OptiPay360, a platform operated by Optimum Payment Solutions
Effective Date: June 23, 2026 | Last Updated: October 21, 2026
1. Introduction
This Privacy Policy describes how Optimum Payment Solutions ("Optimum," "we," "us," or "our"), operator of the OptiPay360 platform ("OptiPay360," the "Platform," or the "Service"), collects, uses, discloses, and protects information. By accessing or using the Platform, you agree to the practices described in this Policy.
OptiPay360 is a payment and business management platform provided to merchants and other businesses ("Merchants," "you," or "your"). This Policy applies both to Merchants who use the Platform and to information about Merchants' own customers ("End Customers") that is processed through the Platform.
Two-tier data relationship. We act as a data controller with respect to the account, business, and personal information of Merchants who use the Platform. We act as a data processor / service provider with respect to End Customer information that Merchants enter into or process through the Platform — Merchants are responsible as the controller of their own customers' data. Merchants are responsible for having a lawful basis and appropriate disclosures/consent for the End Customer data they process through OptiPay360.
2. Information We Collect
Information Merchants provide:
- Business identity information (legal name, address, EIN/tax ID, business type)
- Account holder and authorized user information (name, email, phone, login credentials)
- Payment gateway and processing credentials and configuration
- Banking/settlement details necessary for payment processing
End Customer information Merchants process through the Platform:
- Customer name, email address, phone number, billing/shipping address
- Transaction, invoice, estimate, and appointment details
- Payment card data (handled per Section 5) and payment history
- SMS/communication consent status
Information collected automatically:
- Log data, device/browser information, IP address
- Usage data and interactions with the Platform
- Cookies and similar technologies (see Section 9)
3. How We Use Information
We use information to:
- Provide, operate, maintain, and improve the Platform
- Process payments, invoices, estimates, refunds, and settlements
- Send transactional communications (receipts, invoice/payment notifications, appointment confirmations) by email and, where consent exists, SMS
- Authenticate users and secure accounts
- Detect, prevent, and address fraud, security issues, and prohibited activity
- Provide support and respond to inquiries
- Comply with legal, regulatory, tax, and card-network obligations
We do not sell personal information. We do not use End Customer data for our own marketing.
4. How We Share Information
We share information only as necessary to operate the Service:
- Payment processors and gateways (e.g., NMI and associated processors) to process transactions
- Communications providers (e.g., Twilio for SMS, email service providers) to deliver notifications
- Infrastructure and service providers (hosting, database, security) under appropriate confidentiality and data-protection obligations
- As required by law, legal process, or to protect rights, safety, and security
- In connection with a business transfer (merger, acquisition, or sale of assets), subject to this Policy
- Notification providers (Apple, Google and Expo), to deliver mobile app notifications you have turned on
Third parties acting as our service providers are authorized to use information only to perform services for us.
5. Payment Card Data & Security
Payment card data is handled in accordance with applicable Payment Card Industry Data Security Standard (PCI DSS) requirements. Sensitive cardholder data is processed through tokenization and secure, hosted payment fields provided by our payment gateway; we minimize our handling and storage of raw card data. We maintain administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
6. SMS / Text Messaging Data
Where SMS messaging is used, mobile phone numbers and messaging consent status are collected and processed solely to deliver transactional messages related to the recipient's transactions, invoices, estimates, receipts, and appointments. Consent is captured by the Merchant at the point of service. Mobile information is not shared with third parties for their marketing or promotional purposes. Message and data rates may apply. Recipients may opt out at any time by replying STOP. See our Messaging Terms for details.
Mobile App
Optimum Payment Solutions offers the OptiPay360 mobile app for iPhone and Android to Merchants and their staff. The app uses the same OptiPay360 account and is covered by this Policy. In addition to the information described above, the app handles the following.
Signing in. Accounts are created through the OptiPay360 website. You sign in to the app with the email and password of your OptiPay360 login.
Payments taken in the app. When you key in a card, the card number goes from the app directly to our payment processor (NMI) and is turned into a one-time token. We receive that token, the card brand, the first six to eight digits (to tell a credit card from a debit card) and the last four digits, never the full card number or security code. With Tap to Pay on iPhone, the card or digital wallet is read by Apple's secure technology on the iPhone and sent to the processor; we receive the payment result, not the card number. When you accept a bank payment, the routing and account numbers pass through our servers to the processor to create a token and are not stored by us.
Location. On Android, the app does not use your location. On iPhone, Tap to Pay on iPhone asks for your location while the app is in use, never in the background, because the card networks require it for contactless payments on a phone. It is used by our payment processor's Tap to Pay software to approve Tap to Pay on your iPhone; it is not sent to or stored by OptiPay360.
Notifications. If you turn on notifications, the app sends us a notification token for your device, along with the device model, operating system version and app version. We use these to deliver payment and product notifications and to tell which devices support Tap to Pay on iPhone. Notifications are delivered through Apple Push Notification service, Google Firebase Cloud Messaging and our notification provider, Expo. You can turn notifications off at any time in your phone's settings, and signing out of the app stops notifications to that device.
Photos and files. If you choose to attach a photo or document to an invoice, it is uploaded and stored with that invoice. The app uses your camera or photos only when you choose to attach something, and asks your permission the first time.
What the app does not do. The app shows no ads and contains no analytics or tracking tools. We do not sell information collected through it, and we do not use it to track you across other companies' apps or websites.
Deleting your account. You can ask to remove your login, or (business owners) to close your business account, from Settings in the app. See "Your Rights & Choices" below.
7. Data Retention
We retain information for as long as necessary to provide the Service, comply with legal, tax, and card-network obligations, resolve disputes, and enforce agreements. Merchants are responsible for their own retention obligations regarding End Customer data.
Payment, refund and invoice records, including the customer details on them, are kept for 7 years from the date of the transaction. Bank-payment authorizations are kept for 7 years after the authorization ends. After that they are deleted. We chose 7 years because it covers every rule that applies to these records: U.S. tax rules can require business records for up to 7 years; the banks and payment processors we work with must keep payment records for 5 years under federal anti-money-laundering rules; the ACH network's rules require bank-payment authorizations to be kept for 2 years after they end; and a cardholder can dispute some card payments up to 540 days later. Copies in our secure backups are deleted as those backups expire.
8. Your Rights & Choices
Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the use of your personal information, or to data portability. Merchants may exercise these rights through their account or by contacting us. Requests concerning End Customer data should generally be directed to the relevant Merchant, as the controller of that data; we will assist Merchants in responding as required.
To delete your OptiPay360 login or close your business account, use Settings in the OptiPay360 mobile app, follow the steps at optipay360.com/delete-account, or email support@optipay360.com. We confirm each request by email and complete it within 30 days. Some records are kept longer, as described under "Data Retention".
9. Cookies & Tracking
We use cookies and similar technologies to operate, secure, and improve the Platform. You can control cookies through your browser settings; disabling some cookies may affect functionality.
10. Children's Privacy
The Platform is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be indicated by updating the "Last Updated" date and, where appropriate, through additional notice. Continued use of the Platform after changes constitutes acceptance.
12. Contact Us
Optimum Payment Solutions — OptiPay360
Indianapolis, IN 46236
Email: support@optipay360.com