MagicPay

Applicant Privacy Policy

Version 1.0 — effective November 11, 2026

This Privacy Policy explains how MagicPay Merchant Services, LLC and its affiliates, including DISP MP Soluciones, S. de R.L. de C.V. in Mexico (together "MagicPay"), collect, use, store, share and protect personal information through the merchant onboarding portal and the application process. It supplements the privacy section of the magicpay.net Terms of Use; if they conflict on how personal information is handled, this Policy controls.

MagicPay Merchant Services, LLC is the controller of the information described here. For applicants in Mexico, DISP MP Soluciones, S. de R.L. de C.V. is jointly responsible (responsable), and the Spanish Aviso de Privacidad below applies.

1. Information we collect

From you or someone applying for you:

  • Identity: name, date of birth, home address, phone, email, Social Security number, ITIN, SIN, CURP or other tax/national ID, and driver's license or other government ID details, including number, issuing state and expiration.
  • Ownership and control: ownership percentages, titles and roles of owners, officers and guarantors.
  • Business: legal name, DBA, EIN, RFC, BN or other tax ID, entity type, formation details, addresses, website, products and services, processing volumes, ticket sizes, refund and chargeback history, and prior processors.
  • Bank: bank name, routing/transit and account numbers, account type and account holder name.
  • Documents: IDs, voided checks, bank and processing statements, tax letters, articles, licenses, registrations (including Puerto Rico's Certificado de Registro de Comerciante), and similar files.
  • Pricing and equipment choices, signatures and consent records.

From verification and other sources:

  • Identity verification (Plaid): results, and images of the ID document and a selfie. See section 4.
  • Bank verification (Plaid): account and routing numbers, account holder names, account type, institution, and up to the last few months of statements.
  • Tax ID matching: for example the IRS TIN match and business registry lookups.
  • Credit and risk: consumer and business credit reports; fraud, sanctions (OFAC, PEP) and watchlists; the MATCH/Terminated Merchant File and similar industry databases; public records and website reviews.
  • Partners: information from sales partners and agents who refer or apply for you.

Automatically: IP address, device and browser type, pages viewed, timestamps and security logs. The portal uses only the cookies it needs to work and stay secure. It does not use advertising cookies.

2. How we use it

  • To evaluate, underwrite, approve, price and set up merchant accounts, payment software and payment terminals, including equipment leasing, rental or financing.
  • To verify identity and ownership and to prevent fraud, money laundering and terrorist financing, as required by the U.S. Bank Secrecy Act and USA PATRIOT Act (including Customer Identification and Beneficial Ownership rules), Canada's PCMLTFA, Mexico's LFPIORPI, and card network rules.
  • To submit applications to Providers and to board approved accounts in our systems and theirs.
  • To fill in your application from documents you upload. An automated document reader extracts details for your review, and a person reviews every application. No decision is made by automated means alone.
  • To communicate with you about your application and services, and, if you opt in, about offers.
  • To run, secure and improve the portal; to comply with law, regulators and card networks; and to establish, exercise or defend legal claims.

3. Who we share it with

We share personal information only as needed for these purposes:

  • Payment processors and sponsor banks you apply to or that we submit to on your behalf, and card networks (Visa, Mastercard, American Express, Discover and others).
  • Equipment, software and financing providers for the products you select, including lessors and lenders.
  • Verification and data providers: Plaid (identity and bank verification), tax ID verification services such as EINSearch, credit bureaus and business credit agencies, and fraud and sanctions screening services.
  • Service providers working for us: IRIS CRM (our customer management system), Vercel (hosting and file storage), Neon (database), Twilio (text messages), Resend (email), Anthropic (automated document reading), e-signature providers, and professional advisers. They may use the information only to serve MagicPay.
  • Sales partners and agents who referred you, limited to what they need to support your application.
  • Authorities, card networks and others when required by law, subpoena or network rules, to protect rights, safety or property, or to prevent fraud; this includes reporting to MATCH where network rules require it.
  • A buyer or successor in a merger, acquisition or sale of assets, under this Policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Biometric information and ID images

Identity verification compares a selfie with the photo on your government ID. Plaid performs that comparison. MagicPay receives the result and copies of the ID and selfie images, but does not itself create or store facial geometry templates. Where a law treats this as biometric information (for example Illinois BIPA, Texas CUBI, Washington RCW 19.375, Colorado, or Quebec Law 25), you consent to its collection, use and storage as described in the Waiver, Release and Authorizations. We keep ID and selfie images only for identity verification, fraud prevention and compliance record-keeping, restrict access to underwriting and compliance staff, and destroy them on the schedule in section 7, or sooner where required.

5. Communications

You may receive emails, calls and texts about your application. Message and data rates may apply. Reply STOP to stop texts, HELP for help. Agreeing to marketing messages is never a condition of applying.

6. Security

We protect information with encryption in transit and at rest (sensitive fields such as tax IDs and bank account numbers are encrypted individually), access limited by role, multi-factor authentication for staff, audit logs, and vendor review. No system is perfectly secure; tell us at once if you suspect a problem.

7. How long we keep it

We keep application information, including for applications that are declined, withdrawn or never finished, for as long as we have a legitimate business or legal need for it: to keep an account running, to meet legal, tax, audit, regulatory and card network record-keeping duties, to prevent and detect fraud and repeat applications, and to establish or defend legal claims. That is at least seven (7) years after an account is closed or an application is declined, withdrawn or abandoned (U.S. CIP rules require at least five years after closure), and longer while any of those needs continues or a legal hold applies. We may keep a limited fraud-prevention record (names, business and tax identifiers, the decision and the reason for it) for as long as it remains needed for that purpose. ID and selfie images are kept only as long as the identity verification and compliance records they support, and deleted sooner where a biometric privacy law requires (for example, within three years of your last interaction with us under Illinois law). When information is no longer needed, we delete or de-identify it.

8. International transfers

MagicPay is based in the United States, and information is processed in the U.S. and wherever our Providers and service providers operate. Those countries' laws may differ from yours. By applying, you consent to this transfer. Where the law requires, we use contractual or other safeguards.

9. Your choices and rights

Depending on where you live, you may have the right to:

  • access or receive a copy of your information;
  • correct it;
  • delete it, subject to legal retention duties;
  • object to or limit certain uses;
  • withdraw consent (this won't affect past processing, and we may then be unable to process your application);
  • opt out of marketing.

To exercise a right, email info@MagicPay.net with "Privacy request" in the subject, or write to the address below. We'll verify your identity and respond within the time the law requires. You can appoint an authorized agent where the law permits. We won't discriminate against you for exercising a right. If we deny a request, you may appeal by replying to our response.

10. Region-specific terms

United States. Most information collected about applicants is collected in a business context or is subject to the Gramm-Leach-Bliley Act. To the extent a state privacy law applies (such as California's CCPA/CPRA), the categories, sources, purposes and recipients above are our notice at collection; we don't sell or share personal information as those laws define it, and we use sensitive personal information only for purposes the laws allow.

Puerto Rico and the U.S. Virgin Islands. U.S. federal law applies, as do local laws on data breach notification and consumer information.

Canada. We handle personal information under PIPEDA and applicable provincial laws, including Quebec's Law 25, Alberta's and British Columbia's PIPA. Our privacy officer can be reached at info@MagicPay.net. Information may be stored or processed outside Canada, including in the United States, where it may be accessible to authorities under local law. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Mexico. Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, see the Aviso de Privacidad below, which includes your ARCO rights. By ticking the consent box you give express consent to processing of financial, patrimonial and sensitive data as described.

Other countries. If you apply from elsewhere, you consent to the transfer and processing of your information in the United States and with the recipients above. Where a local law gives you rights we can honor, we will. Some services may not be available in your country.

11. Children

The portal is for businesses and is not directed to anyone under 18. We don't knowingly collect information from minors.

12. Changes

We may update this Policy. Material changes will be posted with a new effective date and, where required, we'll ask for your consent again.

13. Contact

Privacy Officer, MagicPay Merchant Services, LLC, 4710 NW 2nd Ave, Suite 101, Boca Raton, FL 33431, USA · info@MagicPay.net

Mexico: DISP MP Soluciones, S. de R.L. de C.V., Manzana 329 Lote 9, Carretera Federal Cancún–Tulum, Edif. Terramar, Local 36AB, El Tigrillo, Playa del Carmen, Solidaridad, Quintana Roo 77717, México · info@MagicPay.net