Riskopus Privacy Policy

This Privacy Policy describes how CloverApps LLC ("Riskopus", "we", "us", or "our") collects, uses, discloses, and safeguards personal data when Merchants ("Customer", "you") access or use our software-as-a-service risk management platform, APIs, and associated web services (collectively, the "Services")

1. SCOPE AND APPLICABILITY

This Privacy Policy applies to personal data collected, processed, or handled by Riskopus across all touchpoints, including:

Merchants (Customers): Representatives, account administrators, and billing contacts using our SaaS platform and APIs.

Website Visitors: Individuals visiting riskopus.com and associated marketing or informational web properties.

Invited Team Members: Users added to merchant dashboards with specific role-based permissions.

Cardholders & End-Users: Customers whose transaction, order, and dispute data is processed via Merchant integrations with connected Payment Service Providers (PSPs) and commerce platforms.

2. ROLES & APPLICABLE DATA PROTECTION FRAMEWORK

2.1. Dual Roles under Data Protection Laws: Under applicable data protection laws (including the EU/UK GDPR, CCPA/CPRA, and the Delaware Personal Data Privacy Act - DPDPA):

(a) Riskopus as Data Controller: Riskopus acts as an independent Data Controller (or Business) with respect to personal data collected directly from Merchant representatives, website visitors, and invited users for account administration, identity verification, billing, platform security, and relationship management.

(b) Riskopus as Data Processor: Riskopus acts as a Data Processor (or Service Provider) with respect to End-User transactional, customer, and dispute data processed on behalf of Merchant to deliver the Services. 2.2. Data Processing Addendum (DPA): All processing of End-User personal data on behalf of Merchants is governed by our Data Processing Addendum ("DPA"), which is incorporated into our Master Terms of Service.

3. CATEGORIES OF PERSONAL DATA WE PROCESS

3.1. Merchant & Account Data: We collect information provided directly by merchant representatives during registration and account setup, including full name, corporate email address, phone number, login credentials, billing details, and IP/access logs.

3.2. Transaction and Dispute Data (Cardholders): Depending on the Services used by the Merchant and data made available through connected PSPs, commerce platforms, card networks, and alert providers, Riskopus may process: transaction identifiers, order identifiers, transaction amount and currency, transaction date and status, dispute and chargeback information, payment method metadata, BIN/IIN information, issuing bank information, customer contact details (such as customer name, email, IP address, and delivery addresses), and related fraud or alert signals.

3.3. Exclusion of Sensitive Payment Card Data: Riskopus does not intentionally collect, process, or store full payment card numbers (Primary Account Numbers / PAN), CVV/CVC security codes, or other sensitive authentication data. All cardholder payment data remains strictly tokenized within your connected PCI-compliant Payment Service Providers.

4. PURPOSES OF PROCESSING & LEGAL BASES

We process personal data solely for the following legitimate business and operational purposes:

Providing, maintaining, securing, and administering the Riskopus platform and Services.

Processing dispute evidence and automating chargeback representments as directed by Merchant.

Analyzing merchant-level health metrics, risk indicators, and network monitoring thresholds.

Executing Merchant-configured rules (such as automated refund API commands upon alert receipt).

Complying with applicable legal, regulatory, and contractual obligations.

5. SECURITY MEASURES

Riskopus implements and maintains robust administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or alteration. These measures include:

Industry-standard encryption for personal data in transit (TLS/HTTPS) and at rest (AES-256).

Tokenization protocols ensuring sensitive card data is never exposed.

Strict role-based access controls (RBAC), multi-factor authentication (MFA) requirements for administrative access, and comprehensive security audit logging.

6. DATA RETENTION & DELETION PROCESSES

6.1. Retention Periods: Riskopus retains personal data only for as long as necessary to fulfill the purposes outlined herein, comply with legal obligations, resolve disputes, and enforce agreements. Aligned with our operational standards:

Transaction, Dispute & Evidence Data: Retained for up to 180 days (or longer if required by ongoing dispute lifecycles or network rules).

Security & Audit Logs: Retained for 90 days.

Merchant Account Metadata & Login Logs: Retained for 30 days following account termination or closure.

6.2. Cardholder Erasure & Deletion Requests: When a cardholder or end-user submits a deletion request under GDPR/CCPA to a Merchant, the Merchant coordinates deletion through connected platform integrations. For Shopify and integrated merchants, automated webhook triggers process customer deletion and data erasure requests in compliance with platform rules.

7. AI MODEL TRAINING & SUBPROCESSORS

7.1. AI Providers & Zero-Training Commitment: Riskopus utilizes advanced AI models (such as OpenAI and Anthropic) to power dispute generation and risk insights. Our AI model providers operate under strict zero-data-retention and no-training commitments regarding customer personal data (i.e., your data is never used to train their foundational public models). 7.2. Aggregated Platform Analytics: Riskopus may use aggregated and/or anonymized data (such as platform-wide win rates or win_odds) that does not reasonably identify any Merchant or individual to evaluate and improve its AI models and analytics. 7.3. Authorized Subprocessors: We disclose personal data only to authorized subprocessors under strict confidentiality obligations, including:

Cloud Infrastructure & Database: AWS / Google Cloud Platform (GCP).

Payment & Billing: Stripe, Inc.

Alert Partners: Chargeblast / Ethoca / Verifi.

Communications & AI Infrastructure: Email providers and AI model hosts.

8. INTERNATIONAL DATA TRANSFERS

As a Delaware corporation handling global and European data, Riskopus complies with cross-border transfer requirements. Transfers of personal data originating from the European Economic Area (EEA) or the United Kingdom to the United States are secured through the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum incorporated into our DPA.

9. DATA SUBJECT RIGHTS (GDPR, CCPA & DPDPA)

Depending on your jurisdiction, individuals possess specific rights regarding their personal data, including:

Right of Access: Request confirmation of whether we process your data and access copies of your personal data.

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data.

Right to Restriction / Objection: Object to or restrict our processing of your personal data.

Right to Data Portability: Request transfer of your data to another controller.

Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority.

To exercise these rights, individuals may submit requests directly to our privacy team at [email protected].

10. CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify or update this Privacy Policy at any time. Material changes will be communicated to active Merchants via email or prominent notice within the Riskopus platform prior to their effective date, with the updated "Effective Date" displayed at the top.

11. CONTACT INFORMATION

For questions, concerns, or legal inquiries regarding this Privacy Policy or our privacy practices, please contact us at: CloverApps LLC (dba Riskopus) Attention: Privacy & Legal Compliance Team Email: [email protected] Corporate Headquarters: 131 Continental Dr, Suite 305, Newark, DE 19713, USA