1. Who we are and what this covers
PayFam (“PayFam”, “we”, “us”) provides checkout, subscription billing and payment-routing software for Shopify brands. This policy explains how we handle personal information when you visit our website, book a call or email us, sign up for or use the PayFam app and services (the “Services”), or buy from a store that runs its checkout on PayFam.
We play two roles. For our website, our sales conversations and the accounts of the brands we work with, we decide how personal information is used and act as a controller. For shopper information that a brand processes through PayFam — at checkout, in the customer portal and on rebills — we act on the brand’s behalf as its processor or service provider, and the brand’s own privacy policy applies.
2. If you bought from a store that uses PayFam
The store you bought from decides what it collects at checkout and how it uses it. PayFam processes that information only to provide the store’s checkout, subscriptions, customer portal and related services, on the store’s instructions.
To access, correct or delete your information, or to cancel a subscription, contact the store first — its details are on your order confirmation. If you contact us instead, we’ll pass your request to the store and help it respond.
3. Information we collect
What we collect depends on how you interact with us:
- Contact and sales details — your name, work email, company, store URL and anything you tell us when you book a call, email us or talk to our team.
- Account details — the name, email address and sign-in details of each person on a brand’s PayFam account, and the settings and content they create, such as checkout pages, offers and flows.
- Billing details — what we need to invoice a brand for its PayFam plan, such as the billing contact, address and payment method.
- Store and processor data — information from the services a brand connects, such as its Shopify store (products, orders, customers and refunds) and its payment processors (account identifiers and transaction results).
- Shopper data, on a brand’s behalf — a shopper’s name, email, phone number, billing and shipping addresses, order and subscription history, customer-portal actions, and the device and browser information used for checkout and fraud prevention.
- Payment card data — card numbers are captured into our PCI DSS Level 1 vault, operated by Evervault, and stored as network tokens where the card network supports them. PayFam’s own systems keep tokens and limited card details — such as the card brand, last four digits and expiry date — not full card numbers.
- Usage and device data — log information such as IP address, browser type, pages viewed, the referring page and timestamps, collected automatically when you use our website or the Services.
5. How we use information
- To provide the Services — running checkout, storing payment credentials, routing charges to the processors a brand chooses, billing subscriptions, retrying failed payments and syncing orders back to Shopify.
- To keep the Services secure — detecting and preventing fraud, abuse and security incidents, and verifying who is signing in.
- To support brands — onboarding, answering questions, troubleshooting and sending service messages, such as receipts, security alerts and notices about changes to the Services.
- To bill for PayFam — calculating plan and usage fees and collecting payment.
- To improve PayFam — understanding how the Services are used and measuring things like approval rates, retry outcomes and checkout conversion — using aggregated or de-identified data wherever we can.
- To talk to you about PayFam — following up on a call you booked or an enquiry you sent and, where permitted, sending product news you can opt out of at any time.
- To meet our obligations — complying with the law, card network rules and lawful requests, and enforcing our Terms of Service.
We don’t use the shopper data a brand processes through PayFam for our own marketing, and we don’t sell it.
6. Legal bases (EEA, UK and Switzerland)
Where data protection laws such as the GDPR apply, we rely on these legal bases:
- Contract — to provide the Services and the website features you ask for.
- Legitimate interests — to secure and improve the Services, prevent fraud and talk to businesses about PayFam, balanced against your rights.
- Consent — where we ask for it, such as for optional marketing. You can withdraw it at any time.
- Legal obligation — where the law requires us to process or keep information.
8. International transfers
PayFam and our service providers may process information in the United States and in other countries whose data protection laws differ from yours. When we transfer personal information out of the EEA, the UK or Switzerland, we use recognised safeguards, such as the European Commission’s Standard Contractual Clauses.
9. How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy:
- Account and billing details for as long as a brand’s account is open, then for as long as we need them for tax, accounting and legal purposes.
- Shopper data and vaulted payment credentials for as long as the brand instructs us. When a brand leaves PayFam, we return or migrate its data on request and then delete it, unless the law requires us to keep it.
- Sales enquiries and call notes for as long as they’re relevant to our conversation.
- Logs for a limited period, for security and troubleshooting.
Some payment records are kept longer where the law or card network rules require it — for example, to handle refunds and chargebacks.
10. Security
We protect personal information with technical and organisational measures suited to its sensitivity, including encryption, access controls and a PCI DSS Level 1 vault for card data. No system is perfectly secure, but we work hard to keep yours safe. Our Security page has the details.
11. Your rights and choices
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw any consent you’ve given.
California residents have the right to know what personal information we collect, use and disclose, to delete and correct it, and not to be discriminated against for exercising these rights. We don’t sell or share personal information as those terms are defined under California law.
To make a request, email privacy@payfam.com. We may need to verify your identity before acting on it, and we’ll respond within the time the law requires. If you’re a shopper, we’ll forward your request to the store that holds your information. You can also complain to your local data protection authority.
You can unsubscribe from marketing emails at any time with the link in each email. We’ll still send you messages about your account and the Services.
12. Children
PayFam is a business service and isn’t directed at children. We don’t knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we’ll delete it.
13. Changes to this policy
We’ll update this policy as PayFam changes. When we do, we’ll change the date at the top of this page, and if a change is significant we’ll tell brands by email or in the app before it takes effect.
14. Contact us
Questions about this policy or how we handle personal information? Email privacy@payfam.com.