Privacy Policy

Effective Date: August 16, 2026 | Version 2026.1

This Privacy Policy explains how ePayUs, Inc. (“ePayUs”, “we”, “us”) collects, handles, and protects information across our B2B financial synchronization platform at e-payus.com. We comply with applicable US state privacy laws (including CCPA/CPRA) and standard B2B data protection protocols.

1. Information We Collect

  • Account Details: Business name, representative name, contact details, and billing records.
  • Authentication Credentials: Secure OAuth 2.0 tokens and organization IDs used to interface with Xero and QuickBooks Online. We do not store raw ledger login credentials or passwords.
  • Transaction Metadata: Invoice identifiers, customer ledger names, gross amounts, processing fee line items, check numbers, and batch deposit summaries.
  • Excluded Financial Data (Zero Cardholder Data): ePayUs operates strictly within PCI-DSS SAQ-A scope. Raw debit/credit card numbers (PAN) and CVV codes are never ingested, transmitted, or stored on our servers. All card rails run directly through Stripe.

2. Purpose of Data Processing

Collected operational data is used exclusively to provide core functionality:

  • To process automated fee splitting and push clearing records into your linked ledger.
  • To format printable deposit slip PDFs and NACHA export files.
  • To safeguard ledger synchronization integrity and prevent fraudulent actions.

3. Sub-Processors & Infrastructure

We do not monetize, rent, or sell operational data. Sub-processors are limited to essential cloud and payment infrastructure:

Sub-Processor Purpose Location Standard
Stripe, Inc. Payment Infrastructure USA PCI-DSS Level 1
Xero Limited Accounting Integration USA / Global SOC 2 Type II, ISO 27001
Intuit, Inc. QuickBooks Online Sync USA SOC 2 Type II
Amazon Web Services (AWS) Encrypted Hosting USA SOC 1/2/3, ISO 27001

4. Data Security & Your Rights

All data in transit is protected using TLS 1.3 encryption, and tokens at rest are secured with AES-256 encryption. Telemetry error logs are cycled out every thirty (30) days. You maintain statutory rights to request access, correction, or deletion of your business metadata at any time through our verified contact channels.