Privacy Policy

1. INTRODUCTION

This Privacy Policy (“Policy”) explains how Bags Software Inc. (“Bags App”, “we”, “us”, or “our”), a Delaware corporation operating as a Merchant of Record for digital products and services, collects, uses, discloses, and protects your Personal Data. Bags App functions as a Merchant of Record (MoR), meaning we act as the legal reseller of our merchants’ digital products and services. When you purchase a product through a merchant that uses Bags App, you are transacting with us. We appear as the seller on your receipt, invoice, and payment statement. This Policy applies to all individuals who interact with us, including:

• Buyers: Individuals or entities who purchase products or services through Bags App’s checkout, payment links, or subscription flows.
• Merchants (Suppliers): Businesses and individuals who appoint Bags App as their Merchant of Record to resell their products and services globally.
• Site Visitors: Individuals who visit our websites, including getbags.app and docs.getbags.app.
• Applicants: Individuals who apply for employment with Bags App.

This Policy may be updated from time to time to reflect changes in our practices or applicable law. We encourage you to review this Policy periodically. If we make material changes, we will notify you by posting a notice on our website or by other appropriate means.

2. PERSONAL DATA WE COLLECT

We collect Personal Data from multiple sources and in several categories. Not all categories apply to every individual; the data we collect depends on your relationship with Bags App.

2.1 Data Provided Directly By You

• Account registration details (name, email address, password)
• Business information for merchant onboarding (company name, registration documents, beneficial ownership information, tax identification numbers)
• Payment and billing information (billing address, payment card type, last four digits of card number)
• Contact information (email address, phone number, mailing address)
• Communications you send to us (support requests, emails, feedback)
• Employment application data (resume, cover letter, professional history)

2.2 Data Collected Automatically

• Device and browser information (device type, operating system, browser type and version)
• IP address and IP‑based geolocation data (used for tax calculation and fraud prevention)
• Site usage data (pages visited, time spent, referring URLs, click patterns)
• Cookie and tracking technology data (see Section 10 below)

2.3 Blockchain and Cryptocurrency Transaction Data

Because Bags App accepts stablecoin payments (USDC), we collect certain blockchain‑specific data in connection with cryptocurrency transactions. This data is necessary for payment processing, regulatory compliance (including anti‑money laundering obligations), and tax calculation.

• Wallet addresses: The USDC sender wallet address used to make a payment.
• Blockchain network: The network on which the transaction was conducted (Ethereum, Polygon, Solana, or Base).
• Transaction metadata: Transaction hash, amount, timestamp, and confirmation status as recorded on the applicable public blockchain.
• KYT (Know Your Transaction) screening results: Risk scores, sanctions screening results, and flagged address indicators generated by our compliance screening tools.

Note on Blockchain Immutability: Stablecoin transactions occur on decentralized, public ledgers where data remains permanent. While wallet addresses and hashes stay on‑chain beyond our control, Bags App will, upon a legitimate deletion request, scrub all internal, off‑chain records that connect such identifiers to your Personal Data, such as your name or contact details.

2.4 Data From Third Parties

• Identity verification and KYB/KYC data from our verification providers including business registration verification, beneficial ownership checks, sanctions and PEP screening results, and document authentication outcomes.
• Payment processing data from our payment service provider(s), including transaction confirmations, decline reasons, and chargeback notifications.
• KYT and AML screening data from our blockchain analytics and compliance screening providers.
• Credit reference and fraud prevention data from third‑party agencies, where applicable.
• Publicly available data, including information from public blockchain explorers, company registries, and social media profiles you choose to make public.

2.5 Data We Create

We also generate Personal Data about you in the course of our relationship, including records of your interactions with us, transaction histories, risk assessments, compliance screening outcomes, and internal notes related to customer support inquiries.

3. HOW WE USE YOUR PERSONAL DATA

3.1 Providing Our Services

• Processing payments for purchases made through Bags App (both stablecoin and card payments)
• Calculating, collecting, and remitting applicable taxes (VAT, GST, sales tax) in supported jurisdictions, based on information provided by merchants regarding their products
• Managing subscriptions, recurring billing, and invoicing
• Settling payouts to merchants
• Generating and delivering invoices and receipts
• Providing customer support related to transactions, refunds, and disputes

Tax Classification Authority: Bags App retains final, sole, and unreviewable authority to determine the tax classification, localization, and treatment of all digital resales processed through the Services. While Supplier provides initial suggested product characteristics, Bags App shall independently classify the Product and remit all applicable Sales Taxes as the legal seller of record. Supplier shall remain strictly liable under the indemnification framework of this Agreement for any explicit factual misrepresentations regarding the core technical functionality of the Product.

3.2 Compliance and Legal Obligations

• Conducting KYB (Know Your Business) and KYC (Know Your Customer) checks on merchants during onboarding. For buyers, we generally do not require government‑issued identification unless a transaction is flagged by our risk controls or exceeds applicable thresholds.
• Performing KYT (Know Your Transaction) screening on stablecoin transactions before settlement. Transactions that fail screening may be delayed, held, or rejected.
• Screening wallet addresses against OFAC, EU, UN, and other sanctions lists.
• Complying with the FATF Travel Rule by collecting and, where required, transmitting originator and beneficiary information for qualifying cryptocurrency transactions (generally those above USD 1,000 or equivalent). Transactions below this threshold may still be subject to screening. Transactions involving unhosted (self‑custody) wallets may be subject to additional scrutiny and may be delayed or rejected based on our risk assessment.
• Filing Suspicious Activity Reports (SARs) with FinCEN or other authorities as required by law.
• Maintaining records as required by the Bank Secrecy Act (BSA), tax authorities, and other regulatory frameworks.
• Responding to lawful requests from law enforcement, regulators, and governmental authorities.

3.3 Fraud Prevention and Security

• Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and other illegal activities
• Monitoring chargeback rates and dispute patterns across our merchant portfolio
• Enforcing our Merchant Acceptance Policy and Master Services Agreement

3.4 Business Operations

• Operating, maintaining, and improving our websites, APIs, and platform
• Conducting analytics to understand usage patterns and improve our services
• Communicating with you about your account, transactions, or our services
• Managing our internal financial and accounting operations

3.5 Marketing

• Sending promotional communications about Bags App’s products and services, subject to your prior opt‑in consent where required by applicable law

You may opt out of marketing communications at any time by clicking the unsubscribe link in any email or contacting us at privacy@getbags.app.

4. LEGAL BASES FOR PROCESSING (EEA/UK) If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your Personal Data on one or more of the following legal bases under the General Data Protection Regulation (GDPR):

• Contractual Necessity: Processing is necessary to perform our contract with you or to take steps at your request before entering into a contract. This includes processing payments, managing subscriptions, and providing settlement invoices to merchants.
• Legal Obligation: Processing is necessary to comply with a legal obligation to which we are subject, including tax collection and remittance, AML/KYC/KYT screening, sanctions compliance, Travel Rule obligations, record retention requirements, and responding to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing is necessary for our legitimate interests (or those of a third party), provided that such interests are not overridden by your rights and freedoms. Our legitimate interests include fraud prevention and detection, improving and securing our platform, internal analytics, and enforcing our terms and policies.
• Consent: Where we rely on your consent for processing (such as for marketing communications), you may withdraw your consent at any time without affecting the lawfulness of processing that occurred before your withdrawal.
• Automated Decision‑Making: We use automated systems to screen transactions, detect fraud, and assess compliance risks (e.g., KYT and sanctions screening). These automated decisions may result in the rejection or delay of a transaction. If you believe an automated decision has been made in error, you may request human intervention by contacting us at privacy@getbags.app.

5. HOW WE SHARE YOUR PERSONAL DATA

We share your Personal Data with the following categories of recipients, and only to the extent necessary for the purposes described in this Policy:

5.1 Service Providers and Processors

• Payment Service Providers: We use third‑party payment processors (such as Stripe and/or Adyen) to facilitate card payment transactions. These providers receive payment card details, billing addresses, and transaction amounts necessary to process your payments. We do not store your full card number.
• Identity Verification Platforms: We utilize third‑party services to execute merchant KYB and KYC protocols. These entities process business documentation, identity records, and ownership information to authenticate accounts during the onboarding phase.
• Tax Compliance Infrastructure: Automated partners are employed to determine and remit VAT and sales tax. We share transaction details, product categories, and buyer geolocation data with these providers to ensure accurate global tax settlement.
• KYT and Blockchain Analytics Providers: We use compliance screening tools to perform Know Your Transaction (KYT) checks on stablecoin payments. These providers receive wallet addresses, transaction hashes, and network information to generate risk assessments and sanctions screening results.
• Hosting and Infrastructure Providers: We use cloud hosting and infrastructure services to operate our platform. These providers may process Personal Data in the course of providing hosting, storage, and computing services to us.

5.2 Legal and Regulatory Disclosures

• Law enforcement agencies, regulatory authorities, and government bodies, where required by law or in response to valid legal process (such as a subpoena, court order, or regulatory investigation)
• Financial Crimes Enforcement Network (FinCEN) or equivalent authorities in connection with Suspicious Activity Reports (SARs) or other mandatory filings
• Card networks (Visa, Mastercard, American Express) as required by card network rules and regulations

5.3 Merchants (Suppliers) When you purchase through Bags App, we may share limited information with the merchant whose product or service you purchased, to the extent necessary for the merchant to fulfill the order, provide customer support, or deliver digital access. This may include your name, email address, and purchase details. We do not share your full payment card details or wallet addresses with merchants.

5.4 Business Transfers

If Bags App undergoes a merger, acquisition, reorganization, dissolution, or sale of all or a portion of its assets, your Personal Data may be transferred to the successor entity. We will notify you of any such change and any choices you may have regarding your Personal Data.

5.5 With Your Consent

We may share your Personal Data with other third parties where you have provided your explicit consent for us to do so. We do not sell your Personal Data to third parties.

6. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Bags App is incorporated in the United States (Delaware) and our primary data processing operations are located in the United States. If you are located outside the United States, including in the EEA or UK, your Personal Data will be transferred to the United States for processing. Where we transfer Personal Data from the EEA or UK to a country that has not been recognized as providing an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Addendum (IDTA), where applicable
• Any other transfer mechanism permitted under applicable law

You may request a copy of the safeguards we use for international transfers by contacting us at privacy@getbags.app.

7. DATA RETENTION

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our retention periods are determined based on the following criteria:

• Transaction and payment data: Retained for a minimum of five (5) years following the transaction date, as required by applicable tax, financial, and AML record‑keeping obligations (including the Bank Secrecy Act).
• KYB/KYC verification data: Retained for a minimum of five (5) years after the termination of the merchant relationship, as required by AML regulations.
• KYT and blockchain screening data: Retained for a minimum of five (5) years, as required for AML compliance and potential regulatory audits.
• Account and profile data: Retained for the duration of your active account or business relationship with us, plus a reasonable period thereafter to resolve any disputes or fulfill legal obligations.
• Marketing preferences: Retained until you opt out or request deletion, whichever occurs first.
• Site usage and cookie data: Retained in accordance with the retention periods specified in our Cookie Policy.

After the applicable retention period expires, we will either permanently delete or anonymize your Personal Data. If deletion is not immediately possible (for example, because the data is stored in backup archives), we will securely store and isolate the data from further processing until deletion is feasible. Data may persist for a longer period in encrypted backups retained strictly for disaster recovery purposes and not actively processed. Important: Transaction data recorded on public blockchains (including wallet addresses and transaction hashes) cannot be deleted or modified by Bags App. This data exists on decentralized, immutable ledgers outside our control.

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption of Personal Data in transit (TLS/SSL) and at rest
• Access controls limiting Personal Data access to authorized personnel on a need‑to‑know basis
• Regular security assessments and monitoring of our systems
• Use of PCI‑DSS compliant payment processors for card payment data (Bags App does not store, process, or transmit full card numbers directly)
• Secure handling of KYT screening data and blockchain analytics through encrypted channels

No method of electronic transmission or storage is completely secure. While we strive to protect your Personal Data, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

9. YOUR RIGHTS

9.1 Rights of EEA and UK Data Subjects

If you are located in the EEA or UK, you have the following rights under the GDPR:

• Right to Rectification: You may request that we correct any inaccurate or incomplete Personal Data.
• Right to Erasure: You have the right to request the deletion of your Personal Data, though we may be required to maintain specific records for tax and AML compliance. While information recorded on public blockchains—such as wallet addresses and transaction hashes—is immutable and cannot be deleted, we will scrub all internal, off‑chain records that link such identifiers to your personal profile or identity.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances.
• Right to Data Portability: You may request a copy of your Personal Data in a structured, commonly used, machine‑readable format.
• Right to Object: You may object to processing based on our legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where we process your data based on consent, you may withdraw consent at any time.

To exercise any of these rights, please contact us at privacy@getbags.app. We will respond to your request within one (1) month, or within the extended timeframe permitted by applicable law if your request is complex. 9.2 Rights of California Residents (CCPA/CPRA) If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your data.
• Right to Delete: You may request that we delete Personal Information we have collected from you, subject to legal exceptions. Blockchain transaction data on public ledgers is not subject to deletion.
• Right to Correct: You may request that we correct inaccurate Personal Information.
• Right to Opt Out of Sale or Sharing: Bags App does not sell or share your Personal Information as defined by the CCPA.
• Right to Non‑Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at privacy@getbags.app or submit a request through our website. We may need to verify your identity before fulfilling your request.

9.3 Rights of Residents of Other US States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights to access, delete, correct, and opt out of certain processing of their Personal Data. Please contact us at privacy@getbags.app to exercise any applicable rights.

9.4 Nevada Residents

If you are a Nevada resident, you have the right to opt out of the sale of certain Personal Data. Bags App does not sell your Personal Data. To submit an opt‑out request, contact us at privacy@getbags.app with the subject line “Nevada Do Not Sell Request.”

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies (including pixels, web beacons, and local storage) on our websites to:

• Essential cookies: Enable core functionality such as account authentication, security, and payment processing. These cookies are strictly necessary and cannot be disabled.
• Functional cookies: Remember your preferences, such as language and region settings.
• Analytics cookies: Help us understand how visitors use our websites, so we can improve the user experience. We may use third‑party analytics providers such as Google Analytics.

You can control cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our services. Where required by applicable law, we will obtain your consent before placing non‑essential cookies on your device.

11. CHILDREN’S PRIVACY Bags App’s services are not directed at individuals under the age of 16. We do not knowingly collect Personal Data from children under 16. If we become aware that we have inadvertently collected Personal Data from a child under 16, we will take steps to delete such data promptly. If you believe that a child under 16 has provided Personal Data to us, please contact us at privacy@getbags.app.

12. THIRD‑PARTY LINKS AND SERVICES

Our websites and services may contain links to third‑party websites, products, or services that are not owned or controlled by Bags App. This Policy does not apply to any third‑party websites or services. We encourage you to review the privacy policies of any third‑party services you interact with. We are not responsible for the privacy practices or content of third‑party websites.

13. SENSITIVE PERSONAL DATA

We do not intentionally collect or process Sensitive Personal Data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health conditions, sexual orientation, or genetic or biometric data) in the ordinary course of our business as a Merchant of Record. Where processing of Sensitive Personal Data becomes necessary (for example, if such data is incidentally included in identity verification documents submitted during KYB/KYC onboarding), we process it only on the basis of applicable legal requirements, including compliance with AML laws, fraud prevention obligations, or with your explicit consent.

14. DO NOT TRACK SIGNALS

Some web browsers transmit “Do Not Track” (DNT) signals to websites. Because there is no universally accepted standard for how to respond to DNT signals, our websites do not currently respond to DNT signals. We will continue to monitor developments around DNT technology and update our practices if a standard is established.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Policy on our website with a new “Last Updated” date
• Notify you by email or through a prominent notice on our website, where required by applicable law

Your continued use of our services after the effective date of any updated Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

16. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@getbags.app Website: https://getbags.app

17. DEFINITIONS

• “Bags App” means Bags Software Inc., a Delaware corporation, operating as a Merchant of Record under the trade name Bags App.
• “Buyer” means an individual or entity that purchases a product or service through Bags App’s payment infrastructure.
• “Controller” means the entity that determines the purposes and means of processing Personal Data. For this Policy, Bags Software Inc. is the Controller.
• “GDPR” means the General Data Protection Regulation (EU) 2016/679 and, where applicable, the UK General Data Protection Regulation as implemented by the Data Protection Act 2018.
• “KYB” means Know Your Business, the process of verifying the identity, registration, and beneficial ownership of merchant businesses.
• “KYC” means Know Your Customer, the process of verifying the identity of individuals.
• “KYT”means Know Your Transaction, the process of screening cryptocurrency transactions for anti‑money laundering (AML) and sanctions compliance.
• “Merchant” or “Supplier” means a business or individual that has appointed Bags App as its Merchant of Record to resell its products or services.
• “Merchant of Record” means the legal entity that acts as the seller of record for a transaction, assuming responsibility for payment processing, tax collection and remittance, compliance, and liability.
• “Personal Data” means any information that identifies, relates to, describes, or could reasonably be linked to an identified or identifiable individual. This term is used interchangeably with “Personal Information” as defined under the CCPA.
• “Process” or “Processing” means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, alteration, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• “Sensitive Personal Data” means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation, or criminal convictions and offenses.
• “Site” means any website operated by or on behalf of Bags App, including getbags.app and docs.getbags.app
• “Travel Rule” means the requirement under FATF Recommendation 16 (and applicable national implementations) for Virtual Asset Service Providers to collect and transmit originator and beneficiary information for qualifying virtual asset transfers.