Check Terminal Privacy Policy

The short version

• We collect what we need to run Check Terminal: your account details, your company's details, the bank accounts, vendors and checks you set up, and records of what happens in your account.
• We encrypt bank routing and account numbers, your company's EIN and QuickBooks access tokens before storing them in our database. The check PDFs and Positive Pay files you generate contain your full bank numbers, because your bank needs them.
• We do not sell your personal information or share it for cross-context behavioral advertising. We do not use advertising or analytics trackers.
• We use a small set of service providers to host, secure and run the Service. They are listed below.
• We keep your data until you ask us to delete it, or until we delete it after an account ends under our Terms. We do not delete it automatically after a set period. To request deletion, email [Privacy email]. We keep activity logs for security and legal reasons, even after other data is deleted.
• Information you load about your vendors, payees, employees and others belongs to your business. We process it on your behalf.

Who we are and what this policy covers

[Company legal name] operates Check Terminal. This policy covers our website at checkterminal.com and the Check Terminal web application, including sign-up, sign-in and the emails we send. Together, we call these the "Service."

The Service is for businesses in the United States and the people who work for them or on their behalf, such as owners, employees, bookkeepers and accountants. It is not meant for personal or household use.

This policy does not cover third-party services that you choose to connect or use, such as QuickBooks Online or your bank. Their own privacy policies apply.

Our role with information you load about others

When you use the Service, you enter information about other people. Examples include the vendors and payees you write checks to, the employees you pay by check, the people whose signatures you upload and the people you invite to your team. Invoices and other files you attach can also contain information about other people. We call this "Customer Data."

For Customer Data, we act as a service provider (also called a processor) to the business customer that holds the account. We process it on the customer's behalf and follow the customer's instructions. Our Terms of Service at checkterminal.com/terms, including their data processing terms, govern how we handle Customer Data. As a service provider, we will:

• Process Customer Data only to provide the Service to the customer, and for the limited other purposes the law allows, such as security, fraud prevention, debugging, legal compliance and creating de-identified, aggregated statistics to improve the Service.
• Not sell or share Customer Data, and not use it for advertising.
• Not keep, use or disclose Customer Data outside our direct business relationship with the customer, except as the law permits.
• Not combine Customer Data with personal information we get from other sources, except as the law permits.
• Comply with applicable state privacy laws, protect Customer Data as those laws require, and tell the customer if we can no longer meet these obligations.
• Let the customer take reasonable steps to stop and fix any unauthorized use of Customer Data.
• Help the customer respond to privacy requests about Customer Data.

We also keep limited Customer Data for our own security, fraud-prevention and legal purposes. For example, our activity logs record payee names, addresses and amounts when checks and vendors change. We keep these records as described in "How long we keep information," including after a customer deletes its data.

If you are a customer, you are responsible for having the right to give us Customer Data. You are also responsible for giving any notices and getting any permissions the law requires. This includes having authority to use each signature you upload. If you are a bookkeeper or accountant using the Service for a client, you are responsible for having your client's authorization to load and manage the client's data.

We act as a business (also called a controller) for information about you as a user of the Service. This includes your account details, your sign-in activity, your billing relationship with us and the security records we keep. This policy describes how we use it.

Records of your activity inside a customer's company, such as checks you created or approved and comments you left, also belong to that company. The company's administrators can see them. If you ask us to delete them, we may need the company's instructions first.

If you are a payee, vendor or employee of one of our customers and have a question about your information, please contact that business first. If you contact us, we will forward your request to the customer or help the customer respond, where we can.

Information we collect

We collect the following categories of information. Some of it identifies a person. Some of it is business information about a company.

• Account and contact information. This includes your name, email address, account type (business owner or bookkeeper) and notification preferences. Our sign-in provider, Clerk, holds your password, multi-factor authentication settings, active sessions and any profile photo you add. We do not store your password in our own database.
• Contact form messages. If you write to us through the contact page on our website, we collect your name, email address, company, industry and message, and use them only to reply to you and follow up on your request.
• Company details. This includes your company's name, mailing address and phone number. You can also choose to enter your company's Employer Identification Number (EIN). We encrypt the EIN before storing it. The Service does not show it again after you save it, print it on checks or send it to anyone. Enter your business's EIN only. Do not enter a Social Security number. We also keep your company's plan, usage counts (such as how many checks it printed this month) and account status.
• Bank account information. For each bank account, this includes its nickname, bank name, routing number, account number and the last four digits of the account number, plus check numbering and memo settings. We encrypt routing and account numbers before storing them. Account screens show only the last four digits.
• Payee and vendor information. This includes the names and mailing addresses of the people and businesses you pay, and how they map to QuickBooks vendors and expense accounts. The Service has no fields for payee email addresses or phone numbers.
• Check and transaction information. For each check, this includes the payee, amount, date, memo, check number, invoice number and line items (date, description, quantity, unit price and total). It also includes the check's status and a history of who created, submitted, approved, rejected, printed, voided or deleted it, with any comments or reasons. We also keep records of the files you generate, such as check PDFs, register exports and Positive Pay files.
• Generated files. A check PDF includes your company name and address, the bank name, the payee, amount, date and memo, your signature image, and a MICR line with your full routing and account numbers. A Positive Pay file includes check numbers, dates, amounts, payee names and your full account number. It also includes your routing number when your bank's format requires it. A register export includes check numbers, dates, payees, amounts, statuses, memos and bank account nicknames. The Service creates voided-check PDFs (for setting up direct deposit or electronic payments) on demand and does not store them.
• Signatures. This includes the signature images you upload (PNG or JPG) and the name you give each signature.
• Uploaded attachments. This includes invoices, receipts and other PDF, JPG or PNG files you attach to checks, along with their file names and sizes. These files can contain any information you include in them.
• Team and invitation information. This includes the email address and role of each person you invite, who invited them and when, and whether they accepted. It also includes each member's role in each company. Approval flows and scheduled reports can also name specific team members.
• QuickBooks information, if you connect it. This includes your QuickBooks company ID and company name, encrypted access tokens and connection status. We import vendor names and billing addresses, account names from your chart of accounts, and recent checks and bill payments (vendor name, amount, date and document number), including transactions created outside Check Terminal.
• Billing information, if you subscribe to a paid plan. This includes your plan, subscription status, billing period dates, and customer and subscription IDs from our payment providers. You enter your payment card details into forms run by Clerk and Stripe, and they process them. Your card details never reach our servers.
• Usage, device and log information. When you take an action in the Service, we record who did it, what changed (for example, an old and a new address or amount) and when. We also record views and downloads, such as when someone opens or downloads a check PDF or creates an export or Positive Pay file. These records include your IP address and browser user agent. We also use your IP address to limit how many requests can be made. Our hosting provider processes standard request information, such as IP address, browser type, the page or address requested and the time.
• In-app notifications. These are messages about approvals. They can include payee names, amounts and rejection reasons.
• Communications. If you email us or contact support, we keep your message, your contact details and our reply.

The Service does not ask for Social Security numbers or driver's license numbers, and it does not collect precise location. Payment card numbers never reach our servers.

Where we get information

• From you, when you sign up, set up your company, add bank accounts, vendors and checks, upload or import files, or contact us.
• From your company's administrators and teammates. For example, an administrator may invite you by email and assign your role, and teammates may enter or approve checks.
• From our sign-in provider, Clerk, which shares your name, email address and account status with us when you sign up or change your profile.
• From our billing providers, Clerk and Stripe, which tell us your plan and subscription status if you subscribe to a paid plan.
• From QuickBooks Online, if you connect it, as described above. Intuit may also notify us when synced transactions are deleted or voided in QuickBooks.
• Automatically, from your browser or device when you use the Service. This includes your IP address and browser user agent.
• From the Service itself, which creates check numbers, PDFs, Positive Pay files, exports, notifications and activity logs.

How we use information

• To provide the Service. This includes creating checks and routing them for approval, generating printable check PDFs and voided checks, building Positive Pay files and exports, and importing files you upload.
• To keep your company's profile, which identifies the business that holds the account and appears on your checks. If you provide an EIN, we store it, encrypted, only as part of that profile.
• To create and secure your account, sign you in, and manage your companies, teams, roles and permissions.
• To send service messages, such as approval requests and decisions, the scheduled reports you set up, team invitations, and sign-in and security emails.
• To sync with QuickBooks Online, when you connect it and ask us to.
• To manage subscriptions and apply plan limits, such as counting the checks each company prints each month.
• To keep an activity log, so your company and we can see who did what and when.
• To protect the Service and our customers. This includes limiting request rates, preventing duplicate checks, and detecting and investigating fraud, abuse or security incidents. If we suspect fraud or misuse, our team may pause check activity on an account.
• To answer your questions and provide support.
• To maintain, troubleshoot and improve the Service.
• To create de-identified, aggregated statistics about use of the Service that do not identify any person, business, client or payee, and to use them to run and improve the Service.
• To comply with the law, respond to lawful requests, enforce our Terms, and protect our rights and the rights of others.

We do not use your information for advertising. We do not use the payee, vendor, check or bank information you load to contact your payees or market to them.

How we share information

We share information only as described in this section.

Service providers (subprocessors). We use the following companies to run the Service. They process information on our behalf, under their agreements with us, to provide their services to us.

• Clerk handles sign-up, sign-in, passwords, multi-factor authentication, sessions and profiles. It also manages company (organization) records and team invitations, and runs subscription billing through Clerk Billing. Clerk receives your name, email address and sign-in information, any profile photo, company names, team roles and the email addresses of people you invite. It processes each sign-in request, including your IP address, browser and device information. It also sends sign-in and invitation emails.
• Stripe processes subscription payments if you subscribe to a paid plan, either through Clerk Billing or directly. Stripe receives the payment and billing details you enter at checkout. It may also receive your company name and an internal account ID.
• Supabase provides our database and private file storage. Supabase stores the information described in this policy, including check PDFs, signature images, attachments, exports and Positive Pay files.
• Netlify hosts the website and application and runs scheduled jobs, such as report emails. Netlify processes all traffic to the Service, including IP addresses and request information.
• Resend sends notification and report emails. Resend receives recipient email addresses and the contents of each email. These include your company name, payee names and check amounts. They also include the names or email addresses of the people who submitted, approved or rejected a check, any rejection reasons, and report totals.
• Upstash provides rate limiting and protection against duplicate requests. Upstash receives IP addresses. It also holds a copy of the details of each new check for up to 24 hours: payee, amount, date, memo, check number, invoice number and any amount-override reason. This copy does not include bank account numbers.
• Sentry receives error reports when something in the Service breaks, so we can find and fix the problem. A report includes the page or request involved, technical details of the error, your browser and device type, and your IP address. We configure it not to send cookies, sign-in tokens or the contents of forms.

We will update this list when we add or change a service provider that receives personal information.

Other services your browser connects to. Two other services may receive limited information when you use our pages. They are not our service providers, and their own privacy policies apply.

• jsDelivr, a public content delivery network, serves an icon font used on our pages. When your browser loads the font, jsDelivr receives your IP address, your browser user agent and our site's address. We do not send jsDelivr any account, company or check information.
• Our sign-in provider, Clerk, may use Cloudflare Turnstile to block bots on sign-up and sign-in pages. If it does, Cloudflare receives information about your browser and device for that purpose. Clerk's and Cloudflare's privacy policies apply.

Inside your company. Members of a company can see that company's information and act on it according to the roles your administrators assign. For example, administrators and people with activity-log access can see who did what in the company. Account screens show only the last four digits of bank account numbers. Team members who can print checks, manage bank accounts or export Positive Pay files can see the full numbers in the files they generate. If you are a bookkeeper or accountant, your client's administrators can see your activity in their company.

At your direction. When you connect QuickBooks Online, we send Intuit the information needed to sync. This includes payee names (to find matching vendors), check numbers, dates, amounts, memos, line-item descriptions and amounts, invoice numbers, and the account and vendor mappings you choose. We do not send your bank routing or account numbers to QuickBooks. Intuit's privacy policy governs the information in your QuickBooks account. You share the files you download, such as Positive Pay files and exports, with your bank or other software yourself, and their terms apply.

Today, the Service does not email, mail or send anything to your payees. You deliver the checks you print. If we add features that send information to payees at your request, we will update this policy first.

Our personnel. Authorized members of our team can see a list of customer companies with their plans, usage and member counts. They can also see a platform-wide activity log that shows company names, user names and email addresses, the actions taken and the details of changes. Authorized personnel may also access stored information when needed to provide support, investigate security or fraud, or comply with the law.

Legal and safety reasons. We may disclose information if we believe in good faith that the law, a subpoena or other legal process requires it. We may also disclose it to protect the rights, property or safety of our customers, the public or us, including to investigate fraud or misuse of checks.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, information may be transferred as part of that transaction. If that happens, we will require the recipient to honor this policy, or we will notify you.

With your consent. We may share information for other purposes if you give us permission.

No sale of personal information and no targeted advertising

We do not sell personal information. We do not share it for cross-context behavioral advertising, meaning ads targeted at you based on your activity on other websites or apps. We have not done either in the past 12 months.

The Service does not use advertising networks, analytics tools, tracking pixels or session-recording tools.

Cookies and similar technologies

We keep cookies to a minimum.

• Sign-in cookies. Our sign-in provider, Clerk, sets cookies on our domain (such as __session and __client_uat) that keep you signed in and protect your account. These cookies are strictly necessary. If you block them, you cannot sign in.
• Nothing else from our own code. Apart from the Clerk sign-in cookies set on our domain, our own code sets no cookies and uses no local storage, session storage or similar browser storage.
• Scripts from our providers. Clerk's sign-in and billing components load code from Clerk. Depending on how they are set up, they may also load Cloudflare Turnstile (bot protection) and Stripe (payment forms). These providers may set their own cookies or similar storage for security, for fraud prevention and to complete payments. Their privacy policies apply.
• Fonts and icons. We serve our text fonts from our own site. Our icon font loads from jsDelivr, as described above.
• No analytics or advertising cookies. We do not use cookies or similar technologies for analytics, for advertising or to track you across sites.

You can control cookies in your browser settings. The cookies we rely on are needed for sign-in, so blocking them will stop the Service from working.

Emails and notifications

We send the service emails needed to run the Service, including:

• Approval requests, when a check needs your approval.
• Approval decisions, when a check you submitted is approved or rejected.
• Scheduled reports, sent to the team member chosen when the report schedule was set up. They include your company name, check count, total amount and counts by status.
• Team invitations and sign-in, verification and password emails, which Clerk sends for us.

You can turn approval emails and in-app notifications on or off in Settings > Notifications. Some emails are sent no matter what these settings say. These include sign-in and security emails, team invitations, and the approval request sent to the first approvers when a check is submitted or needs approval again.

A scheduled report stops when someone who manages reports turns it off or deletes it in Settings > Scheduled reports. If you receive a scheduled report and cannot change it, ask an administrator or contact us at [Contact email].

We will never ask for your password by email. Please do not send us full bank account numbers by email.

We do not send marketing emails today. If we start, we will include a way to unsubscribe.

Automated decisions and profiling

We do not use automated decision-making technology to make decisions about you that have legal or similarly significant effects. We do not profile you.

The Service runs rules that your company sets up, such as approval flows that send checks to approvers or approve them automatically. These rules are your company's choices about its own checks. If our team pauses check activity on an account because of suspected fraud or misuse, a person makes that decision.

How we protect information

We use administrative, technical and physical safeguards designed to protect information. These include:

• Encryption of bank routing and account numbers, EINs and QuickBooks access tokens with AES-256-GCM before we store them in our database. The encryption key is kept outside the database.
• Limits on where full bank numbers appear. Account screens show only the last four digits. Our servers decrypt full bank numbers only to create check PDFs, voided checks and Positive Pay files. Team members who can print checks, manage bank accounts or export Positive Pay files can see the full numbers in the files they generate. Bank numbers cannot be changed after you save them.
• Encrypted connections (HTTPS). Browser security settings require secure connections and stop other sites from framing our pages.
• Private file storage. Check PDFs, signatures, attachments and exports can be reached only through temporary download links. These links expire after 60 seconds for signature images and after up to 24 hours for exports and Positive Pay files.
• Sign-in through Clerk, a dedicated authentication provider.
• Role-based permissions, approval workflows, and an activity log designed to be append-only.
• Separation of each company's data. Each request is limited to the companies the signed-in user belongs to, and actions are checked against that user's role.
• Rate limiting, checks on the type and size of uploaded files, and verification of messages from our providers. We can also pause check activity on an account if we suspect fraud.

No system is perfectly secure, and we cannot guarantee the security of your information. Keep these points in mind:

• Check PDFs must contain your full routing and account numbers, and Positive Pay files must contain your full account number (and your routing number when your bank's format requires it), so your bank can process them. We keep them in private storage, but we do not separately encrypt the files, and any copies you download are in your control.
• Anyone who has a download link can use it until it expires. Do not forward these links.
• You are responsible for your password and devices, for the roles you give your team, and for removing people who should no longer have access. Give print, bank-account and export permissions only to people who need them. Turn on multi-factor authentication if your profile offers it. Store printed checks safely, and shred any you do not use.

If you believe your account has been compromised, contact us right away at [Contact email].

How long we keep information

We keep your company's information until you ask us to delete it, or until we delete it after an account ends as described in our Terms of Service at checkterminal.com/terms. We do not delete data automatically after a set period, and we do not close or delete accounts for inactivity. Cancelling a subscription or moving to the free plan does not delete any data.

• Checks. Approved, printed and voided checks stay in your register. A draft check you delete is hidden and marked as deleted, but we keep it. Voided check numbers are never reused.
• Vendors, bank accounts, signatures and custom fields. In the app, you can archive these but not delete them. We keep archived items, including signature image files.
• Check PDFs, exports and Positive Pay files. We keep these in private storage until your company's data is deleted. Check PDFs and Positive Pay files contain your full bank numbers. We do not store voided-check PDFs.
• Attachments. When you delete an attachment, we remove it from our database and storage.
• Templates, approval flows, report schedules and custom roles. These are deleted when you delete them.
• QuickBooks. When you disconnect, we delete your access tokens and revoke them at Intuit. Vendors and transactions we already imported stay until your company's data is deleted.
• Team members. Removing a teammate ends their access, but their user record and the records they created stay with the company.
• Invitations. An invitation stays open until it is accepted or revoked, or until it expires under our sign-in provider's rules. We keep the invitation record, including the invitee's email address, even if it was never accepted, until the company's data is deleted. If you received an invitation and want your email address removed, email [Privacy email].
• Notifications. We keep these until the related user or company data is deleted.
• Activity logs. We currently keep activity logs indefinitely. They are not deleted when a company's data or a user is deleted, and they are designed so they cannot be edited or deleted. They include IP addresses, browser user agents and the details of changes, such as payee names, addresses and amounts, and the email addresses of invited people. They do not contain full bank account numbers or EINs. We keep them to help keep the Service secure, detect and prevent fraud, resolve disputes and meet legal obligations, as state privacy laws allow. If we adopt a fixed retention period, we will update this policy.
• Billing records. We keep these as needed for accounting, tax and legal purposes.
• Rate-limit and duplicate-request data. Rate-limit records last up to 15 minutes. Cached copies of new checks expire after 24 hours.
• Imported CSV files. We read them and then discard them. We keep only the checks and vendors created from them.
• Sign-in data. Clerk holds this until your user account is deleted, following Clerk's retention practices.

Deleted information may stay in our providers' backup copies for a limited period, until those backups are replaced in the normal course.

Your choices and rights

You can do many things yourself in the app. For anything else, email [Privacy email].

• See and update your profile. Change your name, email address, password, multi-factor authentication settings and sessions on your Profile page.
• Update company details. Users with settings permission can edit the company's name, address, phone number and EIN in Settings > Company Profile. You can replace the EIN, but the Service never shows it again after you save it.
• Update bank accounts. Routing and account numbers cannot be changed after you save them. To use different numbers, add a new account in Settings > Bank accounts and archive the old one. To correct a bank account's nickname or bank name, contact us. We will help you correct it, which may mean adding a new account with the corrected details and archiving the old one.
• Update vendors and checks. You can edit vendors and checks as far as your role and each check's status allow.
• Get a copy of your data. Users with export permission can export the check register as CSV, PDF, QuickBooks IIF or Xero CSV, up to 5,000 rows per export. Users with print permission can also download the PDF of an approved check. For a fuller copy, including vendors, attachments and activity logs, email [Privacy email].
• Delete items. You can delete draft checks, attachments, templates, approval flows, report schedules and custom roles. You can archive vendors, bank accounts, signatures and custom fields.
• Delete your user account or your company's data. The app does not have a self-serve option for this, and our team handles each request. Email [Privacy email] from the email address on your account. A request to delete company data must come from the business that owns the company, or from a user with authority to act for it, such as a company administrator. We will verify the request and respond within 45 days. Once we verify it, we will delete or de-identify the information, including the files we store for the company, within 30 days. We will keep what we describe in "How long we keep information," such as activity logs, billing records and records the law requires us to keep. Records that belong to a company you worked for may also remain, such as checks you created or approved and their history, which can show your name or email address.
• Do not use your sign-in settings to delete your account. If your Profile page offers an option to delete your account, it removes your sign-in record at Clerk but may not remove your information from Check Terminal. Email [Privacy email] instead.
• Manage your team. Administrators can change roles and remove members in Settings > Team.
• Manage notifications and reports. Use Settings > Notifications and Settings > Scheduled reports, as described above.
• Disconnect QuickBooks. You can disconnect in Settings > QuickBooks.
• Cancel your subscription. If you have a paid plan, the person who bought it (the Subscriber) can manage or cancel it in Settings > Billing, which requires settings permission, or you can email [Contact email] for help. Cancelling does not delete your data.

Depending on where you live, state privacy laws may give you the right to access, correct or delete your personal information, to get a copy of it, and to opt out of certain processing. We do not sell personal information or use it for targeted advertising. We also do not use it for profiling that produces legal or similarly significant effects. To use any of these rights, email [Privacy email] or write to us at [Mailing address]. We will verify your request and respond within the time the law requires.

If we deny your request, we will explain why. You can appeal by replying to our decision, or by emailing [Privacy email] with "Privacy appeal" in the subject line. We will respond to your appeal within the time the law requires.

If one of our customers loaded your information into the Service, such as a business that paid you by check, we will send your request to that customer, because it controls that information.

California privacy rights

This section applies to California residents and adds to the rest of this policy. It describes our practices under the California Consumer Privacy Act, as amended (CCPA).

Categories we have collected in the past 12 months:

• Identifiers, such as your name, email address, IP address, account and company IDs, and company tax IDs (EINs).
• Personal information described in California Civil Code section 1798.80(e), such as name, mailing address, phone number, signature, and bank routing and account numbers.
• Commercial information, such as your plan and subscription history, and the check and vendor records in your account.
• Internet or other electronic network activity information, such as the activity log of actions you take, your browser user agent, and the request information our hosting and sign-in providers process.
• Professional or employment-related information, such as your role in a company, the companies you work with, and whether you are a business owner or bookkeeper.
• Audio, electronic, visual or similar information, such as signature images and documents you upload.
• Sensitive personal information, such as your account sign-in credentials (held by Clerk), the financial account numbers you enter, and payment card details (handled by Clerk and Stripe).

We have not collected precise geolocation, biometric information, health information or characteristics of protected classifications. We do not create inferences or profiles about you. Files you upload could contain other information that you choose to include.

Sources. We collect these categories from you, from your company's administrators and teammates, from our sign-in and billing providers, from QuickBooks Online if you connect it, from your browser or device, and from the Service itself. See "Where we get information."

Purposes. We use each category for the business purposes in "How we use information." These include providing the Service, security and fraud prevention, debugging, customer support, managing subscriptions and complying with the law.

Disclosures for a business purpose. In the past 12 months, we disclosed these categories as follows:

• Identifiers: Clerk, Stripe, Supabase, Netlify, Resend, Upstash and Sentry. jsDelivr, and Cloudflare if Clerk uses Turnstile, also receive IP addresses.
• Customer records, including bank account numbers and signatures: Supabase and Netlify. Clerk and Resend also receive names and email addresses. Clerk and Stripe receive the billing details you enter at checkout.
• Commercial information: Supabase, Netlify, Resend (in approval and report emails), Upstash (short-term copies of new checks), and Clerk and Stripe (subscription information).
• Internet or other electronic network activity information: Clerk (sign-in requests), Netlify, Supabase, Upstash, Sentry (error reports) and jsDelivr, and Cloudflare if Clerk uses Turnstile.
• Professional or employment-related information: Clerk, Supabase and Netlify.
• Audio, electronic, visual or similar information: Supabase and Netlify.
• Sensitive personal information: Clerk (sign-in credentials), Clerk and Stripe (payment card details), and Supabase and Netlify (bank account numbers).

Clerk, Stripe, Supabase, Netlify, Resend, Upstash and Sentry are our service providers. jsDelivr and Cloudflare are not. They receive limited browser information because your browser connects to them, as described in "How we share information." When you direct us to, we also disclose check, vendor and account mapping information to Intuit to sync with QuickBooks Online.

Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Sensitive personal information. We use sensitive personal information only to provide the Service, to keep it secure, to prevent fraud, and for other purposes for which the CCPA does not give a right to limit. We do not use it to infer characteristics about you.

Financial incentives. We do not offer financial incentives, discounts or different prices or service levels in exchange for personal information.

Retention. We keep each category for the periods described in "How long we keep information."

Your rights. As a California resident, you have the right to:

• Know what personal information we have collected about you. This includes the categories and specific pieces of information, the sources, our purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share it, so there is nothing to opt out of today.
• Limit the use of sensitive personal information. We use it only for permitted purposes, so this right does not change how we process it.
• Not be discriminated against for using these rights. We will not deny you service, charge you a different price or give you a different level of service because you used a right.

How to submit a request. Email [Privacy email] or write to [Mailing address]. Tell us which right you want to use and which email address is on your account.

Verification. We verify requests by matching the information you give us with information we hold. Usually, we confirm the request through the email address on your account. For a request for specific pieces of information, or a request to delete, we may ask for more information. We use what you give us only to verify your request.

Authorized agents. You may use an authorized agent. The agent must give us your signed written permission. We may also ask you to verify your identity directly with us, or to confirm that you gave the agent permission. We will not ask for either if the agent has a valid power of attorney.

Timing. We will confirm that we received your request within 10 business days, and respond within 45 calendar days. If we need up to 45 more days, we will tell you why.

Information we process for customers. If one of our business customers loaded your information, such as a business that paid you by check, we process it as that customer's service provider. Please send your request to the customer. If you send it to us, we will forward it or help the customer respond.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a browser signal that tells websites you want to opt out of the sale or sharing of your personal information. We do not sell or share personal information, so there is nothing for GPC to turn off today. If that ever changes, we will update this policy first, and we will treat a GPC signal as a valid opt-out request for that browser.

Some browsers send a Do Not Track (DNT) signal. There is no common standard for responding to it. We do not track you across other websites or use advertising or analytics trackers, so the Service works the same way whether DNT is on or off.

Children

The Service is for businesses and is not intended for anyone under 18. You must be at least 18 to create an account, as our Terms require. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at [Privacy email] and we will delete it.

Where we store information

Check Terminal is offered to businesses in the United States. We store your information primarily in the United States. Some of our providers, such as our hosting and content delivery networks and our sign-in and payment providers, may process some information in other countries.

If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

Security incident notification

If we learn of a security incident that leads to unauthorized access to personal information we hold, we will investigate it and take steps to contain it. We will notify affected customers, individuals and regulators as applicable law requires. We will send notices by email to the address on the account, through the Service, or by other means the law allows.

For Customer Data we process on a customer's behalf, such as payee data, we will notify the customer without undue delay. We will also give the customer the information it reasonably needs to meet its own notification duties.

Accessibility

We want this policy to be easy for everyone to read. If you have a disability and need this policy in another format, such as large print or a format that works better with your screen reader, email [Privacy email]. You can also print this page from your browser.

Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version at checkterminal.com/privacy and update the effective date. If we make a material change, we will notify account administrators by email or through the Service before the change takes effect.

If we plan to use personal information in a way that is materially different from what this policy describes, we will ask for your consent where the law requires it. If you keep using the Service after the effective date, the updated policy applies.

Contact us

[Company legal name] operates Check Terminal. For privacy questions or requests, email [Privacy email]. For other questions, email [Contact email].

Mail: [Company legal name], [Mailing address]