This Privacy Policy explains how Royal Payment Solutions, LLC (“we”, “us”), the operator of getroyalpay.com and royalpaymentsolutions.com and the RoyalPay sandbox, processes personal data. We apply the EU General Data Protection Regulation (GDPR) as our standard and also respect applicable US state privacy laws.
1. Controller and contact
Royal Payment Solutions, LLC, mailing address 3044 Breckenridge Ln, Ste 102, Louisville, KY 40220, USA. Privacy contact: info@royalpaymentsolutions.com. We are an online only company without branches.
2. Data we process
- Account data: email address, password hash (Argon2id; your password itself is never stored), language, role, timestamps of registration and last login.
- Sandbox profile: the name, date of birth, country and address you enter in the sandbox onboarding form, and the simulated check results. Please use test data. No identity documents are collected.
- Sandbox activity: simulated accounts, IBANs, balances, top ups, cards (last four digits only) and transactions; the event log; your API key in hashed form.
- Security data: IP address and time of logins and security relevant actions (audit log), rate limiting records, two factor authentication settings.
- Server logs: IP address, date and time, requested URL, referrer and user agent, created by our web server.
3. Purposes and legal bases
- Providing the sandbox and your account: performance of a contract (Art. 6(1)(b) GDPR).
- Security, fraud and abuse prevention, audit trail: legitimate interests (Art. 6(1)(f) GDPR) in protecting the Site and users.
- Answering your messages: legitimate interests or steps prior to a contract.
- Complying with legal obligations: Art. 6(1)(c) GDPR.
We do not sell personal data, do not use it for advertising and do not make decisions with legal or similarly significant effects by automated means (sandbox verification results are simulated).
4. Cookies
We use only strictly necessary cookies: rpsid (session and sign in, expires with the session or after 2 hours of inactivity) and _nss (protection against cross site request forgery). We use no analytics, advertising or third party cookies, so no consent banner is needed.
5. Recipients
Our hosting provider (virtual server) and our email provider process data on our behalf under data processing terms. We disclose data to authorities only where legally required. When we launch, our licensed partner will process customer data as a separate controller under its own privacy notice.
6. International transfers
We are a US company managed from the European Union; data may be processed in the EU and the USA. Where GDPR applies to transfers to countries without an adequacy decision, we use the European Commission’s Standard Contractual Clauses or another valid transfer mechanism.
7. Retention
- Sandbox accounts: until you delete them, or automatically after 12 months of inactivity.
- Web server logs: up to 14 days; application error logs: up to 90 days.
- Audit log entries: up to 24 months, for security and accountability.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence. You can export your data and delete your account yourself under Security in the app, or email us; we answer within one month. Residents of US states with privacy laws have comparable rights (to know, correct, delete and not be discriminated against); we do not sell or share data for cross context behavioural advertising.
9. Security
Encrypted connections (TLS, HSTS), Argon2id password hashing, optional TOTP two factor authentication, CSRF protection, a strict Content Security Policy, least privilege access and an audit trail. No method of transmission or storage is completely secure.
10. Children
The Site is intended for persons aged 18 and over. We do not knowingly collect data from children.
11. Changes
We will publish any changes here with a new date.