Privacy Policy
Last updated: 5 November 2026
Controller / business: Supay America Technology LLC, a Colorado limited liability company, doing business as SpeedyFly / Speedyfly (“SpeedyFly,” “we,” “us,” or “our”).
Website: https://speedyfly.io
Privacy contact: support@speedyfly.ltd
This Privacy Policy explains how SpeedyFly collects, uses, shares, and protects personal information when you visit our Website, create a Merchant Account, complete KYC/KYB, use our APIs or dashboards, or interact with SpeedyFly as Merchant of Record (“MoR”) in connection with a purchase from a sub Merchant or supplier’s site.
01Scope
This Policy covers personal information SpeedyFly processes as a business / controller (or similar role under applicable law) for:
- Website visitors and marketing leads;
- Merchant users, developers, and admin contacts;
- KYC/KYB subjects (representatives, directors, beneficial owners as required);
- Buyers when SpeedyFly is MoR or when Buyers contact SpeedyFly support about a MoR Transaction;
- Cookie and device data on SpeedyFly properties.
This Policy does not control independent practices of Merchants on their own sites, or of unaffiliated third parties. Merchants have their own privacy notices for data they collect directly.
Payment card data is typically collected and processed by SpeedyFly’s acquiring banks, payment processors, and gateways under their security programs (including PCI DSS where applicable). SpeedyFly’s systems are designed so that SpeedyFly does not unnecessarily store full PAN/CVV. Exact data flows depend on the integration.
02Categories of Personal Information We Collect
Depending on your relationship with us, we may collect:
2.1 Identifiers and contact data
Name, email, phone, company, job title, mailing/billing address, account usernames.
2.2 Commercial and account data
Merchant Account configuration, Products/URLs, support tickets, communications, contract/fee records, Payout banking details (account identifiers needed for settlement).
2.3 KYC/KYB and compliance data
Government ID data, date of birth, tax identifiers (e.g., SSN/ITIN/EIN or foreign equivalents where lawfully required), company registration documents, ownership percentages, liveness/biometric selfies where used by verification vendors, sanctions/PEP/adverse‑media screening results, IP and device signals used for fraud prevention.
2.4 Transaction and Buyer data (MoR)
Order IDs, Product purchased, amounts, currency, timestamps, billing country/address needed for tax and fraud, partial payment descriptors, refund/Chargeback records, and support correspondence. Full card numbers are generally handled by processors.
2.5 Technical / usage data
IP address, browser type, device identifiers, pages viewed, referring URLs, approximate location derived from IP, log files, and cookie IDs.
2.6 Inferences / risk scores
Fraud, AML, and credit‑risk scores or labels generated from the above for compliance and underwriting.
We do not intentionally collect special‑category data except where embedded in KYC documents you or a Merchant submit and processing is necessary for legal compliance or substantial public interest / legitimate interests as permitted by law.
03Sources
- You — forms, account setup, KYC uploads, emails, support chats;
- Your organization — admin users inviting teammates;
- Automatic collection — cookies, SDKs, logs;
- Merchants — Buyer order details needed for MoR sales and support;
- Service providers — KYC vendors, fraud tools, analytics, hosting;
- Public / compliance sources — sanctions lists, corporate registries, adverse media, as permitted;
- Payment partners — settlement, dispute, and fraud signals.
04How We Use Personal Information
We use personal information to:
- Provide, secure, and improve the Service (accounts, APIs, dashboards, MoR checkout facilitation);
- Complete KYC/KYB, underwriting, ongoing monitoring, sanctions screening, and AML/CTF controls;
- Process MoR Transactions, receipts/invoices, tax calculation/remittance, refunds, and Chargebacks;
- Detect, prevent, and investigate fraud, abuse, and security incidents;
- Communicate service, compliance, and (where permitted) marketing messages;
- Comply with law, Card Network rules, acquirer/processor requirements, and lawful requests;
- Establish, exercise, or defend legal claims;
- Analyze aggregated/de‑identified usage to improve products.
We will not use personal information for materially incompatible purposes without notice or required consent.
05How We Share Personal Information
We may disclose personal information to:
- Service providers / processors — hosting, security, customer support, analytics, email delivery, KYC/identity vendors, tax engines;
- Payment processors, acquirers, card networks, and banking partners — to authorize, settle, dispute, and monitor payments;
- Merchants — Buyer contact and order data needed for fulfillment and Product support on MoR sales (limited to what is needed);
- Professional advisors — lawyers, auditors, insurers under confidentiality;
- Authorities — regulators, law enforcement, courts where required or appropriate;
- Corporate transactions — merger, financing, or sale of assets, subject to appropriate safeguards;
- Parties you authorize — integrations you enable.
We do not sell personal information for money. We do not “share” personal information for cross‑context behavioral advertising as defined by the CPRA unless we update this Policy and provide required opt‑out mechanisms.
06Cookies and Similar Technologies
We use cookies and similar technologies on SpeedyFly properties:
- Essential — authentication, security, load balancing, preference storage required for the Service;
- Functional — remembering settings;
- Analytics / performance — understanding traffic and improving UX
- Marketing (if enabled) — measuring campaigns.
You can control cookies via browser settings. Blocking essential cookies may break login or dashboard features. Where required (e.g., ePrivacy/GDPR), we will present a cookie banner/consent tool before non‑essential cookies.
A short Cookie Notice may appear in the Website footer; this Privacy Policy is the primary description of cookie use.
07International Transfers
SpeedyFly is organized in the United States (Colorado LLC). If you access the Service from outside the U.S., your information may be processed in the U.S. and other countries where our providers operate. Where required, we use appropriate transfer mechanisms (e.g., Standard Contractual Clauses).
08Security and Retention
We implement administrative, technical, and organizational measures appropriate to the risk (access controls, encryption in transit, least‑privilege, vendor diligence). No method of transmission or storage is fully secure.
We retain personal information as long as needed for the purposes above, including:
- Account life plus a reasonable wind‑down period;
- KYC/AML and transaction records generally for at least five (5) years after account closure or as required by BSA/partner rules;
- Longer where needed for disputes, legal holds, or statutory retention.
09Children
SpeedyFly’s merchant Services are not directed to children. We do not knowingly collect personal information from children under 16 (or under 13 where that is the U.S. COPPA threshold for the relevant activity). MoR Product age restrictions are set by Merchants; Buyers must meet SpeedyFly Buyer Terms age rules (generally 18+). Contact us to delete information collected inadvertently from a child.
10Your Privacy Rights
10.1 GDPR / UK GDPR (EEA/UK residents, where applicable)
Subject to legal limits, you may have rights to access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), and to withdraw consent where processing is consent‑based. You may lodge a complaint with a supervisory authority.
Legal bases we rely on may include: contract performance; legitimate interests (security, fraud prevention, product improvement, B2B marketing to existing/prospect businesses where permitted); legal obligations (AML, tax, accounting); and consent (where required for cookies/marketing).
10.2 CCPA/CPRA (California residents)
Subject to verification and exceptions, California residents may request: know/access; delete; correct; and information about categories collected/disclosed. We will not discriminate against you for exercising rights. If we ever “sell” or “share” personal information as defined by CPRA, we will provide a Do Not Sell or Share link.
Sensitive personal information (e.g., government IDs collected for KYC) is used for permitted purposes such as performing services you request and compliance, not for inferring characteristics for advertising.
10.3 Other U.S. state laws
Residents of other U.S. states with consumer privacy laws may have similar rights. We will honor applicable requests.
10.4 How to exercise rights
Email compliance@speedyfly.ltd with “Privacy Request” in the subject. We may need to verify your identity. Authorized agents may submit requests where law allows, with proof of authority.
11Merchant and Buyer Roles (clarity)
| Context | SpeedyFly role (typical) | Notes |
|---|---|---|
| Website visitor / Merchant user | Controller | Account & marketing data |
| KYC/KYB | Controller (compliance) | May use processors |
| MoR Buyer payment data | Controller for order/tax/support; processors handle cards | Descriptor shows SpeedyFly/Supay |
| Merchant’s own marketing site analytics | Merchant’s responsibility | Outside this Policy unless SpeedyFly pixels are used |
Exact controller/processor allocations for a given integration may be set out in a DPA.
12Changes
We may update this Policy by posting a revised version with a new “Last updated” date and, where required, providing additional notice. Continued use of the Service after the effective date means you acknowledge the updated Policy.
13Contact
Supay America Technology LLC DBA SpeedyFly
Email: support@speedyfly.ltd