Skip to main content

​
Privacy Policy

⚠️ DRAFT DOCUMENT — PENDING FINAL CORPORATE COUNSEL REVIEW
Last Updated: October 26, 2026 • Version: 1.0-draft
Canonical Reference: https://lifecycle.pcnaid.com/apple-pay/legal/privacy

​
1. Overview & Scope

Pcnaid Inc. (“Pcnaid,” “we,” “our,” or “us”) is committed to protecting the privacy of merchants who use our Lifecycle Manager service and the end-customers who transact on merchant storefronts. This Privacy Policy describes how we handle information across our services.

​
2. Buyer Information & Data Minimization (Zero PAN Storage)

When an end-consumer initiates an Apple Pay transaction, payment tokens and encrypted payment payloads pass through Cloudflare edge infrastructure directly into Stripe Connect for decryption.
Critical Security Architecture: Pcnaid never receives, decrypts, logs, or stores unencrypted credit card numbers, CVVs, or primary account numbers (PANs). Full cardholder data decryption occurs exclusively within Stripe’s PCI DSS Level 1 certified environment.

​
3. Merchant Information We Collect

We collect merchant account data necessary to provide and manage the Service:
  • Account Identity: Merchant business name, authorized contact email, password credentials (managed via Auth0 enterprise authentication).
  • Domain & Platform Configuration: Storefront URL, custom checkout subdomains, and platform OAuth credentials (e.g., Shopify private custom app access tokens).
  • Financial Metadata: Stripe Connected Account ID, transaction reference IDs, gross amount, and fee calculations. We do not store merchant bank account numbers or tax identifiers directly.

​
4. Use of Information

We use collected merchant data strictly to:
  • Provision Apple Pay merchant domain registrations with Apple’s Mass Enablement APIs;
  • Route cryptographic session validation requests via our secure mTLS gateway;
  • Forward completed order webhooks back into Merchant’s e-commerce storefront;
  • Provide merchant dashboard analytics, transaction history, and dispute summaries;
  • Maintain platform security, detect fraudulent activity, and comply with legal obligations.

​
5. Third-Party Service Providers

We share operational data only with trusted infrastructure providers bound by confidentiality and data protection agreements:
  • Stripe: Payment decryption, underwriting, KYC, and settlement processing.
  • Cloudflare: Edge routing, WAF, SSL for SaaS, and DDoS mitigation.
  • Auth0: Identity and access management.
  • PostHog & Sentry: Anonymized performance telemetry and system crash monitoring (session replays on checkout surfaces are strictly hard-disabled).

​
6. Merchant Data Rights & Retention

Merchants may access, export, update, or request deletion of their account information at any time via the dashboard or by contacting privacy@pcnaid.com. We retain transaction audit records only for the period mandated by tax and financial compliance regulations.

​
7. Contact

For privacy and data protection inquiries, email our Data Privacy Officer at privacy@pcnaid.com.