Privacy Policy

CommerceOrch, Inc. is the data controller for personal data processed in connection with your use of the Services. CommerceOrch is incorporated in the State of Delaware, United States of America.

For data protection inquiries, including GDPR and CCPA requests, please contact our Privacy Team at: privacy@commerceorch.com

Where CommerceOrch processes personal data on behalf of a merchant (e.g., transaction metadata submitted through the API), CommerceOrch acts as a data processor and the merchant is the data controller. The merchant’s use of personal data within the Services is governed by their own privacy policies and applicable law.

We collect the following categories of personal and business data:

2.1 Account Data

When you register for or use our Services, we collect information you provide directly, including:

• Business name, legal entity type, and registered address;
• Contact name, email address, phone number, and job title;
• Billing information (payment method details, billing address);
• Tax identification numbers where required;
• Account credentials, API keys, and authentication data.

2.2 Transaction Metadata

When you use the Services to process payments, we collect metadata about those transactions, including:

• Transaction identifiers, amounts, currencies, and timestamps;
• Payment method types (card brand, funding type, last four digits — no full PANs);
• PSP identifiers, routing decisions, and authorization outcomes;
• Error codes, decline reasons, and chargeback data;
• Customer-facing identifiers or order references you associate with transactions.

CommerceOrch does not store full payment card numbers (PANs), CVV codes, or other sensitive authentication data. These are handled exclusively by your PSPs.

2.3 Usage Data

We automatically collect information about how you interact with the Services:

• IP addresses and approximate geolocation;
• Browser type, device type, and operating system;
• Pages visited, features accessed, and time spent;
• API request logs, response times, and error rates;
• Referrer URLs and search terms used to find our website.

2.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies as described in Section 7 of this policy.

2.5 Communications Data

When you contact our support or sales teams, we retain records of those communications including email correspondence, support ticket content, and any attachments or information you choose to provide.

We use the information we collect for the following purposes:

• Service Delivery. To provide, maintain, and improve the Services, including routing transactions, generating analytics, and delivering developer tools.
• Account Management. To create and manage your account, process payments for our Services, send transactional notifications, and respond to support requests.
• Security and Fraud Prevention. To detect, investigate, and prevent fraudulent activity, unauthorized access, and other illegal or harmful behavior.
• Legal Compliance. To comply with applicable laws, regulations, legal processes, and government requests, including AML/KYC obligations.
• Service Improvement. To analyze usage patterns and conduct research and development to improve our products and services, using aggregated or anonymized data where possible.
• Communications. To send you product updates, security notices, billing information, and, with your consent, marketing communications about our Services.
• Contractual Obligations. To perform our obligations under our agreement with you and enforce our Terms of Service.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b) GDPR). Processing necessary to provide the Services you have requested and to fulfill our contractual obligations.
• Legitimate Interests (Art. 6(1)(f) GDPR). Processing necessary for our legitimate business interests, such as fraud prevention, service security, analytics, and product improvement, where those interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c) GDPR). Processing required to comply with applicable laws and regulations.
• Consent (Art. 6(1)(a) GDPR). Where we rely on consent (e.g., for marketing communications or non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell your personal data. We share data only in the following circumstances:

5.1 PSP Partners

When you configure a PSP connection through CommerceOrch, we transmit transaction requests and routing instructions to your designated PSPs. These PSPs process payments under their own privacy policies and merchant agreements.

5.2 Infrastructure Providers

We use third-party cloud and infrastructure providers to host and operate the Services. These providers include, but may not be limited to:

• Cloud hosting and database providers (acting as data processors);
• Email delivery services for transactional and notification emails;
• Monitoring and observability tools for performance and security;
• Content delivery networks (CDNs) for static asset delivery.

All third-party processors are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to CommerceOrch.

5.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to: (a) comply with legal obligations; (b) protect the rights, property, or safety of CommerceOrch, our customers, or the public; or (c) prevent fraud or abuse.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such change and the choices available to you.

We retain your personal data for as long as your account is active or as needed to provide the Services. Specific retention periods include:

• Account Data: Retained for the duration of your account plus 7 years to satisfy financial, tax, and legal record-keeping requirements.
• Transaction Metadata: Retained for 7 years to comply with financial regulations and to support dispute resolution.
• API and Access Logs: Retained for 12 months for security and debugging purposes.
• Marketing Communications: Retained until you withdraw consent or opt out.
• Support Records: Retained for 3 years after account closure.

When data is no longer required, we securely delete or anonymize it in accordance with our data retention schedule.

We use cookies and similar tracking technologies on our website and platform. Your choices are managed through our cookie consent banner.

Essential Cookies

These cookies are strictly necessary for the Services to function and cannot be disabled. They include session tokens, authentication cookies, CSRF protection tokens, and load-balancing cookies. No consent is required for these cookies.

Analytics Cookies

With your consent, we use analytics cookies to understand how visitors interact with our website. These cookies collect aggregated, anonymized data about page views, session duration, and navigation paths. We do not share analytics data with advertising networks.

Preference Cookies

With your consent, we use preference cookies to remember your settings and choices, such as language preferences and dashboard configurations.

Managing Cookies

You can manage or withdraw your cookie consent at any time through the cookie consent banner on our website. You may also configure your browser to block or delete cookies, but this may affect the functionality of the Services.

Depending on your location, you may have the following rights regarding your personal data:

Rights Under GDPR (EEA / UK / Switzerland)

• Right of Access. Request a copy of the personal data we hold about you.
• Right to Rectification. Request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”). Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Restriction of Processing. Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability. Receive your personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to Object. Object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making. Not be subject to solely automated decisions that produce significant legal effects.

Rights Under CCPA (California Residents)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell;
• Request deletion of your personal information, subject to legal exceptions;
• Opt out of the sale or sharing of your personal information (note: we do not sell personal information);
• Non-discrimination for exercising your privacy rights;
• Correct inaccurate personal information we hold about you;
• Limit the use of sensitive personal information.

Submitting a Request

To exercise any of these rights, please submit a request to privacy@commerceorch.com. We will respond within 30 days (or the timeframe required by applicable law). We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.

If you are located in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority.

CommerceOrch is based in the United States. If you are located in the EEA, UK, or other jurisdictions with data transfer restrictions, your personal data may be transferred to and processed in the United States or other countries that may not provide the same level of data protection as your home country.

Where required, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) as approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms. You may request a copy of the applicable transfer safeguards by contacting us at privacy@commerceorch.com.

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of sensitive credentials and secrets at rest using AES-256-GCM;
• Role-based access controls and mandatory two-factor authentication for administrative access;
• Regular security reviews, penetration testing, and vulnerability assessments;
• Comprehensive audit logging of all access to sensitive data;
• IP allowlisting for API key access where configured.

No method of data transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you in accordance with applicable law.

The Services are intended for use by businesses and their authorized personnel. They are not directed at individuals under the age of 18, and we do not knowingly collect personal data from minors. If we learn that we have collected personal data from a minor, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where required, provide additional notice (such as by email or a prominent notice on our website).

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For legal notices relating to our Terms of Service, please contact legal@commerceorch.com.