Privacy policy

1. Introduction

OnCharge Group LLC, a Wyoming limited liability company ("OnCharge," "Company," "we," "us," or "our"), with its principal place of business at 1309 Coffeen Ave, Sheridan, WY 82801, operates a payment gateway platform that enables merchants to accept card and cryptocurrency payments through their e-commerce stores. This Privacy Policy ("Policy") explains how we collect, use, disclose, retain, and safeguard your information when you visit our website at oncharge.io, use our merchant dashboard, checkout services, APIs, plugins, or any related services (collectively, the "Services"). By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must discontinue use of the Services immediately.

2. Information We Collect

2.1 Merchant Information

• Business name, DBA, legal entity type, EIN, and state of incorporation
• Beneficial owner names, dates of birth, government-issued identification, and Social Security Numbers (for KYB/KYC verification as required by applicable law)
• Business address, phone number, email address, and website domain
• Bank account details (voided check or bank verification letter for payout configuration)
• Financial documents including bank statements, processing statements, and tax identification documents
• Business category, product descriptions, estimated transaction volume, and risk profile data

2.2 Shopper / End-Customer Information

• Email address and phone number (as provided during the checkout process)
• IP address, device fingerprint, browser user agent, screen resolution, and behavioral metadata (for fraud prevention and risk evaluation)
• Payment card details are tokenized by our PSP partners (Adyen, Stripe, Airwallex) and are never stored, logged, or accessible on OnCharge servers or infrastructure
• Transaction metadata including order identifiers, amounts, currency, and timestamp data

2.3 Automatically Collected Information

• Server log data (IP addresses, request timestamps, HTTP headers, response codes)
• Platform usage analytics (pages visited, features accessed, session duration)
• Risk and fraud signals (VPN/TOR/proxy detection, geolocation, email domain reputation, phone line type, velocity patterns)

3. Legal Basis for Processing

We process your information on the following legal bases:

• Contract performance: Processing necessary to provide the Services you have agreed to use
• Legal obligation: Processing required to comply with KYB/KYC, AML, financial reporting, and card network regulations
• Legitimate interest: Processing necessary for fraud prevention, platform security, service improvement, and the protection of our business, merchants, and their customers
• Consent: Where required by applicable law, for marketing communications and non-essential analytics

4. How We Use Your Information

• Payment processing: To facilitate, authorize, settle, and reconcile transactions between merchants and their customers
• Fraud prevention and risk management: To evaluate risk, detect fraud, enforce velocity limits, maintain global blocklists, and block malicious or unauthorized transactions
• Merchant onboarding and underwriting: To verify business identity, assess risk profiles, and comply with KYB/KYC/AML requirements
• Dispute defense: To compile evidence, build defense packets, and submit chargeback responses on behalf of merchants
• Regulatory compliance: To meet legal, regulatory, tax, and card network obligations including suspicious activity monitoring
• Platform operations: To maintain, monitor, optimize, and secure the Services and infrastructure
• Communications: To send transactional notifications, security alerts, compliance findings, and essential service updates
• Enforcement: To investigate violations of our Terms of Service, enforce our agreements, and protect the rights, property, and safety of OnCharge Group LLC, its merchants, and the public

5. Payment Card Data

6. Information Sharing and Disclosure

We may share your information in the following circumstances and only to the extent necessary:

• Payment processors: Adyen, Stripe, Airwallex, and ForumPay for payment authorization, capture, settlement, and refund processing
• Risk and verification providers: Third-party services for IP intelligence, email reputation analysis, phone validation, and identity verification
• Card networks and alert services: Visa (via Verifi) and Mastercard (via Ethoca) for chargeback prevention, rapid dispute resolution, and network compliance
• Legal and regulatory: When required by law, regulation, subpoena, court order, legal process, or governmental or regulatory request; or to protect the rights, property, or safety of OnCharge Group LLC, its merchants, or the public
• Infrastructure and service providers: Supabase (database hosting), Vercel (application hosting), OpenAI (AI-assisted document review and fraud analysis), and Resend (transactional email delivery), each operating under data processing agreements or equivalent contractual safeguards
• Business transfers: In connection with a merger, acquisition, reorganization, asset sale, or bankruptcy proceeding, your information may be transferred as a business asset
• Affiliated entities: With subsidiaries and affiliates of OnCharge Group LLC for internal administration and consistent service delivery

We do not sell, rent, or lease personal information to third parties for marketing purposes. We do not share shopper data with merchants beyond what is strictly necessary for payment processing and dispute resolution.

7. Data Retention

We retain information for the following periods, or longer if required by applicable law:

• Transaction records: 7 years from the date of the transaction, as required by financial regulations and card network rules
• KYB/KYC documents: 5 years after account closure or last transaction, per AML/BSA requirements
• Risk signals and fraud data: 365 days for pattern analysis; cryptographically hashed identifiers in the global blocklist are retained indefinitely for ongoing fraud prevention
• Audit logs: 3 years for security investigation, regulatory compliance, and dispute resolution purposes
• Dispute records: 7 years, as chargebacks may be re-opened or referred to arbitration within card network timeframes

8. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your information. These include but are not limited to: HMAC-SHA256 request signing on all API endpoints, TLS 1.2+ encryption for all data in transit, database-level encryption at rest, Row Level Security (RLS) policies, content security policies, HSTS with preload, automated compliance scanning, and cryptographic hashing of sensitive identifiers. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. You acknowledge and accept this inherent risk.

9. Your Rights

Depending on your jurisdiction and subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data (subject to mandatory legal and regulatory retention requirements; deletion requests that conflict with our compliance obligations will be denied)
• Object to or restrict processing of your data in certain circumstances
• Data portability (receive your data in a structured, machine-readable format) where technically feasible
• Opt out of non-essential marketing communications at any time

To exercise these rights, contact us at privacy@oncharge.io. We may require identity verification before processing your request. We will respond within 30 days or the timeframe required by applicable law.

10. Cookies and Tracking Technologies

Our merchant dashboard uses strictly necessary cookies for authentication session management (Supabase Auth). These cookies are essential for the operation of the Services and cannot be disabled. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking on the checkout pages. The marketing site may use first-party analytics to understand aggregate traffic patterns. By using our Services, you consent to the use of strictly necessary cookies.

11. Children's Privacy

Our Services are intended for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that a child has provided personal data, we will take prompt steps to delete such information from our systems.

12. International Data Transfers

OnCharge Group LLC is based in the United States. Our Services are hosted on infrastructure located in the United States (Vercel, Supabase). If you access our Services from outside the United States, your information will be transferred to and processed in the United States. By using the Services, you explicitly consent to this transfer. We implement appropriate contractual and technical safeguards for international data transfers as required by applicable law.

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at privacy@oncharge.io.

14. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time at our sole discretion. We will notify merchants of material changes via the dashboard notification system and/or email at least 15 days prior to the effective date. The "Effective Date" at the top of this page indicates when the Policy was last revised. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the revised Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us: