Copyright Notice

Privacy Policy

Last updated: October 12, 2026

This Privacy Policy explains how CTO's Club LLC, a California limited liability company ("CTO's Club," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with our websites at https://ctosclub.com, our payment-infrastructure and gateway-emulation services, hosted payment experiences, application programming interfaces, dashboards, communications features, and related support (collectively, the "Services").

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an individual or household. It does not include information that applicable law excludes from that definition, such as properly deidentified or aggregated information.

1. Scope and our roles

This Policy applies when we determine why and how personal information is processed, including information about website visitors, prospective and current merchants, merchant representatives, administrators, developers, and support contacts.

Merchants and other business customers may also direct us to process personal information about their customers and other end users. For that information, the merchant generally determines why and how the information is processed, and CTO's Club acts as its service provider or processor. The merchant's privacy notice also applies. End users should ordinarily direct requests concerning merchant-controlled information to the merchant with whom they interacted. We will assist the merchant as required by our agreement and applicable law.

We maintain access controls designed to prevent personal information from being accessed or disclosed without authorization.

This Policy does not govern the independent practices of merchants, payment processors, acquiring banks, card networks, payment-method providers, or other third parties.

2. Personal information we collect

Depending on how a person interacts with the Services, we may collect the following categories of personal information. These categories also describe the personal information we may have collected during the preceding 12 months:

Identifiers and contact information: name, business name, mailing address, email address, telephone number, online identifiers, account name, and government-issued identifiers when required for identity or compliance checks.
Account and professional information: job title, employer, role, authorization, username, account settings, authentication records, and information about business owners, representatives, and administrators.
Merchant and commercial information: merchant identifiers, business category, products or services, provider configuration, transaction volume, chargebacks, disputes, refunds, and support history.
Customer and transaction information: customer identifiers, contact and billing information, purchase details, transaction amount and currency, transaction status, merchant location, receipts, refunds, disputes, and related payment activity.
Payment and financial information: payment-card or bank-account information submitted for processing, payment-method tokens, bank and processor account information, and limited payment-method details such as brand, expiration date, and last four digits. Security codes are used only for the transaction for which they are provided and are not retained after authorization.
Sensitive personal information: government identifiers, account login credentials, and financial-account or payment-card information with credentials that permit access, when collected for account administration, identity or compliance checks, transaction processing, fraud prevention, or security. We do not use or disclose this information to infer characteristics about an individual.
Communications and consent records: support messages, feedback, recorded communication preferences, the text and version of disclosures presented, the channel and purposes authorized, the date and method of approval or revocation, and evidence a merchant provides concerning an end user's approval.
Device, usage, and network information: IP address, browser and device type, operating system, device identifiers, referring page, pages or features used, access dates and times, approximate location derived from IP address, cookies, logs, and diagnostic or security events.
Compliance and risk information: identity-verification results, sanctions-screening results, fraud or risk signals, and information needed to comply with law, payment-method rules, or requests from financial partners.
Inferences: risk, fraud, operational, and service-performance insights derived from the information above.

Please do not submit sensitive personal information unless we or an authorized merchant specifically requests it for the Services.

Where required, we provide a notice at or before collection describing the categories of personal information collected and the purposes for which they will be used. We do not collect additional categories or use personal information for materially different, unrelated, or incompatible purposes without providing any notice or choice required by law.

3. Sources of personal information

We may collect personal information:

directly from individuals;
from merchants, their personnel, and their software or service providers;
from payment processors, acquiring banks, card networks, payment-method providers, fraud-prevention services, identity-verification services, and other participants in a payment transaction;
automatically from browsers, devices, APIs, and use of the Services;
from service providers and business partners; and
from public records, sanctions lists, and other lawful public or commercial sources.

If a merchant or another person provides us with someone else's personal information, that party is responsible for having authority to do so and for providing all notices and choices required by law.

4. How we use personal information

We may use personal information to:

provide, route, process, reconcile, support, and improve payment and gateway services;
create and administer accounts, authenticate users, and enforce Project- and Merchant-specific access controls;
create and deliver hosted payment links, receipts, payment notifications, account notifications, and other communications authorized as described in Section 5;
verify identities and authority, underwrite or support onboarding, and satisfy processor, acquiring-bank, card-network, and payment-method rules;
detect, investigate, and prevent fraud, abuse, security incidents, money laundering, sanctions violations, unauthorized transactions, and other unlawful activity;
provide support, respond to inquiries, and manage our relationship with a merchant or other user;
analyze, maintain, test, and improve the performance, reliability, security, and functionality of the Services;
create deidentified or aggregated information that cannot reasonably be used to identify an individual;
exercise or defend legal rights, enforce our agreements, and protect users, merchants, CTO's Club, and others; and
comply with applicable law, legal process, regulatory duties, and lawful requests from government authorities.

5. Email, SMS, and communication choices

CTO’s Club delivers payment links and related payment receipts by email or SMS on the merchant’s behalf. Merchants must obtain the customer’s approval for the selected delivery channel and payment-related purpose. CTO’s Club does not send marketing messages.

We send an email or SMS text message to an end user only when either:

the end user has directly approved that communication through the Services; or
the merchant has received the end user's approval and directs us to send the communication.

Approval must cover the applicable channel and purpose. For example, approval to receive a payment link by email does not by itself authorize text messages. A merchant that directs us to send an email or SMS represents and warrants that it obtained legally sufficient approval from the end user, provided all required disclosures, and can produce evidence of that approval. We may record the approval, the disclosure shown, the authorized channel and purposes, and any later revocation.

You may opt out of text messages at any time by replying STOP. Once we receive your opt-out, we will stop sending text messages. We may send one final message confirming your opt-out, but no further text messages will be sent unless you subsequently provide the consent required to opt in again.

Supported SMS keywords also include QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE. A person may also revoke approval by any reasonable method that clearly communicates the request.

Customers may withdraw approval for future payment-related emails by contacting info@ctosclub.com. Withdrawing approval for one channel does not automatically withdraw approval for the other.

For payment-related emails, an end user may withdraw approval at any time using a method described in the message, by using an unsubscribe link when provided, by contacting the merchant, or by contacting us at info@ctosclub.com. Withdrawal does not affect processing that occurred before it became effective. We will honor these requests as soon as practicable and no later than 10 business days, or sooner if law requires.

Message and data rates may apply to SMS communications. Message frequency depends on the communications the end user authorizes and the transactions or account activity involved.

6. How we disclose personal information

We may disclose personal information to:

Merchants and their authorized users for the transactions and Services they request, only within the applicable Project, Merchant, and Customer-Service access scope.
Payment participants such as payment processors, gateway providers, acquiring banks, issuing banks, card networks, and payment-method providers as necessary to route, authorize, settle, reconcile, refund, or dispute a transaction.
Service providers that provide cloud hosting, communications delivery, security, identity verification, fraud prevention, analytics, customer support, and related services under contractual restrictions and only for the business purposes for which we engage them.
Professional advisers such as attorneys, auditors, insurers, bankers, and accountants when reasonably necessary for their services.
Authorities and other parties for legal or safety reasons when we reasonably believe disclosure is required by law or necessary to protect rights, safety, property, the Services, or the public; investigate fraud or unlawful activity; or enforce our agreements.
Transaction counterparties in a corporate event in connection with a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, or transfer of assets, subject to appropriate safeguards.
Other parties at the individual's direction or with authorization.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We do not sell personal information for money and have not done so during the preceding 12 months. We do not share personal information for cross-context behavioral advertising and have not done so during the preceding 12 months. If our practices change, we will update this Policy and provide any legally required opt-out mechanism before engaging in the new practice.

The categories of recipients described above also describe the categories of third parties to which we may have disclosed personal information for a business purpose during the preceding 12 months. We do not disclose one Project's personal information to another Project or one Merchant's private relationship data to another Merchant.

7. Cookies and tracking choices

We and our service providers may use cookies and similar technologies needed to operate, secure, remember preferences for, and understand use of the Services. Browser controls may allow users to block or delete cookies, but doing so may prevent parts of the Services from working.

The Services do not currently respond to browser "Do Not Track" signals, which lack a uniform industry standard. We honor legally recognized opt-out preference signals, including Global Privacy Control, when applicable to our processing. Because we do not currently sell personal information or share it for cross-context behavioral advertising, receiving such a signal does not change those practices.

8. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain transaction and consent records, comply with financial, tax, accounting, anti-money-laundering, payment-method, and other legal or contractual requirements, resolve disputes, enforce agreements, and protect the Services.

Retention varies by the nature and sensitivity of the information, the risk of harm from unauthorized use or disclosure, the relevant merchant's instructions, whether the purpose can be achieved another way, and applicable legal requirements. When retention is no longer necessary, we delete, deidentify, or securely isolate the information as appropriate. A merchant's request to delete data may be limited by transaction-record, security, anti-fraud, legal-hold, or other lawful retention requirements.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These measures include access controls intended to keep each Project's, merchant's, and customer's information within its authorized scope. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Users and merchants are responsible for protecting their credentials, restricting access to their systems, and promptly notifying us of suspected unauthorized access or any unauthorized acquisition, modification, disclosure, access to, or loss of personal information provided to or used with the Services.

10. International processing

CTO's Club is based in the United States. We and the service providers and payment participants involved in a transaction may process information in the United States and other countries whose privacy laws may differ from those in an individual's location. Where required, we use legally recognized transfer mechanisms and safeguards.

11. Privacy rights and choices

Depending on applicable law, individuals may have the right to request that we:

confirm whether we process their personal information and provide access to it;
correct inaccurate personal information;
delete personal information;
provide a portable copy of certain personal information;
disclose the categories and specific pieces of personal information we collect, the sources and purposes, and the categories of recipients;
limit certain uses or disclosures of sensitive personal information; or
honor an opt-out of the sale or sharing of personal information.

As stated above, we do not sell personal information or share it for cross-context behavioral advertising.

To submit a request, contact info@ctosclub.com or write to the address in Section 16. State that the request concerns privacy and identify the relevant merchant if it relates to a merchant transaction. We may need information to verify the requester's identity and authority. We will use verification information only for verification and related security purposes. An authorized agent may submit a request where permitted by law, subject to verification of the agent's authority and, when permitted, the individual's identity.

Some information may be exempt from a request, including information we must retain to complete transactions, detect security incidents or fraud, comply with law, or establish or defend legal claims. We will not discriminate against an individual for exercising a privacy right.

If we process information solely for a merchant, we may refer the request to that merchant or ask the requester to contact it directly.

12. California privacy disclosures

California residents may exercise the rights described in Section 11 to the extent provided by the California Consumer Privacy Act, as amended (the "CCPA"). The categories of personal information we may have collected in the preceding 12 months are described in Section 2; the sources, purposes, and categories of recipients are described in Sections 3, 4, and 6.

Subject to applicable exceptions, these rights include knowing the categories and specific pieces of personal information collected; knowing its sources, purposes, and recipients; deleting personal information collected from the consumer; correcting inaccurate personal information; opting out of sale or sharing; limiting certain uses or disclosures of sensitive personal information; and receiving nondiscriminatory treatment for exercising a privacy right.

We do not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA. We do not knowingly sell or share the personal information of consumers under 16. California residents are entitled to exercise applicable rights without discriminatory treatment.

We honor legally recognized opt-out preference signals, including Global Privacy Control, as requests to opt out of sale or sharing when applicable. We do not require verification before honoring an opt-out request, although we may request information needed to identify the person whose information is subject to the request. We use that information only for the request and related security purposes.

Certain information and entities may be outside the CCPA's scope or subject to an exemption, including information governed by specified financial-privacy laws. We will apply those provisions as required.

California's "Shine the Light" law may permit California residents to request information about disclosures of personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing without authorization.

13. Children

The Services are business services and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to us without legally valid authorization, contact us so we can review and address it.

14. Third-party services and links

The Services may link to or interoperate with third-party websites, software, payment processors, gateway providers, and other services. Their privacy practices are governed by their own notices, not this Policy. We encourage users to review those notices.

15. Changes to this Policy

We may update this Policy to reflect changes to the Services, our practices, or legal requirements. We will post the updated version and change the "Last updated" date. When required by law, we will provide additional notice or obtain consent before a material change takes effect.

16. Contact us

Questions, complaints, and privacy requests may be sent to:

CTO's Club LLC
7043 Bret Harte Drive, San Jose, California 95120, United States
Telephone: 650-492-3947
info@ctosclub.com
https://ctosclub.com