Privacy Policy

1. Who we are and what this policy covers

FBA INTERNATIONAL FINANCE LIMITED, trading as AIPower Pay, is located at UNIT 2128, 21/F, TUEN MUN CENTRAL SQUARE, 22 HOI WING ROAD, TUEN MUN, NEW TERRITORIES. This policy covers our public website, merchant portal, payment transactions, merchant onboarding and KYB/KYC activity.

We generally determine how personal data is used for our website and direct merchant relationship. In a payment chain, the merchant, payment provider, acquiring institution, card network, issuer and verification provider may each have separate legal roles and their own notices.

2. Personal data we may collect

• Business contact data: name, role, company, email, telephone number and correspondence.
• Merchant and ownership data: company records, beneficial ownership, directors, authorised representatives, business activity, websites and supporting documents.
• Verification data: identity documents, images, verification results, screening results and related technical information when required for KYB/KYC.
• Transaction data: amount, currency, date, merchant and order references, payment method, limited account or card details, tokens, authorisation responses, refunds, disputes and settlement records.
• Risk and device data: IP address, device and browser information, location indicators, transaction behaviour, fraud signals and authentication results.
• Website and portal data: login, security, audit and usage records, together with information you submit through enquiries or support channels.

Please do not send full card numbers, security codes, passwords or identity documents through the public contact form or ordinary email unless our team provides an approved secure method.

3. Where data comes from

We collect data from merchants, their representatives, customers who take part in a payment, our website and portal, payment and acquiring partners, card networks, banks, Sumsub, fraud and dispute services such as Ethoca and RDR, public registers and lawful compliance databases.

4. Why we use personal data

We use personal data to answer enquiries; assess and onboard merchants; perform KYB/KYC, sanctions and risk checks; provide and secure payment services; route and authenticate transactions; process refunds, disputes and settlements; prevent fraud and misuse; operate the merchant portal; reconcile records; provide support; meet legal and card-network obligations; establish or defend legal claims; and improve service reliability.

Depending on the person, service and applicable law, our legal grounds may include performance of a contract, steps requested before a contract, legal obligations, legitimate interests in secure payment operations and fraud prevention, and consent where consent is specifically required. We do not rely on consent where another legal basis is more appropriate.

5. KYB/KYC and Sumsub

We use Sumsub as a third-party provider for merchant and identity verification. Information needed for a check may be provided directly to Sumsub or transferred through our systems. The exact data and checks depend on the merchant, representative, country and risk profile.

Where a verification step uses facial images, liveness checks or other biometric-related processing, additional notices or consent may be presented where required. Sumsub also publishes its own privacy information for the processing it performs.

6. Who may receive data

We may disclose relevant data to payment service providers, acquirers, banks, card networks, alternative payment methods, Sumsub, fraud and dispute services, hosting and security providers, professional advisers, auditors, insurers, regulators, law-enforcement bodies and courts. We share only what is reasonably needed for the relevant purpose or required by law.

We do not sell personal data. We do not disclose personal data to third parties for their independent direct marketing without the notice and choice required by applicable law.

7. Storage and international transfers

Our primary data-storage location is the United States. Personal data may also be accessed or processed in other countries by payment, verification, security and support providers involved in a transaction or merchant review.

Where applicable law requires transfer safeguards, we use contractual, organisational or other recognised measures appropriate to the transfer. Laws in a destination country may differ from those in the country where the data was collected.

8. Retention

Our standard operational retention period for customer and transaction information is 180 days. This is not an absolute deletion deadline for every record.

We may retain particular records for longer where required by law, a regulator, card-network or contractual obligation; for KYB/KYC, accounting, audit or fraud-prevention purposes; while a transaction, refund, complaint, investigation, chargeback or legal claim remains open; or where a legal hold applies. When data is no longer needed for a lawful purpose, we take reasonable steps to delete or anonymise it.

9. Security

We use technical and organisational controls designed for the sensitivity of the data, including access controls, encryption in appropriate contexts, monitoring, segregation and supplier oversight. Our payment-data environment is managed under our applicable PCI DSS responsibilities.

No system is completely secure. Merchants must protect their credentials, use approved integration methods and notify us promptly if they suspect unauthorised access.

10. Your privacy rights

Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. Some rights are subject to identity verification, legal exemptions and retention duties.

Send a request to [email protected]. Describe the relationship or transaction involved, but do not email full card details or unrequested identity documents. You may also complain to the privacy regulator or other authority competent in your location.

11. Risk analysis and automated tools

We use rules and technology, including artificial-intelligence-supported analysis, to identify fraud, route eligible payments and manage risk. An issuer, payment provider or other participant may make its own authentication, authorisation or service decision.

Where applicable law gives you a right relating to a decision based solely on automated processing, contact us to request information or an appropriate review. This does not guarantee that a payment or merchant application will be approved.

12. Marketing, children and updates

We may send business communications where permitted. You can opt out of marketing at any time; service, security and transaction messages may still be necessary. Our services are not directed to children, and merchants must not knowingly submit children’s data unless the service and law expressly permit it.

We may update this policy as our practices or requirements change. For privacy questions, contact [email protected].