions or contact the merchant. Opting out of marketing does not cancel a subscription, revoke a payment authorization, or erase an outstanding balance; those requests must be handled through the appropriate merchant or payment channel.

12Children and international processing

Travede’s merchant platform is intended for business use and is not directed to children under 13. Merchants must not submit children’s information in violation of applicable law. If you believe a child’s information has been collected unlawfully, contact us so the matter can be investigated and appropriately addressed with the responsible merchant.

13Changes to this Policy

We may update this Policy to reflect changes in our practices, Services, or legal requirements. We will update the effective date and provide additional notice of material changes as required by law, such as an account notice or email to affected account contacts. Where a new use requires consent or another legal basis, we will obtain or establish it before that use. Continued website use does not by itself substitute for legally required consent.

14Contact Travede

Please identify whether you are a merchant representative, account user, website visitor, or a merchant’s customer. If you are a merchant’s customer, include the merchant’s name and enough non-sensitive information to identify the request.