Privacy Policy

1. Introduction

CFO International LLC ("EXOS Pay," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our merchant-of-record platform and related services.

Please read this Privacy Policy carefully. By using EXOS Pay, you consent to the practices described in this policy.

2. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, company name, and business address
• Verification Information: Government-issued ID, business registration documents, tax identification numbers
• Financial Information: Bank account details for payouts, billing information
• Transaction Data: Information about payments processed through our platform
• Communications: Messages you send us through support channels

Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken
• Device Information: IP address, browser type, operating system
• Cookies: Session cookies, authentication tokens, analytics cookies
• Log Data: Server logs, error reports, API requests

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Verify your identity and prevent fraud
• Comply with legal and regulatory requirements
• Calculate and remit taxes on your behalf
• Send administrative and promotional communications
• Respond to your inquiries and provide customer support
• Analyze usage patterns to improve our platform
• Protect the security and integrity of our services

4. Information Sharing

We may share your information with:

• Payment Processors: To process transactions and payouts
• Tax Authorities: As required for tax compliance and reporting
• Service Providers: Third parties that help us operate our platform
• Legal Authorities: When required by law or to protect our rights
• Business Partners: With your consent for integrations and partnerships

We do not sell your personal information to third parties.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• PCI DSS Level 1 compliance for payment data
• Regular security audits and penetration testing
• Multi-factor authentication
• Access controls and employee training
• SOC 2 Type II compliance

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information longer as required by law, for tax purposes, or to resolve disputes. Transaction records are typically retained for 7 years to comply with financial regulations.

7. Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data (subject to legal requirements)
• Object to or restrict certain processing
• Data portability
• Withdraw consent
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@exospay.com.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and security
• Analytics Cookies: To understand how you use our platform
• Preference Cookies: To remember your settings

You can control cookies through your browser settings, though disabling essential cookies may affect functionality.

9. International Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in compliance with applicable laws.

10. California Privacy Rights

California residents have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell)
• Right to non-discrimination for exercising privacy rights

11. Children's Privacy

Our services are not directed to children under 18. We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through our platform. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions or to exercise your rights, contact us at: