ClearRoute LLC ("ClearRoute," "we," "us") operates an autonomous payment routing SaaS. This Privacy Policy explains how we collect, use, and protect information about you when you use our website and service at myclearroute.polsia.app (the "Service"). ClearRoute acts as the data controller for personal information collected in connection with the Service, as defined under applicable data protection law (GDPR, UK GDPR, CCPA, CPRA, and equivalent regulations).

ClearRoute's Data Protection Officer can be reached at dpo@clearroute.app.

1. Information We Collect

1.1 Account Information

When you register for an account, we collect:

• Name and email address
• Bcrypt-hashed password (cost factor 12, never stored in plaintext)
• Billing name and address — processed and stored by Stripe under their privacy policy
• Stripe customer ID and subscription ID
• Business entity name and type, if provided

1.2 PSP Configuration Data

When you add a Payment Service Provider to your account, you submit:

• PSP name, provider type, and any configuration metadata you choose to store
• PSP API keys and credentials — encrypted at rest using AES-256, decrypted only at request time and only in a restricted service context
• Routing weight preferences and performance thresholds

1.3 Transaction and Routing Data

When you use the routing service, we process and store the following transaction metadata. We do not store full card numbers (PAN), CVV/CVC, cardholder names, or card expiry dates. If such data appears in transaction metadata from your PSP, it is not retained by ClearRoute — your PSP handles all card data under their own PCI DSS compliance program.

• Transaction ID (assigned by your system or PSP)
• Transaction amount and currency
• Selected PSP, routing cost, and latency for each routing decision
• PSP response status (approved, declined, error, and reason codes)
• Routing agent decision logs: PSP scores, scoring factors, selected PSP, and routing outcome

All transaction and routing data is scoped to your customer_id and is not accessible to other users or accounts.

1.4 Technical Data

When you visit the ClearRoute website, we collect:

• IP address (retained for 90 days from date of visit)
• Browser type, version, and operating system
• Pages visited, referring URL, and timestamp
• Unique visitor identifier (first-party localStorage, no cross-session tracking)

1.5 Payment Data

All payment processing is handled by Stripe, Inc. ClearRoute does not store, process, or have access to your payment card numbers, CVV, cardholder name, or Stripe API keys. Stripe's privacy policy applies to payment data: stripe.com/privacy.

2. How We Use Information

We use collected information for the following purposes, and no others:

• Providing, operating, and improving the payment routing service
• Authenticating you and managing your account
• Processing billing and subscription management via Stripe
• Generating routing logs and analytics available in your dashboard and API
• Detecting and responding to security incidents, including unauthorized access attempts
• Complying with legal obligations, including tax and financial record-keeping requirements
• Notifying you of service updates and material changes to these terms, as required by law

3. Legal Basis for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, we process personal data under the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to perform our contract with you — providing the routing service, authenticating your account, processing billing, and maintaining your PSP configurations.
• Legitimate Interest (Article 6(1)(f)): Fraud prevention, security monitoring, and service improvement. You may object to processing based on legitimate interest by contacting dpo@clearroute.app. We will cease processing unless we have a compelling legitimate ground that overrides your interests, or where processing is necessary for legal claims.
• Legal Obligation (Article 6(1)(c)): Tax and financial record-keeping requirements under applicable law.
• Consent (Article 6(1)(a)): Where we request consent for a specific purpose, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your withdrawal.

4. Automated Decision-Making

ClearRoute's routing agent makes automated routing decisions — selecting the optimal PSP for each transaction based on cost, latency, and historical success rate — without human review of individual transactions. This automated decision-making is necessary to provide the service you signed up for (Article 22(2)(b) GDPR basis: necessary for a contract).

You have the right:

• Not to be subject to a solely automated decision that produces legal or similarly significant effects on you, except where such decisions are (a) necessary for a contract, (b) authorized by law, or (c) based on your explicit consent.
• To request human review of a routing decision by contacting routing@clearroute.app. We will respond within 30 days.
• To configure your routing weights and PSPs to influence routing outcomes to match your business needs.

5. Data Retention

We retain data as follows:

Data Type	Retention Period	Basis
Account information (name, email, hashed password)	Until account deletion + 90 days	Contract
Transaction routing logs	12 months from routing decision date	Legitimate interest (audit, dispute resolution)
PSP credentials	Until PSP removed from account + 30 days	Contract
Website visitor analytics (IP, browser, pages)	90 days from visit date	Legitimate interest (security)
Billing records	7 years from transaction date	Legal obligation (tax compliance)
Security and access logs	1 year from event date	Legal obligation (PCI DSS Req. 10)
Marketing communications (if any)	Until consent withdrawn	Consent

Upon account deletion, we delete all personal data within 90 days, except billing records (retained 7 years per tax law) and data required for pending or reasonably anticipated legal holds. Deletion requests are processed within 30 days.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• PSP Integrations: Your PSP API keys and transaction metadata are shared with your configured PSPs to execute routing decisions. Each PSP processes this data under their own privacy policy and PCI DSS compliance program.
• Stripe: Billing, subscription, and payment data is shared with Stripe, Inc. for payment processing. Stripe's data handling is governed by the Stripe Privacy Policy.
• Infrastructure Providers: We use Render, Inc. for hosting and Neon (Neon Database Inc.) for database services. Both providers are contractually bound to protect your data. Data is stored in Neon PostgreSQL on AWS us-east-1.
• Legal Requirements: We may disclose your data if required by law, court order, governmental regulation, or subpoena. We will notify you unless prohibited from doing so by law or court order.
• Emergency Security: We may disclose data without notice where disclosure is necessary to prevent imminent physical harm, prevent fraud targeting ClearRoute or its users, or comply with emergency legal process from law enforcement.

7. Subprocessors

ClearRoute uses the following subprocessors to provide the Service. Each subprocessor processes personal data only to the extent necessary to deliver the service ClearRoute has engaged them for.

Subprocessor	Purpose	Data Processed	Legal Safeguard
Render, Inc.	Web application hosting	Application code, session data, request logs	Data Processing Agreement
Neon Database Inc.	PostgreSQL database	Account info, PSP configs, routing logs, billing records	Data Processing Agreement
Stripe, Inc.	Payment processing and subscription management	Billing name, email, payment method references, subscription status	Stripe Privacy Policy (no DPA — Stripe acts as processor)
OpenAI, LLC	AI model inference (routing agent scoring logic, not personal data)	PSP configuration metadata, anonymized routing metrics — no personal data or cardholder data	Data Processing Agreement

We will notify you via the email on your account at least 30 days before adding or replacing a subprocessor that processes personal data.

8. Data Security

We implement the following technical and organizational security measures:

• All data in transit encrypted via TLS 1.2+; HTTPS enforced on all endpoints
• PSP API keys encrypted at rest using AES-256 encryption
• User passwords hashed with bcrypt (cost factor 12)
• Role-based access control at the application layer; all database queries are customer_id scoped — cross-account access is structurally impossible
• PCI DSS compliance maintained per our PCI DSS Compliance Statement
• Annual independent security review; vulnerability scanning runs quarterly
• Access logs retained for 1 year; security incidents logged with timestamps and affected scope

9. Cookies and Tracking

We use one functional first-party cookie:

• Session cookie: Stores an encrypted session identifier for authentication. HttpOnly, Secure, SameSite=Strict. Expires when you log out or after 7 days of inactivity.

We use first-party localStorage to store a unique visitor identifier for website analytics. This does not track individual behavior across sessions and is not used for advertising or cross-site tracking.

You may disable cookies in your browser. The site will remain functional, but you will need to re-authenticate on each session.

10. Your Rights

Depending on your jurisdiction, you may have the following rights. To exercise any right, email privacy@clearroute.app or dpo@clearroute.app. We respond to all verifiable requests within 30 days.

All jurisdictions

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data (subject to billing record retention requirements and legal holds).
• Portability: Request your data in a structured, machine-readable format (JSON).
• Object to processing: Opt out of processing based on legitimate interest, with the exception of processing required to provide the Service or comply with legal obligations.

EEA and UK (GDPR)

• Restriction of processing: Request that we restrict processing of your data in certain circumstances (e.g., while accuracy is being verified or when you have objected to processing).
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time.
• Lodge a complaint: File a complaint with your local supervisory authority:
  EEA: Your national data protection authority
  UK: Information Commissioner's Office (ICO)
• Automated decision-making review: Request human review of a routing decision (contact routing@clearroute.app).

California (CCPA/CPRA)

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the purpose of collection, and the third parties with whom we share it.
• Right to Delete: Request deletion of your personal information (subject to exceptions for billing records and legal holds).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: ClearRoute does not sell or share personal information for cross-context behavioral advertising. If that changes, we will update this policy and honor opt-out requests. Email privacy@clearroute.app.
• Right to Limit Use of Sensitive Personal Information: We do not collect or use sensitive personal information as defined under CPRA.
• Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

We verify all California requests within 10 business days and respond within 45 days. Verification requires matching at least two data points from your account.

ClearRoute does not knowingly sell or share the personal information of consumers under 16 years of age.

11. International Data Transfers

Data is stored in Neon PostgreSQL on AWS us-east-1 (United States). If you are located outside the United States, your data will be transferred to and processed in the US.

For transfers of EU resident data, ClearRoute relies on Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914/EC) as the appropriate transfer safeguard. A copy of the applicable SCCs is available on request from dpo@clearroute.app.

12. Data Breach Notification

If we become aware of a breach of personal data that is likely to result in a risk to your rights and freedoms, we will:

• Notify you at the email on your account within 72 hours of becoming aware of the breach.
• Describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.
• Notify the relevant supervisory authority (for EEA: your national DPA; for UK: the ICO) within 72 hours if the breach is not unlikely to result in a risk to individuals, or immediately if it is.

Security incidents should be reported to security@clearroute.app.

13. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted at /legal/privacy with an updated effective date. For material changes that significantly affect your rights or our data processing practices, we will notify you via the email on your account at least 30 days before the change takes effect.

15. Contact