Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Gateway Financial ("Gateway Financial," "we," "us," or "our") collects, uses, shares and protects information. It covers gatewayfinancial.io and its subdomains, our forms and applications, phone calls, text messages, emails, and the chat and voice assistants on our website (together, the "Services").

Our services are offered to businesses. Most information we handle is about a business and the people who own, manage or represent it. This policy applies to that information as well.

This policy does not cover information that a processing partner, sponsor bank, equipment provider or other third party collects directly from you. Their own privacy notices govern that information. Once a partner receives your application, it handles your information as an independent business under its own privacy notice and legal obligations.

Our role: an ISO, not a bank

Gateway Financial markets merchant services, reviews processing statements, prepares pricing proposals, helps you complete applications, and supports your account after it is open. Merchant accounts are underwritten, approved and provided by our third-party processing partners and their sponsor (acquiring) banks. Those partners decide on identity verification, credit review, approval, reserves, holds and account closures. Gateway Financial does not make credit or underwriting decisions, does not hold or settle your funds, and is not a party to the bank side of your processing relationship.

Information we collect

Information you give us

• Contact details: name, business name, title, email, phone and mobile number, and mailing address.
• Business information: legal and DBA names, federal tax ID (EIN), business and legal addresses, business type and ownership structure, date established, number of locations, website, industry, how you sell, and your current processor, gateway and point-of-sale system.
• Processing information: monthly card volume, average and maximum ticket size, chargeback and refund rates, billing and fulfillment practices, and the processing statements you upload, which can include account numbers, fees and transaction totals.
• Owner and officer information: full name, title, ownership percentage, home address, date of birth, Social Security number, and a copy of a driver's license or other government ID.
• Bank account information: a voided check or bank letter showing the account and routing number where deposits are sent.
• Communications: messages you send through forms, email, text, chat or voice, call recordings and transcripts, and notes our team makes about your requests.
• Referral information: if an agent or referral partner submits or refers your application, their name and contact details.

Information collected automatically

• Server and security logs: our hosting and security providers process IP address, browser and device type, referring page and timestamps to deliver the site, prevent abuse and keep it secure.
• First-party page counts: we record the page path, referring page and event name (for example, a page view) in our own database. We do not set cookies for this, and we do not store your IP address with it.
• Browser storage: the site saves some things in your own browser, such as a partly completed application or a dismissed banner, so you do not lose your place. This stays on your device until you clear it.
• Abuse prevention: we keep a short-lived, one-way hash of your connection to limit repeated submissions. It cannot be turned back into your IP address and is deleted within 24 hours.

Information from other sources

• Processing partners and sponsor banks, for example whether your application was approved, account status, and information needed to support your account.
• Agents and referral partners who introduce you to us.
• Public sources such as business registries, your website and public business listings, used to verify and complete business information.

Sensitive information

Some application information is sensitive: Social Security numbers, dates of birth, government ID images and bank account details. Processing partners and sponsor banks require it to verify identity, meet "know your customer" and anti-money-laundering obligations, screen against sanctions lists, and assess risk. We collect it only for those purposes and to set up and support your account. We do not use it for marketing, and we do not use it to infer characteristics about you.

Please send sensitive information only through our secure application. Do not include Social Security numbers, full card numbers or bank login details in emails, texts, chat or voice conversations. We will never ask you for a full card number, a bank password or a one-time passcode by phone, text or email.

Credit, identity and risk checks

To evaluate an application, our processing partners and sponsor banks may obtain business credit reports and consumer credit reports on owners, officers and guarantors. They may also verify identity, screen against government sanctions lists, check card network databases of terminated merchants, and run fraud and risk checks. They do this under their own authorizations, policies and legal obligations, including the Fair Credit Reporting Act where it applies. Gateway Financial does not make credit decisions. If an application is declined because of a consumer report, the partner that made the decision is responsible for any notice the law requires.

How we use information

• Answer your questions, review your statements and prepare savings estimates and pricing proposals.
• Prepare, check and submit your application to processing partners, and follow its progress.
• Set up, support and service your account, equipment and software, including chargeback, funding and technical support.
• Communicate with you by phone, email, text and chat, in line with your choices and our SMS Terms.
• Keep records in our customer relationship management system so our team can serve you consistently.
• Operate, secure and improve the Services, including preventing fraud, spam and abuse.
• Pay and reconcile commissions with agents and referral partners.
• Comply with law, card network rules, partner requirements and legal process, and establish or defend legal claims.

How we share information

We share information only as described here:

• Processing partners and sponsor banks to underwrite, approve, board and service your merchant account. This is the core of what we do, and it includes the sensitive information described above.
• Service providers that work for us under contracts limiting how they use information: website hosting, database and file storage, email delivery, our customer relationship management and communications platform (NIRVANI), AI providers that power our chat and voice assistants, and font delivery.
• Equipment and software providers when you order terminals, point-of-sale systems or gateway services, so they can ship, program and support them.
• Agents and referral partners who introduced you, limited to what they need to know about the status of your application and account.
• Affiliates, including our parent company, Integrity Agency, which follow this policy when they handle your information.
• Legal and safety: when required by law, subpoena or other legal process, or when needed to protect rights, property or safety, prevent fraud, or enforce our terms.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under state privacy laws. We have not done so in the past 12 months.

Text messaging privacy

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share mobile numbers only with the messaging providers that deliver our texts. See our SMS Terms for the full program terms.

AI assistants and call recording

Our website chat and voice assistants are powered by artificial intelligence. Conversations with them, and calls with our team, may be recorded, transcribed and stored in our customer relationship management system. We use them to answer you, follow up, train our team and keep accurate records. AI providers process these conversations to deliver the service. By using the assistants or continuing a call after being told it may be recorded, you consent to the recording. See our AI Disclosure.

Cookies and tracking

We do not use advertising cookies, retargeting pixels or cross-site tracking. Our own page counts use no cookies. Some features on our pages come from third parties, such as the chat and voice assistants, the booking calendar and web fonts. Those providers may receive your IP address and set their own cookies or local storage under their own privacy policies. You can block or clear cookies in your browser. The site will still work, though embedded assistants may not.

Because we do not sell or share personal information for advertising, there is nothing to opt out of. We still treat a Global Privacy Control signal as a valid request not to sell or share for any browser that sends one. Browser "Do Not Track" signals do not change how the site works, since we do not track you across sites.

How we protect information

We use administrative, technical and physical safeguards that fit the sensitivity of the information. They include:

• encryption in transit (TLS) across the site;
• access-restricted storage for application documents;
• a password-protected administrative system available only to authorized personnel;
• rate limiting and bot protection on our forms;
• limiting access to people who need it for their work.

Card data is processed by our processing partners under the Payment Card Industry Data Security Standard (PCI DSS). We recommend solutions that keep raw card numbers out of your environment. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and the authorities as the law requires.

How long we keep information

We keep information only as long as we need it for the purposes in this policy. That includes the periods required by law, card network rules and our partner agreements. Records for approved accounts are kept for the life of the account and for a period afterward to meet those obligations and resolve disputes. Information from inquiries, savings reviews, and applications that are declined or never finished is kept while we may still serve you. After that it is deleted or de-identified, unless we must keep it longer. Processing partners keep the information they receive under their own retention schedules.

Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use and share it;
• get a copy of it in a portable format;
• have inaccurate information corrected;
• have it deleted;
• opt out of marketing messages at any time;
• limit the use of sensitive personal information, which we already use only for the purposes above.

These rights come from the laws of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states where they apply to us. We honor reasonable requests from anyone, wherever practical, even where a law does not require it.

How to make a request: email [email protected] with the subject "Privacy Request" or call 949-998-4880. We will verify your identity before we act, usually by matching information we already hold. An authorized agent may submit a request for you with written permission that we can verify. We respond within 45 days, and we will tell you if we need more time as the law allows.

Some information cannot be deleted. Examples are records we or a processing partner must keep for legal, regulatory, card network or fraud prevention reasons, and information needed to service an open account. If we decline a request, we will explain why. Where the law gives you the right, you may appeal by replying to our decision. We will not discriminate against you for using your privacy rights.

California residents may also ask whether we disclosed personal information to third parties for their direct marketing in the prior year (California Civil Code section 1798.83). We do not make those disclosures.

Children

The Services are for businesses and adults. They are not directed to anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Where information is processed

We serve businesses in the United States. Information is processed and stored in the United States and in other countries where our service providers operate. They apply safeguards that meet this policy.

Links to other sites

The Services link to websites and tools run by others, including partners, our parent company and NIRVANI. We are not responsible for their privacy practices. Read their policies before you share information with them.

Changes to this policy

We may update this policy as our services and the law change. We will post the new version here with a new date. If a change materially affects how we use information we already hold, we will give notice through the Services or by email before it takes effect.

Contact us

For privacy questions or requests:

Gateway Financial
16220 N Scottsdale Rd, Suite 300, Scottsdale, AZ 85254
Email: [email protected]
Phone: 949-998-4880