Circuit Privacy Policy

Circuit Pay, Inc. ("Circuit," "we," "us," or "our") respects privacy and is committed to handling information responsibly. This Privacy Policy explains how we collect, use, share, and protect information when you visit our websites, including circuitdata.ai and its subdomains, when you contact us, and when your business uses our data intelligence platform and related services (collectively, the "Services").

Circuit operates a business-to-business platform. We do not market or sell the Services to individual consumers. Our platform processes transaction-level data from point-of-sale ("POS") systems and related operational sources in order to produce cohort intelligence, benchmarking, and measurement and attribution analyses for business customers.

One commitment sits ahead of everything else in this Policy: Circuit does not identify individuals. We do not resolve consumer identity, we do not build, license, purchase, or contribute to consumer identity graphs, we do not join transaction data to loyalty, card, device, or household identifiers, and we do not infer individual-level attributes of any kind. The unit of analysis in our products is the basket, the venue, the cohort, and the market — never the person. Where the rest of this Policy describes how we handle personal information, it is describing information about business contacts, platform users, website visitors, and payees, not profiles of the consumers who shop or dine at participating venues.

If you have questions about this Policy, contact us at privacy@circuitdata.ai.

1. Scope

This Policy covers:

1. information about visitors to our websites and people who contact us, sign up for our newsletter, or attend our events;
2. information about the personnel of our business customers and prospects, including users of the platform; and
3. transaction and operational data that our customers, participating venues, and their POS, payments, and related providers transmit to us through the Services;
4. information about independent contractors, sales agents, and referral partners who work with Circuit; and
5. materials that business customers supply to us in connection with measurement and attribution engagements.

This Policy does not cover the privacy practices of our customers or of third-party services that integrate with the Services. Where we process data on behalf of a customer (for example, processing transaction records from that customer's venues), the customer is the controller of that data and its own privacy notice governs the relationship with end consumers and staff.

2. Information We Collect

2.1 Information you provide directly

When you interact with Circuit, you may give us:

1. Contact and identifying information, such as name, business email address, phone number, job title, and company name;
2. Account and authentication information, including login credentials and account preferences;
3. Commercial information, such as the business you operate, the venues or locations you manage, your POS provider, and other information needed to set up the Services;
4. Communications, such as messages, support requests, survey responses, and feedback; and
5. Payment information, such as billing address and payment method details. Payment card information is collected and processed by our payment processor and is not stored by Circuit; and
6. Payee and tax information, where Circuit pays you — for example as a participating venue receiving a revenue share, or as an independent sales agent or referral partner receiving commission. This may include legal payee name, tax classification and taxpayer identification number (Form W-9), bank account and routing numbers or a voided check, and payment history. We collect this in order to pay you and to meet our tax reporting obligations.

2.2 Information from POS systems and other integrated sources

When you connect a POS system, payment processor, accounting system, third-party delivery platform, or similar integration to the Services, we receive transaction-level and operational data from those sources. This typically includes:

1. transaction records, including dates, times, items, quantities, prices, taxes, tips, discounts, and totals;
2. menu, inventory, and product catalog data;
3. payment metadata such as tender type, last four digits of cards, authorization codes, and tokenized payment identifiers (we do not collect or store full payment card numbers);
4. venue, location, and device identifiers; and
5. operational metadata such as employee or shift identifiers used by the POS system; and
6. menu, promotional, and merchandising materials a venue uploads to us, such as menus, table tents, and program collateral.

We do not seek to collect cardholder personal information through these integrations. Where the POS or processor transmits tokenized identifiers, those tokens are designed to be non-identifying without separate, restricted-access information that Circuit does not store alongside them.

We do not use tender type, truncated card digits, authorization codes, tokenized identifiers, or any other payment metadata to identify a consumer, to link a consumer's transactions across venues or over time, or to match transactions to loyalty, advertising, device, or household data. We do not maintain, license, or contribute to any consumer identity graph, and we do not offer card-linked measurement or household panels.

2.3 Information collected automatically

When you visit our websites or use the platform, we and our service providers automatically collect:

1. Device and connection information, such as IP address, browser type, operating system, device identifiers, and language settings;
2. Usage information, such as pages viewed, links clicked, referring and exit pages, time on page, and other interactions with our websites and platform; and
3. Cookies and similar technologies, as described in Section 8.

2.4 Information from third parties

We may receive information about you or your business from publicly available sources, business data providers, our customers (for example, when a customer adds you as an authorized user), our channel partners, our data licensors, and analytics or marketing service providers.

A substantial portion of the historical transaction data underlying our analytical models is licensed to Circuit by third-party providers under written agreements, rather than collected by us directly.

2.5 Materials supplied for measurement engagements

Where a business customer engages us to measure the effect of its commercial activity, that customer supplies information describing the activity — for example trade and promotional calendars, program and campaign plans, placement and execution records, offer and redemption data, pricing structures, and media schedules. These materials describe the customer's own programs. They are treated as that customer's confidential information, are used only to perform that engagement, and are not disclosed to other customers.

2.6 Contextual and public data

We incorporate third-party and publicly available contextual data into our analyses in order to distinguish the effect of a customer's activity from external factors that independently affect purchasing. This includes weather data, calendar and holiday data, sporting and entertainment event schedules, and similar market-level demand signals. This data describes places, dates, and conditions rather than individuals.

3. How We Use Information

We use the information described above to:

1. provide, maintain, secure, and support the Services and our websites;
2. authenticate users, manage accounts, and process payments;
3. produce analytics, reconciliations, reports, and other outputs for our customers;
4. develop, improve, and train our analytical models and underlying technology;
5. create aggregated and de-identified data sets used for cohort intelligence, benchmarks, measurement and attribution analyses, market intelligence, research, and data products, as further described in Section 5;
6. calculate, process, and report payments owed to participating venues, sales agents, and referral partners, and meet related tax reporting obligations;
7. communicate with you about the Services, respond to inquiries, and send service notices and security alerts;
8. send marketing and promotional messages where permitted by law, with the ability to opt out at any time;
9. measure the performance of our marketing, websites, and Services;
10. detect, investigate, and prevent fraud, security incidents, and misuse of the Services;
11. comply with legal obligations and enforce our agreements; and
12. carry out corporate transactions such as financings, audits, and mergers and acquisitions.

We rely on the following legal bases where required by law: performance of a contract, our legitimate interests in operating and improving the Services, your consent (where applicable), and compliance with legal obligations.

3.1 What we do not do

For the avoidance of doubt, we do not:

1. identify, resolve, or infer the identity of any individual consumer, or build profiles of individual consumers;
2. create, license, purchase, or contribute to consumer identity graphs, household panels, or card-linked measurement products;
3. match transaction data to loyalty programs, advertising identifiers, device identifiers, or third-party consumer profiles;
4. use transaction data to target advertising to individuals, or sell advertising of any kind;
5. identify an individual participating venue in any output we make available to a brand, distributor, agency, or other buyer; or
6. run, fund, place, or administer the trade, promotional, or media programs we measure, or route funds between a brand and a venue.

4. How We Share Information

We share information in the following ways:

1. With service providers and processors that help us deliver the Services, including hosting, infrastructure, security, analytics, communications, and payments providers. These providers are bound by contract to use information only to provide services to us.
2. With our customers, where you are a user authorized by a customer or where information relates to that customer's account.
3. With integration partners, such as POS, payments, and accounting providers, where necessary to enable a connection that you or our customer has authorized.
4. With subscribing and measurement customers, such as brands, retail media networks, offers and promotions platforms, agencies, and distributors, in the form of aggregated cohort reporting and measurement results as described in Section 5. These outputs describe cohort-level and market-level behavior. They do not identify individual consumers, and they do not identify an individual participating business. Circuit does not offer a consent-based exception to this rule: a participating business cannot elect to be identified in an output provided to a buyer.
5. For corporate transactions, including in connection with a financing, merger, acquisition, sale of assets, or similar transaction, subject to standard confidentiality protections.
6. For legal and safety reasons, where we believe disclosure is necessary to comply with law, to respond to lawful requests from public authorities, to protect the rights, property, or safety of Circuit, our customers, or others, or to enforce our agreements.
7. With your direction or consent, including where you authorize a specific disclosure.
8. Aggregated or de-identified information, as described in Section 5, which is not personal information once aggregated or de-identified.

We do not sell personal information in exchange for monetary consideration. To the extent any of our data sharing constitutes a "sale" or "sharing" under specific state laws (for example, California, Colorado, or other states with similar definitions), we honor the rights described in Section 9.

5. Aggregated and De-Identified Data

A core function of our platform is to produce aggregated and de-identified data sets that combine information across many businesses and venues. We use these data sets to operate and improve the Services, build analytical models, produce cohort intelligence and measurement analyses, and create data products and reports that we may share with commercial partners — including consumer packaged goods and beverage companies, retail media networks, offers and promotions platforms, agencies, distributors, retailers, and other industry participants.

When we aggregate or de-identify data, we apply technical and organizational measures designed to ensure that the data cannot reasonably be used to identify a specific individual or, where applicable, a specific participating business. Because some cohorts and market panels are made up of a limited number of venues, every reported breakout must meet a minimum venue count before it is rendered at all, and outputs that fall below that threshold are withheld entirely rather than published with a caveat. We do not publish figures attributable to an individual venue, and a venue cannot consent to be identified in an output provided to a buyer. Once aggregated or de-identified, data is not personal information under this Policy and may be used and shared subject to applicable law and to those controls.

We do not attempt to re-identify de-identified data, and we contractually require recipients of such data not to attempt re-identification — of an individual, a household, or a participating venue. We do not sell or license individual-level data, and we do not offer any product that returns consumer-level records.

6. Data Retention

We retain information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of information, the purpose for which it was collected, and any applicable legal or contractual requirements.

Aggregated and de-identified data may be retained indefinitely. Materials supplied by a customer for a measurement engagement are retained for the period stated in that customer's agreement and are then deleted or de-identified.

When we no longer need information, we delete it or, where deletion is not feasible (for example, because it is stored in backup archives), we securely isolate it from further processing until deletion is possible.

7. Security

We maintain technical, organizational, and administrative safeguards designed to protect information against unauthorized access, use, alteration, and destruction. These include encryption in transit, access controls, monitoring, and personnel training. No system is completely secure, and we cannot guarantee that information will never be accessed in ways inconsistent with this Policy. If you believe your account or information has been compromised, contact us at security@circuitdata.ai.

8. Cookies and Similar Technologies

We use cookies and similar technologies on our websites and within the platform to authenticate users, remember preferences, measure usage, and support marketing.

You can control cookies through your browser settings and, where available, through cookie preference tools we provide. Disabling cookies may affect the functionality of our websites and Services. Where required by law, we obtain consent before placing non-essential cookies.

We do not respond to "Do Not Track" browser signals at this time, but we honor opt-out signals, such as the Global Privacy Control, where required by applicable law.

9. Your Rights and Choices

Depending on your location, you may have the following rights with respect to your personal information:

1. Access to information we hold about you;
2. Correction of inaccurate or incomplete information;
3. Deletion of your information, subject to certain exceptions;
4. Portability of information you provided to us;
5. Restriction or objection to certain processing;
6. Withdrawal of consent where processing is based on consent;
7. Opt out of targeted advertising, profiling, or any sharing or sale of personal information, where applicable;
8. Non-discrimination for exercising your rights; and
9. Appeal of our decision regarding a privacy request, where required by law.

To exercise any of these rights, contact us at privacy@circuitdata.ai. We will verify your request as required by law and respond within the timeframes set by applicable law. If your information was provided to us by a business customer (for example, your employer), we will direct your request to that customer where appropriate.

You may opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us. Service-related communications, such as security and account notices, are not promotional and cannot be opted out of while you have an account.

10. International Data Transfers

Circuit Pay, Inc. is a Delaware corporation. The Services are hosted and the underlying data processed in the United States, and our personnel and service providers may operate in the United States, Canada, and other countries. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other jurisdictions whose data protection laws may differ from those of your jurisdiction. Where required, we use appropriate transfer mechanisms, such as standard contractual clauses, to protect your information.

11. Children

The Services are a business-to-business platform, are not directed to children, and are not intended for anyone under 18. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us at privacy@circuitdata.ai and we will take appropriate steps to delete it.

12. Third-Party Sites and Services

Our websites and Services may contain links to or integrate with third-party websites and services that we do not operate. This Policy does not apply to those third-party services, and we encourage you to review their privacy notices.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top. If the changes are material, we will provide additional notice, such as by posting a notice on our website or sending notice to your account contact. Your continued use of the Services after the updated Policy takes effect constitutes acceptance of the changes.

14. Contact Us

If you have questions, requests, or complaints regarding this Policy or our privacy practices, contact us at:

Circuit Pay, Inc.
Attn: Privacy
155 Hamptons Link NW
Calgary, AB T3A 5V9
Canada
Email: privacy@circuitdata.ai

If you are in a jurisdiction that requires it, you also have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns first.

15. Region-Specific Notices

15.1 California residents

This section provides additional disclosures required by the California Consumer Privacy Act, as amended ("CCPA").

In the twelve (12) months preceding the date above, we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet or network activity, professional or employment-related information, and inferences drawn from these categories). We collect this information for the business and commercial purposes described in Section 3 and disclose it to the categories of recipients described in Section 4.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of California residents under 16. To the extent any of our processing is treated as a "sale" or "sharing" under the CCPA, you may opt out by contacting us at privacy@circuitdata.ai or by using the controls provided on our website.

California residents may exercise the rights described in Section 9, including the right to know, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right to non-discrimination. You may designate an authorized agent to make a request on your behalf, subject to our verification process.

15.2 Other U.S. state residents

Residents of states with comprehensive privacy laws (including, where applicable, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others) have rights similar to those described in Section 9. To exercise those rights, including the right to appeal a decision regarding a privacy request, contact us at privacy@circuitdata.ai.

15.3 Canada

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) or a substantially similar provincial law applies, we handle personal information in accordance with those requirements, including the accountability, limiting collection, and safeguards principles. You may request access to or correction of your personal information, or raise a concern about our handling of it, at privacy@circuitdata.ai. You may also contact the Office of the Privacy Commissioner of Canada.

15.4 European Economic Area, United Kingdom, and Switzerland

Where applicable data protection law (including the GDPR and UK GDPR) applies, Circuit is the controller of personal information processed about visitors to our websites, our personnel contacts, and our prospects. Where we process personal information on behalf of a business customer, that customer is the controller and Circuit acts as a processor under a written agreement with the customer.

You have the rights described in Section 9, and you may contact us at privacy@circuitdata.ai to exercise them. You also have the right to lodge a complaint with your local supervisory authority.