Privacy Policy

1. Acru’s Role in the Payment Ecosystem

Acru provides technology and services designed to help merchants access and manage payment-processing capabilities.

Depending on the product, jurisdiction, transaction, and commercial relationship involved, certain payment-processing, acquiring, banking, card-network, identity-verification, underwriting, compliance, settlement, fraud-prevention, chargeback, or other financial functions may be performed by third-party processors, acquiring banks, financial institutions, payment networks, technology providers, or other partners.

Acru may provide the merchant-facing interface through which information is submitted to these partners. For example, information submitted through an Acru merchant application may be transmitted to one or more payment-processing or financial partners for:

• Know Your Business (“KYB”) verification;
• Know Your Customer (“KYC”) or identity verification;
• Beneficial ownership verification;
• Merchant underwriting;
• Fraud and risk analysis;
• Anti-money laundering or sanctions screening where applicable;
• Payment processing;
• Card tokenization;
• Settlement;
• Payouts;
• Chargeback and dispute management;
• Transaction monitoring; and
• Compliance with applicable laws, payment-network rules, or financial-institution requirements.

Those organizations may process Personal Information under their own privacy policies and legal obligations. Acru does not control the independent privacy practices of banks, card networks, payment processors, or other financial institutions when they process information independently from Acru.

2. When Acru Acts for a Merchant

In certain circumstances, Acru may process Personal Information on behalf of a merchant or other business customer. For example, a merchant may transmit information about its customers to Acru through an integration, API, dashboard, payment flow, or other Service.

When Acru processes Personal Information solely on behalf of a merchant, the merchant may be the “controller” or “business,” and Acru may be a “processor” or “service provider,” as those terms are defined by applicable privacy laws.

If you are a customer of an Acru merchant and have questions about how that merchant uses your Personal Information, you should review the merchant’s privacy policy and contact the merchant directly.

Where required or appropriate, Acru will assist merchants in responding to privacy requests concerning Personal Information that Acru processes on their behalf.

Acru may separately act as a controller or business with respect to information that Acru uses for its own legitimate purposes, including fraud prevention, security, legal compliance, platform administration, billing, merchant risk management, and protection of Acru and its partners.

3. Personal Information We Collect

The information Acru collects depends on how you interact with the Services.

A. Identification and Contact Information

• First and last name;
• Business name;
• Business address;
• Residential address where required;
• Mailing address;
• Email address;
• Telephone number;
• Date of birth;
• Username or account identifier;
• Job title;
• Employer;
• Professional role;
• Signature; and
• Other contact or identification information you provide.

B. Merchant and Business Information

For merchants and prospective merchants, we may collect:

• Legal business name;
• DBA or trade name;
• Entity type;
• Formation jurisdiction;
• Business address;
• Business website;
• Business telephone number;
• Business email;
• Industry;
• Products or services offered;
• Merchant category;
• Processing history;
• Estimated and actual payment volume;
• Average and maximum transaction amounts;
• Customer geography;
• Business model;
• Fulfillment information;
• Refund policies;
• Chargeback history;
• Financial statements;
• Bank statements;
• Processing statements;
• Corporate formation documents;
• Licenses;
• Articles of incorporation or organization;
• Ownership information;
• Beneficial ownership percentages;
• Officer and director information;
• Tax information;
• Employer identification numbers;
• Merchant identification numbers;
• Existing processor information;
• Settlement preferences;
• Merchant risk information; and
• Other information required to evaluate or support a merchant relationship.

C. Identity Verification and Compliance Information

Depending on the Services and requirements imposed by Acru or our financial partners, we may collect or facilitate the collection of:

• Date of birth;
• Social Security number or portions thereof;
• Tax identification number;
• Passport information;
• Driver’s license information;
• State or national identification information;
• Copies or images of identification documents;
• Proof of address;
• Beneficial ownership information;
• Corporate ownership records;
• Identity-verification results;
• Sanctions-screening results;
• Watchlist-screening results;
• Fraud-risk indicators;
• Verification status;
• Compliance records; and
• Other information required for KYC, KYB, underwriting, fraud prevention, or legal compliance.

Certain information in this category may constitute Sensitive Personal Information under applicable privacy laws. Identity verification may be conducted directly by a third-party verification, financial, or compliance provider rather than Acru.

D. Financial and Banking Information

We may collect or facilitate the collection of:

• Bank account and routing information;
• Settlement account information;
• Account ownership information;
• Payout information;
• Transaction records;
• Settlement records;
• Refund information;
• Chargeback information;
• Reserve information;
• Account balances;
• Payment history;
• Revenue information;
• Fees;
• Commissions;
• Affiliate earnings;
• Payout history;
• Billing information; and
• Related financial records.

E. Payment and Transaction Information

When a transaction is processed through payment functionality associated with Acru, we or our payment partners may collect:

• Transaction amount;
• Currency;
• Date and time;
• Merchant;
• Transaction identifier;
• Authorization status;
• Payment method;
• Card brand;
• Expiration information;
• Last four digits or other masked payment-account information;
• Payment token;
• Billing information;
• Shipping information where applicable;
• Refund information;
• Dispute information;
• Chargeback information;
• Settlement information;
• Fraud indicators;
• Device information; and
• Other transaction metadata.

Full payment-card credentials may be submitted directly to payment processors, tokenization providers, acquiring partners, or other PCI-compliant payment infrastructure. Depending on the integration, Acru may receive a token or limited payment information rather than the complete payment-card number.

F. Fraud, Security, and Risk Information

We and our partners may collect information used to identify fraud, abuse, account takeover, suspicious transactions, or other security risks, including:

• IP address;
• Device identifiers;
• Browser characteristics;
• Operating system;
• Device type;
• Approximate location derived from IP address;
• Transaction velocity;
• Login activity;
• Session information;
• Behavioral signals;
• Payment attempts;
• Failed transactions;
• Fraud scores;
• Risk scores;
• Chargeback history;
• Dispute patterns;
• Account relationships;
• Merchant behavior;
• Customer behavior associated with transactions;
• Authentication results; and
• Information received from fraud-prevention, identity-verification, payment-network, and financial partners.

G. Account and Portal Information

If you use an Acru account, merchant portal, affiliate portal, administrative portal, or dashboard, we may collect:

• Account credentials;
• User permissions;
• Login history;
• Security settings;
• Authentication information;
• Merchant assignments;
• Referral relationships;
• Commission information;
• Reports;
• Dashboard activity;
• Configuration settings;
• Support requests;
• Notifications;
• Account preferences; and
• Actions taken within the Services.

Passwords are intended to be maintained in protected form rather than readable plaintext.

H. Affiliate and Referral Information

For affiliates, referral partners, agents, or similar users, we may collect:

• Contact information;
• Business information;
• Referral links or codes;
• Referred merchant information;
• Referral activity;
• Attribution data;
• Commission information;
• Earnings;
• Payment and payout information;
• Tax documentation;
• Affiliate account information; and
• Communications with Acru.

I. Communications and Support Information

If you communicate with Acru, we may collect:

• Emails;
• Chat messages;
• Support tickets;
• Telephone communications;
• Feedback;
• Survey responses;
• Documents provided to support personnel; and
• Other communications.

Calls or support interactions may be recorded or monitored where permitted by law and where appropriate notice has been provided.

J. Website and Device Information

When you use the Services, we may automatically collect:

• IP address;
• Browser type;
• Browser language;
• Operating system;
• Device type;
• Device identifier;
• Referring URL;
• Pages viewed;
• Features used;
• Links clicked;
• Date and time of access;
• Session duration;
• Approximate geographic location;
• Cookie identifiers;
• Advertising identifiers;
• Analytics information; and
• Other technical information concerning your interaction with the Services.

K. Information from Third Parties

We may receive Personal Information from:

• Merchants;
• Customers;
• Affiliates and referral partners;
• Payment processors;
• Acquiring banks;
• Financial institutions;
• Card networks;
• Fraud-prevention providers;
• Identity-verification providers;
• KYB/KYC providers;
• Compliance vendors;
• Credit or risk-information providers where legally permitted;
• Business-information providers;
• Public records;
• Government databases;
• Sanctions and watchlist databases;
• Service providers;
• Marketing partners;
• Professional advisers; and
• Other parties with whom you authorize us to interact.

4. How We Use Personal Information

Provide the Services

• Create and maintain accounts;
• Provide merchant dashboards and portals;
• Support APIs and integrations;
• Facilitate merchant onboarding;
• Process merchant applications;
• Facilitate payments;
• Facilitate settlements and payouts;
• Process refunds;
• Manage disputes and chargebacks;
• Calculate fees and commissions;
• Provide reporting and analytics; and
• Provide customer and merchant support.

Underwrite and Manage Merchant Relationships

• Evaluate merchant applications;
• Verify business information;
• Evaluate merchant risk;
• Monitor transaction activity;
• Monitor chargeback ratios;
• Monitor processing volume;
• Monitor merchant compliance;
• Establish or adjust merchant settings, limits, reserves, pricing, or other risk controls where permitted;
• Communicate application decisions; and
• Maintain relationships with payment and financial partners.

Verify Identity and Comply with Legal Requirements

• Perform or facilitate KYC and KYB;
• Verify beneficial ownership;
• Conduct sanctions screening;
• Conduct fraud screening;
• Comply with payment-network requirements;
• Comply with financial-institution requirements;
• Respond to subpoenas, court orders, regulatory requests, or other lawful requests; and
• Maintain records required by law.

Prevent Fraud and Protect the Services

• Authenticate users;
• Prevent account takeover;
• Detect fraudulent transactions;
• Detect suspicious activity;
• Prevent unauthorized access;
• Investigate security incidents;
• Enforce transaction limits;
• Protect merchants and customers;
• Protect Acru and our partners; and
• Maintain the integrity of the payment ecosystem.

Operate and Improve Acru

• Monitor performance;
• Troubleshoot errors;
• Improve user interfaces;
• Improve onboarding;
• Develop new products;
• Perform analytics;
• Conduct research;
• Measure feature usage;
• Maintain infrastructure; and
• Train personnel.

Where permitted by law, we may use aggregated or deidentified data for analytics, research, product development, risk modeling, and other legitimate business purposes.

Communicate With You

• Provide account notifications;
• Provide transaction notifications;
• Respond to questions;
• Provide support;
• Send security alerts;
• Communicate application or account status;
• Provide legal or policy notices;
• Announce changes to the Services; and
• Send marketing communications where permitted by law.

Protect Legal Rights

• Enforce agreements;
• Collect amounts owed;
• Investigate disputes;
• Establish, exercise, or defend legal claims;
• Prevent misuse of the Services;
• Investigate violations of our policies; and
• Protect Acru, our users, merchants, partners, and the public.

5. Automated Risk Analysis and Decision-Making

Acru and our partners may use automated systems, algorithms, rules, risk models, or other technologies to help:

• Detect fraud;
• Authenticate users;
• Identify suspicious transactions;
• Evaluate merchant risk;
• Monitor transaction patterns;
• Determine whether transactions should be subject to additional review;
• Identify potential violations of payment-network rules;
• Detect account takeover;
• Prioritize manual review; and
• Support underwriting, compliance, or security decisions.

Automated systems may consider information such as transaction history, merchant activity, device information, fraud signals, account information, chargeback patterns, processing behavior, identity-verification results, and information supplied by financial or fraud-prevention partners.

In some cases, a bank, processor, card network, or other independent partner may make its own decision concerning merchant approval, transaction authorization, account restrictions, settlement, or other financial matters.

Where applicable law grants rights concerning qualifying automated decision-making or profiling, you may exercise those rights as described in the Your Privacy Rights section below.

6. How We Disclose Personal Information

We may disclose Personal Information to the following categories of recipients.

Payment Processors and Payment Infrastructure Providers

We may disclose information to payment processors, gateways, tokenization providers, settlement providers, payout providers, and other companies involved in providing payment services.

Acquiring Banks and Financial Institutions

Information may be disclosed to acquiring banks, sponsor banks, banking partners, and other financial institutions in connection with underwriting, processing, settlement, compliance, and risk management.

Card Networks and Payment Networks

We may disclose transaction and related information to payment networks such as Visa, Mastercard, American Express, Discover, or other applicable networks when necessary to process payments or comply with network rules.

Identity, KYB, KYC, Fraud, and Compliance Providers

Information may be disclosed to vendors that provide:

• Identity verification;
• Document verification;
• Business verification;
• Beneficial ownership verification;
• Fraud prevention;
• Device intelligence;
• Risk scoring;
• Sanctions screening;
• Watchlist screening;
• Transaction monitoring; and
• Similar compliance or security services.

Merchants

When you transact with a merchant, we may disclose information relating to your transaction to that merchant as necessary to complete the transaction, provide support, process refunds, manage disputes, or prevent fraud.

Service Providers

We may use service providers for functions such as:

• Cloud hosting;
• Data storage;
• Cybersecurity;
• Customer support;
• Email;
• Communications;
• Analytics;
• Accounting;
• Billing;
• Business intelligence;
• CRM systems;
• Software development;
• Infrastructure monitoring; and
• Other business operations.

These providers may process Personal Information on our behalf subject to contractual restrictions where required.

Affiliates and Corporate Entities

We may disclose information among Acru affiliates, subsidiaries, parent entities, or entities under common ownership or control where permitted by law.

Referral and Business Partners

Where appropriate, we may disclose information with referral partners, agents, or other business partners in connection with a merchant relationship.

We do not disclose sensitive merchant underwriting, identification, or payment information to referral partners merely because they referred the merchant unless the disclosure is authorized, necessary, or otherwise permitted by law.

Professional Advisers

• Attorneys;
• Accountants;
• Auditors;
• Consultants;
• Insurers;
• Banks;
• Investors; and
• Other professional advisers.

Government and Legal Authorities

We may disclose Personal Information when we reasonably believe disclosure is necessary to:

• Comply with applicable law;
• Respond to a valid subpoena, court order, warrant, or government request;
• Cooperate with regulators;
• Investigate fraud;
• Protect against illegal activity;
• Protect the safety of any person;
• Protect Acru’s rights; or
• Establish, exercise, or defend legal claims.

Corporate Transactions

If Acru is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, investment, due diligence process, or similar corporate transaction, Personal Information may be disclosed or transferred as part of that transaction subject to applicable law.

With Your Direction or Consent

We may disclose information when you direct us to do so or otherwise provide consent.

7. Sale, Sharing, and Targeted Advertising

Acru does not sell Personal Information for monetary consideration as a core part of our business model.

We do not sell merchant KYC/KYB information, government identification information, payment credentials, or financial-account information to data brokers.

However, certain analytics, advertising, cookie, or online-marketing technologies may involve disclosures of identifiers, cookie information, device information, or internet activity that some U.S. privacy laws define as a “sale,” “sharing,” or processing for “targeted advertising,” even where no money is exchanged.

Where Acru engages in activities legally defined as sale, sharing, or targeted advertising, eligible individuals may opt out as described in this Privacy Policy and through any Your Privacy Choices mechanism provided on the applicable Acru website.

Acru will also honor qualifying browser-based opt-out preference signals, such as Global Privacy Control, where required by applicable law.

8. Sensitive Personal Information

Acru may process Sensitive Personal Information when reasonably necessary to provide payment services, perform identity verification, prevent fraud, comply with legal obligations, or protect the Services.

Sensitive Personal Information may include:

• Social Security numbers;
• Government identification numbers;
• Passport information;
• Driver’s license information;
• Financial-account information;
• Login credentials;
• Payment information;
• Precise geolocation if ever collected;
• Biometric information if collected by an identity-verification provider; and
• Other information considered sensitive under applicable law.

Acru does not use Sensitive Personal Information to infer characteristics about individuals for advertising purposes.

Where applicable law provides a right to limit certain uses or disclosures of Sensitive Personal Information, Acru will honor that right when the relevant processing falls within the scope of that right.

Certain Sensitive Personal Information may need to be retained or processed notwithstanding a privacy request when necessary to comply with fraud-prevention, security, financial, regulatory, or legal obligations.

9. Cookies and Similar Technologies

Acru and our service providers may use cookies, software development kits, pixels, local storage, and similar technologies.

Strictly Necessary Functions

• Authentication;
• Account security;
• Fraud prevention;
• Session management;
• Load balancing;
• Security; and
• Core site functionality.

Preferences and Functionality

• Language preferences;
• Account settings;
• Dashboard settings; and
• Other user preferences.

Analytics

• How users reach the Services;
• Which pages are viewed;
• Which features are used;
• How users navigate the Services;
• Performance issues; and
• How we can improve our products.

Advertising and Marketing

Where used, advertising technologies may help Acru:

• Measure advertising campaigns;
• Attribute traffic;
• Understand marketing effectiveness; and
• Deliver or measure relevant advertising.

Where required by law, non-essential cookies will not be activated until appropriate consent has been obtained. You may be able to control cookies through our cookie-management tools and your browser settings. Blocking certain cookies may affect functionality.

10. Global Privacy Control and Do Not Track

Some browsers allow users to transmit privacy preference signals.

Where required by applicable law, Acru recognizes qualifying opt-out preference signals, including Global Privacy Control (“GPC”), as requests to opt out of certain sale, sharing, or targeted-advertising activities.

Because there is not currently a universally accepted legal or technical standard for all “Do Not Track” signals, Acru may not respond to traditional Do Not Track settings unless required by applicable law.

11. Marketing Communications

Acru may send marketing communications to merchants, prospective merchants, affiliates, or other business contacts where permitted by law.

You may unsubscribe from promotional email communications by using the unsubscribe mechanism included in those messages.

Even after opting out of marketing, Acru may continue sending non-promotional communications concerning:

• Your account;
• Security;
• Transactions;
• Merchant applications;
• Payments;
• Service changes;
• Legal notices;
• Compliance matters; and
• Other administrative issues.

12. Data Retention

Acru retains Personal Information for no longer than reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods depend on factors such as:

• The nature of the information;
• The sensitivity of the information;
• The nature of the relationship;
• The purposes for which the information was collected;
• Fraud and security requirements;
• Contractual requirements;
• Payment-network requirements;
• Financial-institution requirements;
• Applicable statutes of limitation;
• Regulatory requirements; and
• Legal obligations.

Generally:

Where practical, Acru may delete, anonymize, aggregate, or deidentify Personal Information when it is no longer required.

Information stored in backups may remain for a limited period until the backup is overwritten or securely deleted according to our backup practices.

13. Security

Acru uses administrative, organizational, technical, and physical safeguards designed to protect Personal Information against:

• Unauthorized access;
• Unauthorized disclosure;
• Loss;
• Misuse;
• Alteration;
• Destruction; and
• Other unauthorized processing.

Security measures may include, as appropriate:

• Encryption;
• Access controls;
• Authentication controls;
• Network security;
• Logging and monitoring;
• Vendor risk management;
• Secure software-development practices;
• Employee access restrictions;
• Security testing; and
• Incident-response procedures.

Payment-card information may be handled through payment-processing infrastructure designed to comply with applicable payment-card security requirements.

No system can guarantee absolute security. Users should protect their account credentials and promptly notify Acru if they believe an account or credential has been compromised.

14. International Data Transfers

Acru, its service providers, payment processors, financial partners, and other recipients may process Personal Information in countries different from the country in which the information was originally collected. Those countries may have privacy laws different from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, Acru will use an appropriate legal mechanism, which may include contractual protections, adequacy decisions, standard contractual clauses, or another legally recognized transfer mechanism.

15. Your Privacy Rights

Depending on where you reside and subject to applicable exceptions, you may have the right to:

• Access Personal Information we maintain about you;
• Know the categories and specific pieces of Personal Information collected about you;
• Delete certain Personal Information;
• Correct inaccurate Personal Information;
• Obtain a portable copy of certain Personal Information;
• Opt out of sale of Personal Information;
• Opt out of sharing for cross-context behavioral advertising;
• Opt out of targeted advertising;
• Opt out of qualifying profiling or automated decision-making;
• Limit certain uses of Sensitive Personal Information;
• Withdraw consent where processing is based on consent; and
• Appeal certain decisions concerning your privacy request.

You also have the right not to receive unlawful discriminatory treatment for exercising applicable privacy rights.

Rights vary by jurisdiction, and certain information may be exempt. For example, Acru may be unable to delete information that must be retained to:

• Complete a transaction;
• Maintain payment records;
• Prevent fraud;
• Protect account security;
• Resolve disputes;
• Defend legal claims;
• Comply with tax obligations;
• Comply with financial regulations;
• Comply with payment-network requirements;
• Satisfy recordkeeping obligations; or
• Fulfill another legally permitted purpose.

16. How to Exercise Your Privacy Rights

To submit a privacy request, contact Acru at legal@acru.com. Please state the type of request you wish to make and provide sufficient information for us to identify the relevant records.

We may need to verify your identity before completing certain requests. Verification may require us to confirm information reasonably associated with your account or relationship with Acru. We will not request additional information beyond what is reasonably necessary to authenticate the request.

Where permitted by law, you may use an authorized agent to submit a request. We may require evidence that the agent is authorized to act on your behalf and may separately verify your identity.

If Acru denies a privacy request and applicable law provides an appeal right, instructions for appealing the decision will be included in our response.

17. California Privacy Notice

This section supplements the remainder of this Privacy Policy for California residents. For purposes of the California Consumer Privacy Act, as amended (“CCPA”), Personal Information and Sensitive Personal Information have the meanings provided under California law.

Depending on your relationship with Acru, the categories of Personal Information Acru may collect, and may have collected during the preceding twelve months where applicable, include:

Sources of California Personal Information

We obtain this information from the sources described in Section 3, including:

• Directly from you;
• Merchants;
• Businesses with which you are associated;
• Affiliates and referral partners;
• Payment processors;
• Financial institutions;
• Fraud and identity providers;
• Service providers;
• Public sources; and
• Your device or browser.

Purposes

We collect and use these categories for the purposes described in Section 4, including providing Services, merchant onboarding, payment processing, underwriting, identity and business verification, fraud prevention, security, compliance, support, analytics, communications, and legal purposes.

Disclosure for Business Purposes

We may disclose the categories above to the recipients described in Section 6, including payment processors, banks and financial institutions, card networks, identity and fraud providers, technology service providers, merchants, professional advisers, affiliates, and government authorities.

Sale and Sharing

Acru does not sell Personal Information for monetary consideration as a core part of its business. Depending on the online marketing or analytics technologies deployed on the Services, certain disclosures of identifiers, device information, or internet activity could constitute “sharing” or “sale” under California law.

Where applicable, California residents may opt out through any Your Privacy Choices mechanism made available on the Services or by enabling a qualifying opt-out preference signal such as Global Privacy Control.

Sensitive Personal Information

Acru uses Sensitive Personal Information primarily for purposes such as providing requested Services, merchant onboarding, identity verification, financial-account administration, fraud prevention, account security, compliance, and other purposes permitted under applicable law. Acru does not use Sensitive Personal Information to infer characteristics about individuals for advertising purposes.

California Rights

Subject to applicable requirements and exceptions, California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses of Sensitive Personal Information, exercise applicable rights regarding qualifying automated decision-making, and receive equal service and pricing after exercising privacy rights. You may exercise these rights as described in Section 16.

Financial Incentives

Acru does not currently offer consumer financial incentives or price or service differences in exchange for Personal Information that require a notice of financial incentive under the CCPA.

18. Other U.S. State Privacy Rights

Residents of states with comprehensive consumer privacy laws may have additional rights under applicable state law.

Depending on your state and the nature of Acru’s processing, these may include rights to:

• Confirm whether Personal Information is processed;
• Access Personal Information;
• Correct Personal Information;
• Delete Personal Information;
• Obtain portable data;
• Opt out of targeted advertising;
• Opt out of the sale of Personal Information;
• Opt out of certain profiling;
• Revoke consent for certain sensitive-data processing; and
• Appeal a denied privacy request.

Acru will process valid privacy requests in accordance with the law applicable to the individual submitting the request.

19. European Economic Area, United Kingdom, and Similar Jurisdictions

Where the European Union General Data Protection Regulation, United Kingdom GDPR, or similar law applies, Acru processes Personal Data under one or more lawful bases.

Performance of a Contract

• Provide the Services;
• Maintain accounts;
• Process transactions;
• Support merchants;
• Process applications; or
• Fulfill contractual obligations.

Legitimate Interests

We may process Personal Data when necessary for legitimate interests such as fraud prevention, security, product improvement, merchant-risk management, business administration, analytics, customer support, network protection, and establishment or defense of legal claims. We consider the impact on individual privacy rights when relying on legitimate interests.

Legal Obligation

• Applicable laws;
• Court orders;
• Regulatory obligations;
• Tax obligations;
• Payment-network rules;
• Fraud-prevention requirements;
• Financial-industry obligations; and
• Other legal requirements.

Consent

Where required, Acru may process Personal Data based on your consent. Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing lawfully conducted before withdrawal.

EEA/UK Rights

Subject to applicable law, you may have rights to:

• Access Personal Data;
• Correct Personal Data;
• Delete Personal Data;
• Restrict processing;
• Object to processing;
• Receive portable Personal Data;
• Withdraw consent; and
• Exercise rights concerning certain automated decisions.

You may also have the right to lodge a complaint with the data-protection authority in the jurisdiction where you reside, work, or believe an infringement occurred.

20. Information Concerning Merchant Customers

If you are an individual who paid a merchant using payment functionality made available through an Acru-related integration, your Personal Information may be processed by several parties, including:

• The merchant;
• Acru;
• A payment processor;
• An acquiring bank;
• A card network;
• A fraud-prevention provider; and
• Other payment infrastructure providers.

Each organization may have different legal responsibilities and independent purposes for processing information.

For questions about a purchase, refund, subscription, product, service, or merchant’s use of your information, contact the merchant directly. For questions specifically concerning Acru’s processing of your Personal Information, contact us using the information below.

21. Children

The Services are intended for businesses and individuals legally capable of entering into the applicable commercial relationship and are not directed to children.

Acru does not knowingly solicit or collect Personal Information directly from children under 13 in violation of applicable law.

If you believe a child has provided Personal Information to Acru inappropriately, please contact us. We will investigate and, where required, delete the information.

Certain payment transactions initiated through third-party merchants may involve information about individuals whose age Acru does not independently know. Merchants are responsible for complying with age restrictions and children’s privacy laws applicable to their own products and services.

22. Third-Party Websites and Services

The Services may link to or integrate with third-party websites, applications, processors, banks, identity providers, or other external services.

Acru is not responsible for the privacy practices of third parties acting independently. We encourage you to review the privacy notices of third-party services before providing Personal Information to them.

23. Business-to-Business Information

Acru primarily operates in a business and payments environment.

We may process information concerning employees, representatives, beneficial owners, directors, officers, agents, and other individuals associated with businesses with which Acru interacts.

We may use this information to:

• Manage commercial relationships;
• Conduct merchant onboarding;
• Verify authority;
• Perform due diligence;
• Provide support;
• Communicate regarding products and services;
• Maintain records; and
• Meet compliance obligations.

Individuals whose information is processed in a business context may have privacy rights depending on applicable law.

24. Deidentified and Aggregated Information

Acru may create aggregated or deidentified information that cannot reasonably be used to identify an individual.

We may use such information for:

• Analytics;
• Benchmarking;
• Product development;
• Fraud research;
• Risk analysis;
• Business intelligence;
• Statistical analysis; and
• Other lawful purposes.

Where required by applicable law, Acru will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted by law.

25. Changes to This Privacy Policy

Acru may update this Privacy Policy periodically to reflect changes to the Services, our information practices, our partners, applicable laws, regulatory requirements, or other operational changes.

When we make changes, we will update the Last Updated date at the top of this Privacy Policy.

If changes materially affect the way we use Personal Information, we will provide additional notice where required by law.

Your continued use of the Services after an updated Privacy Policy becomes effective does not constitute consent where applicable law requires separate consent.

26. Contact Acru

Questions about this Privacy Policy, Acru’s privacy practices, or requests to exercise applicable privacy rights may be directed to:

Acru, Inc.

Privacy / Legal Team

Email: legal@acru.com

Website: acru.com

Mailing Address:

8 The Greene STE A

Dover, Delaware 19901

United States

For privacy requests, please include sufficient information for Acru to identify your relationship with us and the nature of your request.

Please do not send full payment-card numbers, passwords, Social Security numbers, or copies of identification documents to legal@acru.com unless Acru specifically instructs you to use a secure method for submitting that information.