This privacy policy explains how personal data is processed when you visit fractionalpay.com, create an account, use the FractionalPay dashboard and API, or pay for a subscription.
Who is responsible for your data
The controller of personal data processed through the service is the administrator of the fractionalpay.com service, reachable at [email protected]. Write to this address for any question or request about your data.
When you use FractionalPay to split payments for your own platform, the personal data of your customers and beneficiaries that passes through the service is processed on your behalf. In that relationship you are the controller and the administrator of the fractionalpay.com service acts as your processor, following your instructions and the terms of service.
What we collect
Account data. Your email address, a hashed password, your name if you add it, your workspace and team details, roles and sign-in history.
Billing data. The plan, billing period, invoices, your company name, billing address and tax ID if you add them. Card details are entered at our payment operator and never reach our servers. We receive only the card brand, the last four digits and the expiry date.
Product data you send us. Beneficiaries (names, email addresses, countries, payout currencies, connected account IDs at your operator, tax form status), split rules, payment events from your connected operator account (amounts, currencies, references, metadata), ledger entries, payouts and reconciliation results.
Connection data. Access tokens for your connected operator account, stored encrypted, and webhook endpoints with their signing secrets.
Technical data. IP address, browser and device type, pages requested and timestamps in server logs, kept for security and troubleshooting. API requests are logged with the key prefix, endpoint, status and time.
Demo data. When you use the split simulator without an account, the amounts and roles you enter are stored with a random token so that you can return to your result. They are not linked to you unless you sign up.
Why we process it and on what legal basis
- To create your account and provide the service you signed up for (performance of a contract).
- To take subscription payments, issue invoices and keep accounting records (performance of a contract and legal obligations).
- To send sign-in codes, security notices, payout and reconciliation alerts and billing messages (performance of a contract).
- To keep the service secure, prevent abuse and investigate incidents (legitimate interest).
- To process your customers' and beneficiaries' data on your instructions (as your processor).
We do not sell personal data, we do not use it for advertising and we do not build profiles of visitors.
Who receives the data
We use a small number of service providers that process data on our behalf under written agreements, in these categories:
- a hosting provider in the European Union that runs our servers and databases,
- the payment operator that processes our own subscription payments,
- an email delivery provider that sends sign-in codes and service messages.
Your connected payment operator receives payout instructions that you configure, because that is how the service works. Public authorities receive data only where the law requires it.
Transfers outside the European Economic Area
Where a provider processes data outside the European Economic Area, the transfer is covered by an adequacy decision or by standard contractual clauses approved by the European Commission.
Cookies
The site uses essential cookies only: a session cookie that keeps you signed in, a security token that protects forms, and a cookie that remembers the demo you started. They are needed for the site to work, so there is no consent banner. We do not use advertising pixels, cross-site tracking or third-party analytics cookies. You can delete cookies in your browser at any time, which signs you out.
How long we keep data
- Account and workspace data: for as long as your account exists, then deleted within 30 days of account deletion.
- Ledger, payment and payout records: for the life of the workspace, because the ledger is append-only, and afterwards as long as needed for your and our legal record keeping.
- Invoices and billing records: as long as tax and accounting law requires.
- Server and API logs: up to 90 days, longer only when needed for a security investigation.
- Demo results without an account: up to 30 days.
Your rights
Under the GDPR you have the right to access your data, to have it corrected, deleted or restricted, to object to processing based on legitimate interest, and to receive the data you gave us in a portable format. You can export most data yourself from the dashboard. For anything else write to [email protected] from the email address of your account. We answer within one month.
If your data reached us through a platform that uses FractionalPay, please contact that platform first, because it decides how your data is used. We will help it answer your request.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.
Security
Data is encrypted in transit. Operator tokens and webhook secrets are encrypted at rest, API keys are stored only as hashes, and access is limited by roles. More detail is on the security page.
Changes to this policy
We update this policy when the service or the law changes. The date at the top shows the latest version. Material changes are announced by email to account owners before they take effect.