Privacy Policy

Introduction

This Privacy Policy describes how TensorRail, based in Limassol, Cyprus (“we”, “us”, “our”) collects, uses, and protects information when you use our payment orchestration platform and related services. We operate TensorRail as a technology platform that facilitates payment processing through integration with payment service providers (processors). This policy applies to our website, API, dashboards, and any communication with us.

Information We Collect

We collect the following categories of information. The lawful basis under the GDPR for each category is stated alongside it.

Account information

Company name, contact person name, email address, phone number, billing address, and other details you provide when registering or managing your account. Lawful basis: Article 6(1)(b) (performance of our contract with you).

KYB and onboarding information

To meet our Know-Your-Business (KYB) and anti-money-laundering (AML) obligations when onboarding a merchant, we collect and store merchant corporate documents (such as certificate of incorporation and registry extracts) and, for your directors, corporate officers, and Ultimate Beneficial Owners (UBOs): identity documents, passport or national-ID document numbers, date of birth, nationality, and beneficial-ownership percentage. These documents are stored encrypted at rest on EU-based object storage (EEA region) and access is restricted to authorised compliance and onboarding personnel. Lawful basis: Article 6(1)(c) (compliance with a legal obligation, AML/KYB record-keeping) and Article 6(1)(f) (our legitimate interest in fraud prevention and onboarding integrity).

API usage data

API calls, endpoints used, timestamps, IP addresses, and related technical logs necessary to operate, secure, and improve the platform. Lawful basis: Article 6(1)(f) (our legitimate interest in operating and securing the platform).

Transaction metadata

Transaction IDs, amounts, currencies, status, and response codes. We do not collect or store payment card numbers, CVVs, or full bank account details. Card data is captured directly in secure fields within the customer's browser and never passes through TensorRail infrastructure. Lawful basis: Article 6(1)(b) (performance of our contract with you); where we act as a processor on your behalf, you (the merchant) are the controller and rely on your own lawful basis for any end-customer data.

Technical data

When you visit our website or use our dashboards: browser type, device information, and IP address, for security and operational purposes. Lawful basis: Article 6(1)(f) (our legitimate interest in website and platform security).

Communication data

Support tickets, emails, and other correspondence you send to us. Lawful basis: Article 6(1)(f) (our legitimate interest in responding to and managing communications) and, where relevant, Article 6(1)(b).

Information We Do Not Collect

We do not collect payment card numbers, CVVs, or bank account details. These are captured directly in secure fields in the customer's browser and transmitted for processing without passing through TensorRail. Our core orchestration service is designed to operate on transaction metadata rather than end-customer identity data. Where you (the merchant) instruct us to do so, we may, acting as a processor on your behalf, handle limited optional end-customer details (such as a name, email address, phone number, billing reference, or IP address) where you choose to send them with a transaction; in those cases you remain the controller of that data. We do not use end-customer personal data for our own purposes.

How We Use Information

We use the information we collect to:

• Provide and improve the TensorRail platform and services
• Deliver error intelligence, routing optimization, and analytics
• Bill and invoice you and manage your account
• Monitor for security incidents and prevent fraud and abuse
• Comply with applicable laws and respond to lawful requests

Our Role: Controller and Processor

TensorRail acts as a data controller for its own business data, including your account information, KYB/onboarding data, website-visitor data, and communications with us. TensorRail acts as a data processor on your behalf where it processes transaction metadata (and any optional end-customer details you choose to send) to provide orchestration, routing, and support; in that capacity you (the merchant) are the controller. Our processing as your processor is governed by a Data Processing Agreement (DPA) which forms part of your merchant agreement and sets out our obligations, the approved sub-processors, and the technical and organisational measures we apply.

Data Sharing and Sub-Processors

We do not sell your data. We may share information only as follows: (1) with processors as instructed by you to execute payment operations; (2) with the infrastructure and service providers (sub-processors) listed below, who process data on our behalf under written agreements; (3) with legal or regulatory authorities when required by law. We require all such parties to protect your information in line with this policy and applicable law.

Our current sub-processor categories and the transfer mechanism for each are:

• EU infrastructure hosting provider (Germany / EEA): infrastructure hosting, database hosting, and encrypted storage of KYB/onboarding documents. Within the EEA; no international transfer.
• Global content-delivery and security network: CDN, DDoS protection, WAF, DNS, and delivery of website contact-form submissions to TensorRail. EEA edge locations are used where available; any transfer outside the EEA is covered by Standard Contractual Clauses (SCCs).
• Cloud key-management service: encryption key management. Transfers, where applicable, are covered by Standard Contractual Clauses (SCCs).

In addition, the payment service providers you route transactions to (and any optional fraud-screening providers enabled for your account at your request) process transaction data as sub-processors under your own configuration and instructions; each maintains its own data protection terms and transfer safeguards.

The complete, current list of sub-processors is maintained as part of our Data Processing Agreement (DPA) and is provided to merchants on request; we notify merchants in advance of any change in accordance with the DPA.

Data Security

We use TLS 1.2 or higher for all data in transit and industry-standard encryption for data at rest. Access to systems and data is restricted by role, and we maintain audit logs of administrative and payment-related operations. Your processor credentials are stored encrypted in isolated, access-controlled environments and are never shared between merchants or with third parties except as necessary to perform the services you have requested.

Data Retention

We retain transaction metadata for up to 7 years where required for regulatory and compliance purposes. API and operational logs are retained for 90 days. Account data is retained for the duration of our agreement and for one year thereafter, unless a longer retention period is required by law. KYB and onboarding documents are retained for the period required by applicable anti-money-laundering and KYB record-keeping rules, after which the encrypted documents are securely deleted from storage.

Your Rights (GDPR)

If you are in the European Economic Area or otherwise subject to GDPR, you have the right to access, rectify, erase, restrict processing, object to processing, and to data portability where applicable. Where TensorRail processes data as a processor on behalf of a merchant (for example, transaction metadata or any optional end-customer details), the merchant is the controller: if you are an end customer, please direct your request to the merchant you transacted with, and we will assist that merchant in responding. For data where TensorRail is the controller (such as your account or KYB data, or our business contacts), you may exercise these rights by contacting us at legal@tensorrail.com. Some rights, in particular erasure of KYB/AML records and transaction metadata, may be limited where we are legally required to retain the data. You also have the right to lodge a complaint with a supervisory authority.

International Transfers

Data is processed primarily within the European Economic Area (EEA). A limited number of our sub-processors operate outside the EEA (for example, certain content-delivery and key-management infrastructure); any such transfer is carried out under Standard Contractual Clauses (SCCs) or another appropriate safeguard or adequacy decision.

Cookies

Our use of cookies and similar technologies is described in our Cookie Policy. Please refer to that policy for details.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice in your dashboard. The “Last updated” date at the top of this page will be revised accordingly.

Contact

For privacy-related questions or to exercise your rights, contact us at legal@tensorrail.com. TensorRail, Limassol, Cyprus.