SANDBOX — test deployment of the website. Nothing here is real.
PayMidWare

Privacy Policy

Version 1 · Effective October 11, 2026

STARTER DRAFT. Not legal advice. Have your attorney review and adapt this text before you publish it. Replace every item in double square brackets, such as [[Company legal name]]; the Portal will not publish a document while any remain. Delete this paragraph when you are done.

1. Who we are and what this covers

This Privacy Policy explains how [[Company legal name]], doing business as MyEzPay and PayMidWare ("we", "us"), collects, uses and shares personal information through the PayMidWare Admin Portal, the PayMidWare payment pages, the Register (point of sale) site, the PayMidWare API and our websites. When we handle information about a business's customers, we usually do so on behalf of that business, which decides why the information is collected. This policy explains what we do with it.

2. Information we collect

People who use the Admin Portal or API (employees, providers and merchants and their staff):

  • Name, work email address, role, business details and, if you choose to add it, a mobile number.
  • Sign-in and security information: a hashed password, sign-in times and results, the trusted browsers you choose to keep (browser type, internet address and last use), codes we send you (never kept after use) and activity logs of key account actions.
  • Support requests, chat messages and attachments you send us.

Customers of our merchants and providers (as entered by them or by you on a payment page):

  • Name, email address, phone number, billing or service address and an account reference.
  • Invoices, payment amounts, dates, status and receipts, scheduled payment details, and records of consent to texts.
  • Payment method details. Card and bank details are sent to the payment gateway or processor. We keep references to them (such as a token, card brand and last four digits) and not the full card number or security code. [[Confirm against your actual card data handling.]]

Everyone who visits: internet address, browser and device type, pages visited and dates and times, and cookies described below.

3. How we use information

  • To provide, secure and support the Service, including processing payments, sending invoices, receipts and reminders, and syncing with services you connect.
  • To verify your identity, prevent fraud and abuse, and keep records required by law and by card networks.
  • To send service messages such as sign-in codes, security notices and billing notices.
  • To answer support requests, including with an automated assistant that answers from our help center content.
  • To improve and troubleshoot the Service and meet our legal duties.

We do not sell personal information and we do not use it for third-party advertising.

4. Text messages

If you give us your mobile number and agree to receive texts, we use it only for the purpose you agreed to, such as payment links, receipts, reminders, sign-in codes and account alerts. Message and data rates may apply. Reply STOP at any time to stop, or HELP for help. We do not share mobile phone numbers or text messaging consent with third parties or affiliates for their marketing or promotional purposes. Our text messaging provider receives numbers and message content only to deliver the messages for us.

5. Who we share information with

  • The business you are dealing with (a merchant or provider), who can see its own customers' and users' information.
  • Payment gateways and processors chosen by the merchant, to process payments.
  • Service providers that help us run the Service, such as hosting, email delivery, text message delivery, document generation and an AI provider for the support assistant. They may use the information only to serve us.
  • Services you connect, such as accounting or e-commerce systems, to the extent you direct.
  • Authorities and advisers when the law requires, to protect rights and safety, or to investigate fraud.
  • A successor if we are involved in a merger, sale or financing.

6. Cookies and similar technologies

We use only the cookies the Service needs to work. We do not use advertising, analytics or tracking cookies, and we do not run a cookie banner because there is nothing optional to switch off. You can block cookies in your browser, but the Portal, the payment pages and the Register will not work without them. Below is every cookie we set, what it does and how long it lasts. Where a name ends in a long code, the code is specific to one person, business or register.

Admin Portal (people who sign in)

  • .AspNetCore.Cookies: keeps you signed in. It ends when you close your browser, unless you choose Remember me, in which case it lasts up to the number of days our settings allow (14 by default; never for our employees). It also ends after a period of inactivity, after a maximum total time, and when your password or role changes.
  • .PayMidWare.TwoFactorPending: holds your place for a few minutes while you enter a sign-in code sent by email or text. It is deleted when you finish or close your browser.
  • pmw_td_ followed by a code: remembers that you chose to trust this browser, so we do not ask for a sign-in code every time. It lasts the number of days set in our security settings after you last use it, and you can revoke it from your Devices page.
  • .PayMidWare.SessionEnded: carries a one-line message to the sign-in page after a session ends, such as when you were signed out for inactivity. It lasts five minutes.
  • pmw_emulation and pmw_merchant_emulation: used only when one of our staff, or a provider, views the Portal as another account to give support. They end when the browser closes or the viewing stops. You will never receive these in normal use.
  • .AspNetCore.Antiforgery followed by a code: protects forms against forgery. It ends when you close your browser.
  • .AspNetCore.Mvc.CookieTempDataProvider: carries a short confirmation or error message from one page to the next, such as "Saved". It ends when you close your browser.

Payment pages (people who pay an invoice or approve a payment schedule)

  • .AspNetCore.Antiforgery followed by a code: protects the payment form against forgery. It ends when you close your browser.
  • .AspNetCore.Mvc.CookieTempDataProvider: carries a short message between pages when one is needed. It ends when you close your browser.

Register (point of sale) site and register pages

  • .PayMidWare.Register: keeps a cashier signed in on a paired register. It ends when the browser closes, after a period of inactivity and after a maximum total time.
  • .PayMidWare.Register.Af: protects register forms against forgery. It ends when the browser closes.
  • __Host-PayMidWare.Device: identifies a tablet or till that a manager has paired with the business, so only paired devices can open the Register. It lasts about 13 months, after which the device is paired again.
  • pmw_pos_register_ followed by a code: remembers which register this device is using. It lasts up to 12 months.

Other browser storage. The register screen remembers which product category you last picked, using your browser's local storage on your own device. It is never sent to us and you can clear it in your browser settings.

Cookies set by payment providers. To take a card payment, the payment pages load a script from the business's payment processor (for example Stripe, Braintree, Adyen, Authorize.Net or PayPal, depending on which one the business uses). Those companies may set their own cookies or similar technologies, for example to prevent fraud and keep the card fields secure. We do not control them, and each company's own privacy policy describes them.

If this changes. If we ever add cookies that are not strictly necessary, such as analytics or advertising, we will update this section and ask for your consent first where the law requires it.

7. How long we keep information

We keep information for as long as the account is active and as needed for legal, tax, accounting, dispute and security purposes. Text message content is kept for 90 days and then deleted, while records that a message was sent and opt-outs are kept longer so we can honor them. Sign-in codes are never stored after use. [[Add other retention periods.]]

8. Security

We protect information with measures such as encrypted connections, hashed passwords, encryption of the credentials you store for connected services, role-based access, optional and required sign-in codes, and activity logging. No system is perfectly secure, so please protect your own credentials.

9. Your choices and rights

You can ask to see, correct or delete information we hold about you, subject to legal limits. If your information was provided by a business you deal with, please contact that business first, since it decides how the information is used. You can ask us at the address below. Depending on where you live you may have additional rights, such as to know what we collect, to opt out of sale or targeted advertising (we do neither) and to appeal a decision. [[Attorney to review state privacy law notices.]]

10. Children

The Service is for businesses and the people who pay them. It is not directed at children under 13 [[confirm age]], and we do not knowingly collect their information.

11. Where information is handled

We operate in the United States, and information is handled there. [[Confirm hosting location.]]

12. Changes

We may update this policy. We will post the new version here with its date, and for material changes we will ask signed-in users to review it.

13. Contact

[[Company legal name]], [[mailing address]]. Email [[privacy contact email]].