Legal

Privacy Policy

Effective August 13, 2026 · Last updated August 13, 2026

1. Introduction

ClearBox (“ClearBox,” “we,” “us,” or “our”) provides payment orchestration, facilitation, and settlement services to business Merchants. This Privacy Policy explains how we collect, use, disclose, and protect information from Merchants, prospective Merchants, and visitors to our website.

By accessing our website or using ClearBox services, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our website or services.

2. Information we collect

2.1 Information you provide to us

When you apply for or use ClearBox services, we may collect:

Contact information: Name, title, email address, phone number, company name.
Business information: Legal business name, entity structure, physical address, website, industry classification, average ticket size, monthly processing volume estimates.
Beneficial ownership and identity information: Government-issued identification for owners and authorized signers, Social Security numbers for background and credit checks.
Financial information: Business bank account information, business bank statements, prior processing statements and history.
Compliance documentation: Business licenses, vertical-specific licenses or permits, terms of service, refund and cancellation policies, consent and liability waiver templates where applicable.
Communication records: Correspondence, meeting notes, and support interactions.

2.2 Information collected automatically

When you visit our website, we may automatically collect:

Device information: IP address, browser type, operating system, device identifiers.
Usage data: Pages viewed, time spent on pages, links clicked, referral sources.
Cookies and tracking technologies: See section 4 for details.

2.3 Information from third parties

We may receive information from:

Identity verification providers: To confirm identity and business standing.
Compliance and underwriting databases: For KYC and AML screening, sanctions checking, and merchant risk history, including MATCH list status.
Processing Partners: GOAT and other third-party processors, gateways, and sponsoring banks involved in underwriting and processing your account.
Correspondent Partner: Cross Mint, in connection with Stablecoin Settlement services.
Public sources: Regulatory filings, corporate registries, and business databases.

3. How we use your information

3.1 Service provision

Facilitate payment orchestration and settlement services
Submit Merchant information to one or more Processing Partners for underwriting review and Merchant Identification Number approval
Coordinate Gateway integration and routing configuration
Facilitate Stablecoin Settlement through our Correspondent Partner
Maintain transaction records and audit trails
Provide customer support and technical assistance

3.2 Compliance and legal obligations

Comply with KYC and AML requirements
Fulfill regulatory reporting obligations
Respond to legal process and government requests
Prevent fraud, money laundering, and prohibited activities
Enforce our Terms of Use and agreements

3.3 Business operations

Improve and optimize our services
Analyze usage patterns and service performance
Communicate updates, changes, or important notices
Respond to inquiries and provide information

Develop related financial intelligence products and services, including analytics and risk scoring tools. This includes the use of anonymized and aggregated data to develop, train, and improve our financial intelligence products, risk scoring models, and analytics services.

3.4 Security and risk management

Detect and prevent security threats
Monitor for unauthorized access or suspicious activity
Maintain system integrity and availability
Protect against fraud and abuse

4. Cookies and tracking technologies

4.1 Types of cookies we use

Strictly necessary cookies: Required for website functionality and security.
Performance cookies: Collect anonymous usage statistics.
Functional cookies: Remember preferences and settings.

We do not use advertising or marketing cookies on our website.

4.2 Cookie management

You can control cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

4.3 Do Not Track

Our website does not respond to Do Not Track signals. We do not track users across third-party websites.

5. How we share your information

We do not sell or rent your personal information. We may share information in the following circumstances:

5.1 Service providers

We share information with trusted third-party service providers who assist with identity verification and compliance screening, technology infrastructure and hosting, security monitoring and threat detection, and legal and professional advisory services. Service providers are contractually obligated to protect your information and use it only for specified purposes.

5.2 Processing Partners and Correspondent Partner

To facilitate underwriting, approval, and processing of your Merchant account, we share your business, financial, and identity information with one or more Processing Partners, including GOAT and other processors, gateways, and sponsoring banks. You understand that ClearBox may submit your information to multiple Processing Partners simultaneously to establish redundant processing capacity.

To facilitate Stablecoin Settlement, we may share relevant transaction information with Cross Mint as our Correspondent Partner.

Sharing is limited to information necessary for underwriting review, transaction execution, and compliance.

5.3 Legal and regulatory requirements

We may disclose information when required by law or in response to court orders, subpoenas, or legal process, regulatory inquiries or investigations, national security or law enforcement requests, or protection of rights, property, or safety.

5.4 Business transfers

If ClearBox is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

5.5 Consent

We may share information with your explicit consent for purposes not described in this policy.

6. Data retention

We retain information for as long as necessary to provide services and maintain transaction records, comply with legal and regulatory obligations, resolve disputes and enforce agreements, and satisfy audit and compliance requirements.

Transaction records: Minimum 7 years, or as required by applicable law.
Compliance and underwriting documentation: Minimum 5 years after relationship termination.
Communications: 3 years from last interaction.
Website usage data: 2 years.

After retention periods expire, we securely delete or anonymize information unless longer retention is required by law. We periodically review and justify retention; data is securely deleted or anonymized thereafter unless law requires otherwise.

7. Data security

7.1 Technical safeguards

Encryption of data in transit and at rest, multi-factor authentication, intrusion detection and prevention systems, regular security audits and penetration testing, secure data centers with physical access controls.

7.2 Organizational safeguards

Access controls and role-based permissions, employee training on data protection, confidentiality agreements with personnel and vendors, incident response and breach notification procedures. In the event of a data breach, we will notify affected Merchants and regulators as required by applicable law.

7.3 Limitations

No security system is impenetrable. While we implement rigorous safeguards, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and promptly notifying us of any suspected unauthorized access.

8. International data transfers

ClearBox may transfer information across borders in connection with Processing Partner or Correspondent Partner relationships. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States or other countries. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses, adequacy determinations, and consent where required.

9. Your rights and choices

Depending on your jurisdiction, you may have the following rights:

9.1 Access and correction: Request access to your personal information and request corrections to inaccurate data.
9.2 Deletion: Request deletion of your information, subject to legal and underwriting-related retention requirements.
9.3 Data portability: Request a copy of your information in a structured, machine-readable format.
9.4 Restriction and objection: Request restriction of processing or object to certain uses of your information.
9.5 Withdraw consent: Withdraw consent for processing based on consent, where applicable.
9.6 Opt out: Unsubscribe from marketing communications.

Exercising your rights: please contact us at info@clear-box.io for all inquiries. We will respond within the timeframe required by applicable law, typically 30 days. We may require identity verification before fulfilling requests.

10. Children's privacy

ClearBox services are not directed to individuals under 18 years of age. We do not knowingly collect information from minors. If we become aware that we have collected information from a minor, we will promptly delete it.

11. Third-party links

Our website may contain links to third-party websites, including current and future Processing Partners, Correspondent Partners, and other service providers. These third-party entities maintain their own independent privacy policies and data practices, which we encourage you to review.

12. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on our website with a revised “Last Updated” date. For significant changes, we will provide prominent notice on our website or direct communication to Merchants. Continued use of our services after changes constitutes acceptance of the updated Privacy Policy.

13. California privacy rights

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information is collected, used, and shared, the right to delete personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. Please contact us at info@clear-box.io for all inquiries.

14. European Economic Area and UK rights

If you are located in the EEA or UK, you have additional rights under the General Data Protection Regulation (GDPR), based on legal grounds including contractual necessity, legitimate interests, legal obligations, and consent where obtained. For GDPR-related inquiries, please contact us at info@clear-box.io for all inquiries. You have the right to lodge a complaint with your local data protection authority.

15. Contact us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at info@clear-box.io for all inquiries.

16. Jurisdiction-specific provisions

16.1 Nevada residents: Nevada residents may opt out of the sale of personal information. We do not sell personal information as defined under Nevada law.
16.2 Virginia, Colorado, Connecticut, Utah residents: Residents of these states have rights similar to those described in section 9. Please contact us at info@clear-box.io for all inquiries.